EIA：针对通用网络智能体的环境注入攻击以窃取隐私
EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
AI总结：
本文首次研究对抗环境下通用网络智能体的隐私风险，提出环境注入攻击EIA，通过注入适应网页环境的恶意内容窃取用户PII或完整请求，实验显示最高70%攻击成功率且难以检测，并探讨了部署前后防御策略。
摘要：
通用网络智能体在真实网站上自主完成广泛任务方面已展现出显著潜力，大幅提升了人类生产力。然而，诸如预订航班等网络任务通常涉及用户的个人身份信息（PII），如果网络智能体意外与受攻击的网站交互，这些信息可能面临隐私泄露风险，而这一场景在现有文献中仍基本未被探索。在本工作中，我们通过首次研究对抗环境下通用网络智能体的隐私风险来填补这一空白。首先，我们提出一种针对网站攻击的现实威胁模型，其中考虑两个对抗目标：窃取用户的特定PII或整个用户请求。然后，我们提出一种新的攻击方法，称为环境注入攻击（EIA）。EIA注入经过设计以良好适应智能体运行环境的恶意内容，我们的工作专门针对网络环境中的隐私场景实例化了EIA。我们从Mind2Web收集了177个涉及真实网站上多种PII类别的动作步骤，并使用迄今为止能力最强的通用网络智能体框架之一进行实验。结果表明，EIA在窃取特定PII方面实现了高达70%的攻击成功率（ASR），在窃取完整用户请求方面实现了16%的ASR。此外，通过评估隐蔽性并实验防御性系统提示，我们表明EIA难以被检测和缓解。值得注意的是，未针对网页进行良好适应的攻击可以通过人工检查被发现，这引出了我们对安全性与自主性之间权衡的讨论。然而，攻击者额外的努力可以使EIA实现无缝适应，从而使此类人工监督失效。因此，我们进一步讨论了不依赖人工监督的网站部署前和部署后阶段的防御措施，并呼吁提出更先进的防御策略。
英文摘要：
Generalist web agents have demonstrated remarkable potential in autonomously completing a wide range of tasks on real websites, significantly boosting human productivity. However, web tasks, such as booking flights, usually involve users' PII, which may be exposed to potential privacy risks if web agents accidentally interact with compromised websites, a scenario that remains largely unexplored in the literature. In this work, we narrow this gap by conducting the first study on the privacy risks of generalist web agents in adversarial environments. First, we present a realistic threat model for attacks on the website, where we consider two adversarial targets: stealing users' specific PII or the entire user request. Then, we propose a novel attack method, termed Environmental Injection Attack (EIA). EIA injects malicious content designed to adapt well to environments where the agents operate and our work instantiates EIA specifically for privacy scenarios in web environments. We collect 177 action steps that involve diverse PII categories on realistic websites from the Mind2Web, and conduct experiments using one of the most capable generalist web agent frameworks to date. The results demonstrate that EIA achieves up to 70% ASR in stealing specific PII and 16% ASR for full user request. Additionally, by accessing the stealthiness and experimenting with a defensive system prompt, we indicate that EIA is hard to detect and mitigate. Notably, attacks that are not well adapted for a webpage can be detected via human inspection, leading to our discussion about the trade-off between security and autonomy. However, extra attackers' efforts can make EIA seamlessly adapted, rendering such supervision ineffective. Thus, we further discuss the defenses at the pre- and post-deployment stages of the websites without relying on human supervision and call for more advanced defense strategies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
