对增强工具的语义攻击：保护模型上下文协议免受描述级操纵
Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation
AI总结：
本文研究了通过工具描述符与外部工具交互的模型上下文协议（MCP）中存在的语义攻击问题，提出了一种分层防御方案，通过描述符完整性验证、预上下文语义审查和轻量级运行时防护机制，有效降低描述级操纵导致的不安全工具调用风险。
摘要：
模型上下文协议（MCP）使大型语言模型（LLMs）能够通过工具描述符与外部工具交互，从而扩展其任务执行、自主决策和多智能体协调的能力。现有MCP部署将工具描述符视为可信元数据，尽管其直接整合到LLM推理上下文中。这引入了一个此前未被充分探索的语义攻击面。当前防御主要针对提示注入，忽略了描述级操纵可能偏转工具选择和后续推理。为解决这一差距，我们正式化了三种描述驱动攻击类别：工具污染、影子和拉扯。我们提出了一种分层防御方案，整合描述符完整性验证、预上下文语义审查与辅助LLM以及轻量级运行时防护机制，无需模型重新训练。我们评估了GPT-5.3、DeepSeek-V3和LLaMA-3.5在八个提示策略下的表现，在受控的对抗性MCP场景中，工具元数据被操纵以模拟现实攻击。结果表明，描述操纵可以显著改变工具选择行为，在基线配置下，导致高达36%的不安全工具调用。所提出的全栈缓解措施将不安全调用减少到15%，同时将阻断率提高到74%，显示出对描述驱动攻击的显著改进。跨模型分析进一步揭示了不同LLM架构和提示策略在鲁棒性、延迟和对描述级操纵的敏感性方面的显著差异。本研究提供了对描述级威胁和缓解策略的受控跨模型评估，为部署安全且稳健的工具增强LLM奠定了实证基础。
英文摘要：
The Model Context Protocol (MCP) enables Large Language Models (LLMs) to interact with external tools via tool descriptors, thereby extending their capabilities for task execution, autonomous decision-making, and multi-agent coordination. Existing MCP deployments treat tool descriptors as trusted metadata, despite their direct integration into the LLM reasoning context. This introduces a previously underexplored semantic attack surface. Current defenses primarily target prompt injection, neglecting descriptor-level manipulation that can bias tool selection and downstream reasoning. To address this gap, we formalize three descriptor-driven attack classes: Tool Poisoning, Shadowing, and Rug Pull. We propose a layered defense solution that integrates descriptor integrity verification, pre-context semantic vetting with an auxiliary LLM, and lightweight runtime guardrails, without requiring model retraining. We evaluate GPT-5.3, DeepSeek-V3, and LLaMA-3.5 across eight prompting strategies in controlled, adversarial MCP scenarios in which tool metadata is manipulated to simulate realistic attacks. Results demonstrate that descriptor manipulation can substantially alter tool-selection behavior, producing unsafe tool invocations in up to 36% of trials under baseline configurations. The proposed full-stack mitigation reduces unsafe invocations to 15% while increasing the block rate to 74%, demonstrating substantial improvement in resistance to descriptor-driven attacks. Cross-model analysis further reveals significant differences in robustness, latency, and sensitivity to descriptor-level manipulation across LLM architectures and prompting strategies. This study provides a controlled cross-model evaluation of descriptor-level threats and mitigation strategies in tool-calling LLM systems, establishing an empirical foundation for deploying secure and resilient tool-augmented LLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
