镜面迷雾：针对基于大语言模型的钓鱼检测的隐秘提示注入攻击
Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection
AI总结：
本文首次全面评估了针对基于大语言模型的钓鱼检测的提示注入攻击，提出InjectDefuser防御框架以降低攻击成功率。
摘要：
钓鱼网站的数量和复杂性仍在持续增长。近期的研究利用大语言模型（LLMs）分析URL、HTML和渲染内容以决定网站是否为钓鱼网站。尽管这些方法具有前景，但LLMs本质上容易受到提示注入（PI）攻击。由于攻击者可以完全控制钓鱼网站的各种元素，这为利用LLMs与人类之间的感知不对称性而产生的PI攻击创造了可能性：对终端用户不可察觉的指令仍可被LLM解析并隐秘地操控其判断。PI在钓鱼检测中的具体风险和有效的缓解策略仍鲜有研究。本文首次全面评估了PI对多模态LLM基于钓鱼检测的威胁。我们引入了一个二维分类法，由攻击技术与攻击表面定义，以捕捉现实中的PI策略。利用此分类法，我们实施了多种攻击，并实证研究了几种代表性的LLM检测系统。结果表明，使用最先进的模型如GPT-5进行的钓鱼检测仍易受PI攻击。我们随后提出了InjectDefuser，一种结合提示加固、基于允许列表的检索增强和输出验证的防御框架。在多个模型上，InjectDefuser显著降低了攻击成功率。我们的发现澄清了PI的风险图景，并提供了实用的防御措施，以提高下一代钓鱼反制措施的可靠性。
英文摘要：
Phishing sites continue to increase in number and sophistication. Recent work uses large language models (LLMs) to analyze URLs, HTML, and rendered content and determine whether a website is a phishing site. However, these systems also introduce a new attack surface: prompt injection. Because attackers control many elements of a phishing site, they can embed malicious instructions that exploit perceptual asymmetry between LLMs and human users. Content that goes unnoticed by end users may still be processed by the LLM and can therefore be used to manipulate the model's judgment or disrupt the detection pipeline. The specific risks of prompt injection in phishing detection, and possible mitigation strategies, have not been studied systematically. We present the first comprehensive evaluation of prompt injection against multimodal LLM-based phishing detection. We study diverse attacks embedded in phishing sites across multiple attack techniques and surfaces, and show that even state-of-the-art models remain vulnerable both in controlled settings and on real phishing sites. To mitigate this risk, we propose InjectDefuser, a modular framework that combines prompt hardening, allowlist-grounded retrieval, and output validation. Across multiple models, InjectDefuser reduces attack success rates. Our results show that prompt injection is a practical threat to LLM-based phishing detection and provide insight into how these systems can be made more robust.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
