CausalArmor: 通过因果归因实现高效的间接提示注入防护
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
AI总结：
CausalArmor通过因果归因实现高效间接提示注入防护，提升AI代理的安全性和效率。
摘要：
具备工具调用能力的AI代理容易受到间接提示注入（IPI）攻击。在该攻击场景中，恶意命令隐藏在不可信内容中，使代理执行未经授权的操作。现有防御措施可以减少攻击成功率，但往往面临过度防御的困境：它们部署昂贵且持续运行的清理机制，无论实际威胁如何，从而在良性场景下也降低效用和延迟。我们从因果消解的角度重新审视IPI：成功的注入表现为支配力转移，其中用户请求不再为代理特权操作提供决定性支持，而特定不可信片段，如检索文档或工具输出，提供不成比例的可归因影响。基于此特征，我们提出CausalArmor，一种选择性防御框架，它（i）在特权决策点计算轻量级、留一法消解的归因；（ii）仅在不可信片段主导用户意图时触发针对性清理。此外，CausalArmor采用回溯的推理链遮蔽，以防止代理执行“中毒”的推理轨迹。我们通过理论分析表明，基于归因边界的清理在条件上会带来指数级小的恶意操作选择概率上界。在AgentDojo和DoomArena上的实验表明，CausalArmor在安全性能上与激进防御相当，同时提高了可解释性并保留了AI代理的效用和延迟。
英文摘要：
AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks. In this attack scenario, malicious commands hidden within untrusted content trick the agent into performing unauthorized actions. Existing defenses can reduce attack success but often suffer from the over-defense dilemma: they deploy expensive, always-on sanitization regardless of actual threat, thereby degrading utility and latency even in benign scenarios. We revisit IPI through a causal ablation perspective: a successful injection manifests as a dominance shift where the user request no longer provides decisive support for the agent's privileged action, while a particular untrusted segment, such as a retrieved document or tool output, provides disproportionate attributable influence. Based on this signature, we propose CausalArmor, a selective defense framework that (i) computes lightweight, leave-one-out ablation-based attributions at privileged decision points, and (ii) triggers targeted sanitization only when an untrusted segment dominates the user intent. Additionally, CausalArmor employs retroactive Chain-of-Thought masking to prevent the agent from acting on ``poisoned'' reasoning traces. We present a theoretical analysis showing that sanitization based on attribution margins conditionally yields an exponentially small upper bound on the probability of selecting malicious actions. Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses while improving explainability and preserving utility and latency of AI agents.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
