LAAF：逻辑层自动攻击框架：一种针对代理大语言模型系统中LPCI漏洞的系统性红队方法
LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems
AI总结：
LAAF是首个结合特定技术分类和分阶段种子升级的自动化红队框架，通过49种技术分类生成大量独特负载，并通过持久化阶段突破器实现分阶段负载变异，有效提升阶段突破效率。
摘要：
配备持久内存、RAG管道和外部工具连接器的代理大语言模型系统面临一种攻击类型——逻辑层提示控制注入（LPCI），此前缺乏自动化红队工具。本文提出LAAF（逻辑层自动攻击框架），首次结合LPCI特定技术分类和分阶段种子升级，填补现有工具的空白：Garak缺乏内存持久性和跨会话触发；PyRIT支持多轮测试但不考虑前一轮突破的种子。LAAF提供：（i）涵盖六个攻击类别（编码11、结构8、语义8、分层5、触发12、外泄5）的49种技术分类，可组合成5种变体和6个生命周期阶段，理论最大可生成2,822,400种独特负载（49×5×1,920×6；SHA-256去重）；（ii）一个持久化阶段突破器（PSB），分阶段驱动负载变异：每次突破后，PSB用变异后的胜利负载种子下一个阶段，模拟真实对抗升级。在五个生产LLM平台上的评估显示，LAAF的阶段突破效率高于单技术随机测试，平均整体突破率为84%（83-86%），平台级率在三次独立运行中波动不超过17个百分点。分层组合和语义重构是最高效果的技术类别，分层负载在受保护平台中表现优于编码。
英文摘要：
Agentic LLM systems equipped with persistent memory, RAG pipelines, and external tool connectors face a class of attacks - Logic-layer Prompt Control Injection (LPCI) - for which no automated red-teaming instrument existed. We present LAAF (Logic-layer Automated Attack Framework), the first automated red-teaming framework to combine an LPCI-specific technique taxonomy with stage-sequential seed escalation - two capabilities absent from existing tools: Garak lacks memory-persistence and cross-session triggering; PyRIT supports multi-turn testing but treats turns independently, without seeding each stage from the prior breakthrough. LAAF provides: (i) a 49-technique taxonomy spanning six attack categories (Encoding~11, Structural~8, Semantic~8, Layered~5, Trigger~12, Exfiltration~5; see Table 1), combinable across 5 variants per technique and 6 lifecycle stages, yielding a theoretical maximum of 2,822,400 unique payloads ($49 \times 5 \times 1{,}920 \times 6$; SHA-256 deduplicated at generation time); and (ii) a Persistent Stage Breaker (PSB) that drives payload mutation stage-by-stage: on each breakthrough, the PSB seeds the next stage with a mutated form of the winning payload, mirroring real adversarial escalation. Evaluation on five production LLM platforms across three independent runs demonstrates that LAAF achieves higher stage-breakthrough efficiency than single-technique random testing, with a mean aggregate breakthrough rate of 84\% (range 83--86\%) and platform-level rates stable within 17 percentage points across runs. Layered combinations and semantic reframing are the highest-effectiveness technique categories, with layered payloads outperforming encoding on well-defended platforms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
