MIPIAD: 多语言间接提示注入攻击防御与Qwen-TF-IDF混合及元集成学习
MIPIAD: Multilingual Indirect Prompt Injection Attack Defense with Qwen -- TF-IDF Hybrid and Meta-Ensemble Learning
AI总结：
本文提出MIPIAD框架，结合Qwen2.5-1.5B微调序列分类器、TF-IDF特征和元集成学习，通过合成基准测试在英文和孟加拉文上实现高准确率的攻击检测，有效减少跨语言差距。
摘要：
间接提示注入攻击仍是检索增强和工具使用LLM系统中的持续性弱点，尤其在多语言环境下更难界定。本文提出MIPIAD防御框架，该框架在英文和孟加拉文上进行评估，结合通过LoRA微调的Qwen2.5-1.5B序列分类器（XLPID）、TF-IDF词法特征以及通过晚期融合、堆叠和梯度提升进行验证微调的集成方法。框架在基于BIPIA（Yi等，2023）模板构建的合成基准上进行评估，涵盖电子邮件、表格、问答、摘要和代码五类任务，包含超过143万生成样本，训练和测试划分使用互斥的攻击类别。在实验中，词法信号表现强劲（TF-IDF+SVM F1=0.77），而混合XLPID+TF-IDF集成在整体F1（0.9205）方面表现最佳，而Boosting集成在AUROC（0.9378）方面最佳。集成方法在英文-孟加拉文跨语言差距方面始终优于单独的神经模型。该流程设计用于扩展性：NLLB-200支持超过200种语言，XLPID的多语言主干可以无需架构更改即可重新定向到其他语言；实证验证目前仅限于英文和孟加拉文。
英文摘要：
Indirect prompt injection remains a persistent weakness in retrieval-augmented and tool-using LLM systems, and the problem becomes harder to characterise in multilingual settings. We present MIPIAD, a defense framework evaluated on English and Bangla that combines a sequence classifier fine-tuned from Qwen2.5-1.5B via LoRA (XLPID), TF-IDF lexical features, and validation-tuned ensembling through late fusion, stacking, and gradient boosting. The framework is evaluated on a synthetic benchmark built from BIPIA(Yi et al., 2023) templates spanning five task families -- email, table, QA, abstract, and code-comprising over 1.43 million generated samples, with train and test splits using mutually exclusive attack categories. Across the experiments, lexical signals prove strong (TF-IDF+SVM F1=0.77), and the hybrid XLPID+TF-IDF ensemble achieves the best overall F1 (0.9205) while the Boosting Ensemble achieves the best AUROC (0.9378). Ensemble methods consistently reduce the English-Bangla cross-lingual gap relative to standalone neural models. The pipeline is designed for extensibility: NLLB-200 supports over 200 languages and XLPID's multilingual backbone can be retargeted to additional languages without architectural changes; empirical validation is currently limited to English and Bangla
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
