从提示注入到持久控制：防御智能体框架中的木马后门
From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors
AI总结：
本文提出ClawTrojan基准测试揭示本地智能体框架中的多步木马攻击，并设计DASGuard防御方法，通过扫描控制文本、追溯来源并清除不可信控制内容，实现动态防御。
摘要：
LLM智能体正在从对话式聊天机器人演变为实际工作空间中的操作工具。在本地智能体框架中，LLM可以读写文件、调用工具，并在会话间重用工作空间状态。虽然这些功能增强了实用性，但也为攻击者暴露了新的攻击面。攻击者可以将提示注入嵌入文件或工具输出中。智能体可能会读取这一隐藏指令，存储它，并在之后执行。在这种多步木马攻击范式中，没有任何单个步骤本身是恶意的，但这些步骤可以共同将不可信文本转化为持久控制内容。然而，现有防御通常孤立地检查每个步骤。因此，它们可以阻止明显的恶意行为，但无法检测到植入后门的早期写操作。为了揭示这一威胁，我们引入了ClawTrojan，一个旨在识别本地智能体框架中多步木马攻击的基准测试。在OpenClaw风格的模拟工作空间中，使用GPT-5.4，ClawTrojan达到了95.5%的攻击成功率（ASR），而同一模型上现有的单轮提示注入攻击产生的ASR接近零。为了解决这一威胁，我们提出了DASGuard，它扫描敏感本地文件中的控制类文本，追溯其来源，并清除非可信来源的控制内容。我们的结果表明，DASGuard通过结合运行时攻击阻断和对工作空间的清理提交，实现了强大的动态防御。
英文摘要：
LLM agents are evolving from conversational chatbots to operational tools in real-world workspaces. In local agentic harnesses, an LLM can read and write files, call tools, and reuse workspace state across sessions. While such capabilities enhance utility, they also expose a new attack surface for attackers. Attackers can embed a prompt injection within a file or tool output. Agents may read this hidden instruction, store it, and execute it later. In this multi-step trojan attack paradigm, no individual step appears malicious on its own, but these steps can collectively turn untrusted text into persistent control content. However, existing defenses often inspect each step in isolation. As a result, they can block a clear harmful action, but fail to detect the earlier write operation that plants the backdoor. To reveal this threat, we introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses. In an OpenClaw-style simulated workspace with GPT-5.4, ClawTrojan reaches a 95.5% attack success rate (ASR), while existing single-turn prompt-injection attacks produce near-zero ASR on the same model. To address this threat, we propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source. Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
