MIRAGE: 针对Web代理的隐蔽视觉提示注入漏洞检测
MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents
AI总结：
提出MIRAGE框架，利用扩散模型在受限区域生成视觉上无害的对抗图像，实现针对多模态大模型Web代理的隐蔽间接提示注入攻击，以检测其视觉漏洞。
摘要：
基于多模态大语言模型（MLLM）的Web代理为视觉浏览器自动化提供了实用、高精度的解决方案；然而，它们固有地扩大了攻击面，引入了新颖的基于视觉的漏洞。现有的针对这些代理的对抗性评估通常依赖于宽松的威胁模型和视觉上明显的伪影。在本文中，我们研究了一个受限的漏洞检测设置：一个受信任的Web平台，评估者仅作为无特权的第三方（例如商家或广告商），仅控制一个语义上合法、空间受限的区域，例如广告位、赞助卡片或本地化小部件。在这些现实约束下，我们提出了MIRAGE，一种新颖的视觉间接提示注入框架，用于目标性的下一步动作劫持。我们的方法利用扩散模型生成感知上良性的对抗图像，严格限制在受信任服务提供商允许的攻击者控制边界内。为了在这种限制性设置中最大化攻击效果，我们引入了一种鲁棒优化技术，结合了曲率感知的对抗扩散引导和稀疏的暗像素残差扰动。针对著名的MLLM Web代理框架（具体为SeeAct和OpenClaw）的全面评估，实证证明了我们提出的MIRAGE的效力、真实性和隐蔽性。
英文摘要：
Multimodal Large Language Model (MLLM)-based web agents provide practical, high-precision solutions for visual browser automation; however, they inherently expand the attack surface, introducing novel vision-based vulnerabilities. Existing adversarial evaluations targeting these agents frequently rely on permissive threat models and visually conspicuous artifacts. In this paper, we investigate a constrained vulnerability detection setting: a trusted web platform where the evaluator acts solely as an unprivileged third party, such as a merchant or advertiser, controlling only a semantically legitimate, spatially constrained region, such as an ad slot, a sponsored card, or a localized widget. Operating under these realistic constraints, we propose MIRAGE, a novel visual indirect prompt injection framework for targeted next-action hijacking. Our approach leverages diffusion models to generate perceptually benign adversarial images strictly confined to the attacker-controlled boundaries permitted by the trusted service provider. To maximize attack efficacy within such a restrictive setting, we introduce a robust optimization technique combining curvature-aware adversarial diffusion guidance with sparse, dark-pixel residual perturbations. Comprehensive evaluations against prominent MLLM web agent frameworks, specifically SeeAct and OpenClaw, empirically demonstrate the potency, realism, and stealth of our proposed MIRAGE.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
