警惕智能体僵尸网络：通过通用且可转移的对抗性幻觉蹲点进行可扩展的无目标提示软件攻击
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
AI总结：
研究针对实际威胁模型中无直接渠道时攻击者能否利用LLM应用的问题，提出对抗性幻觉蹲点技术，通过识别热门资源计算幻觉分布抢先注册对抗性提示，利用幻觉特性扩大无目标提示软件攻击范围并建立僵尸网络，实验证明该技术可行性及幻觉可转移性。
摘要：
智能体大语言模型（LLM）应用的日益普及带来了此前被称为提示软件的新威胁。虽然先前工作表明对手可在弱威胁模型下利用通向LLM应用的直接渠道实施提示软件攻击，但许多应用除互联网外未提供可用于提示注入的直接渠道。本文提出疑问：在实际威胁模型中，攻击者能否在无直接渠道的情况下大规模利用LLM应用？研究表明，可利用LLM产生资源标识符的固有倾向来放大无目标提示软件攻击并建立僵尸网络。引入对抗性幻觉蹲点技术，攻击者识别热门资源，计算其幻觉的LLM分布并抢先注册以托管对抗性提示。利用幻觉的可预测性和可转移性，对手可在弱威胁模型下显著扩大无目标提示软件的影响范围并建立僵尸网络。实验证明，幻觉资源生成率很高，在仓库克隆场景中高达85%，在技能安装中高达100%，且这些幻觉可在基础模型和不同提示之间转移。还展示了对抗性幻觉蹲点对各种生产LLM应用的实用性，实现了远程工具执行和远程代码执行。
英文摘要：
The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware. While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware under weak threat models, many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet. This raises a question: can attackers exploit LLM applications at scale without any direct channels in practical threat models? In this work, we show that the inherent tendency of LLMs to hallucinate resource identifiers can be exploited to amplify untargeted promptware attacks that pull adversarial prompts at scale and could be exploited to establish a botnet. We introduce adversarial hallucination squatting, a technique in which attackers identify trending resources (e.g., popular repositories, popular skills, etc.), compute the LLM distribution of hallucinations on the trending resource names, and preemptively register them to host adversarial prompts. By leveraging the predictability and transferability of hallucinations across foundational LLMs and to application layers, adversaries can significantly amplify the reach of untargeted promptware under weak threat models and establish a botnet by exploiting LLM applications to install a bot on the device that pulled the compromised hallucinated resource from the Inter. We empirically demonstrate that hallucinated resource generation occurs at high rates, up to 85% in repository cloning scenarios and up to 100% in skill installation, and that these hallucinations transfer between foundational models and different prompts. We demonstrate the practicality of adversarial hallucination squatting against various production LLM applications with integrated terminals in their set of tools, achieving remote tool execution and remote code execution.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
