AgentAntibody：一种用于防御大语言模型（LLM）智能体提示注入的自适应免疫系统

中文摘要 AI 辅助

提示注入仍然是LLM智能体面临的关键威胁，然而现有防御措施将每个任务视为独立问题，与之前的交互无关。在实践中，用户请求往往未被充分明确：它们描述了期望的结果，但未完全指定可接受的行为。注入攻击可利用这种模糊性，导致智能体以用户会拒绝的方式完成任务。随着用户的期望通过具体案例变得更清晰，防御措施应从每次交互中学习，并将所学应用到下一次。受自适应免疫的启发，我们提出AgentAntibody，它为LLM智能体配备了一个自我进化的提示注入免疫系统。AgentAntibody将其对用户安全边界的不断演变的理解表示为一个持久的抗体库。在运行时，该库识别对该边界的威胁并启动相应的免疫响应。在多次交互中，它不断进化以增强智能体对未来攻击的免疫力。在三个基准测试和四个骨干LLM上进行的大量实验表明，通过从经验中学习用户的边界，AgentAntibody在防止有害行为的同时保留合法任务完成方面优于现有防御措施，即使有害和合法行为都与所述任务兼容。

英文摘要

Prompt injection remains a critical threat to LLM agents, yet existing defenses treat each task as a self-contained problem, independent of previous encounters. In practice, user requests are often underspecified: they describe the desired outcome without fully specifying acceptable behavior. An injection can exploit this ambiguity, causing the agent to complete the task in a way the user would reject. As the user's expectations become clearer through concrete cases, a defense should learn from each encounter and apply what it learns to the next. Inspired by adaptive immunity, we propose AgentAntibody, which equips LLM agents with a self-evolving immune system against prompt injection. AgentAntibody represents its evolving understanding of the user's security boundary as a persistent library of antibodies. At runtime, the library recognizes threats to this boundary and mounts corresponding immune responses. Across encounters, it evolves to strengthen the agent's immunity to future attacks. Extensive experiments across three benchmarks and four backbone LLMs show that, by learning the user's boundary through experience, AgentAntibody outperforms existing defenses in preventing harmful actions while preserving legitimate task completion, even when the harmful and legitimate actions are both compatible with the stated task.

发表机构

• Nanjing University（南京大学）
• Singapore Management University（新加坡管理大学）
• Nanyang Technological University（南洋理工大学）

机构由 AI 辅助整理，请以论文原文为准。

补充信息

备注

7 pages