发表机构
NVIDIA（英伟达）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对工具使用智能体感知易受状态篡改攻击的问题，提出PIPES防护方案，通过语义先验与来源筛选，大幅降低攻击成功率且保留良性效用。
AI 中文摘要
使用工具的智能体会消耗来自不同信任级别来源的外部数据，但工具响应极少标识每个组件的生产者或其应传达的内容。我们表明，这一漏洞会引发状态篡改攻击：攻击者控制的内容会提出超出其响应组件信息权限的环境主张，篡改智能体感知的环境，使生成的动作对现有防护机制而言看似合理。我们提出PIPES（Provenance-Informed, Prior-Enforced Screening，即基于来源感知与先验约束的筛选），该方案用语义先验和来源出处对响应单元进行筛选。当模式提供稳定预期时，PIPES使用静态字段契约；对开放式内容的筛选则以响应前轨迹和可信来源元数据为条件。它会标记违反语义先验或来源层级的单元，部署时可对检测到的违规执行移除、警告、阻止或升级操作。我们实例化了原子移除机制，并针对自适应PAIR式攻击对PIPES进行评估：以Gemma 4 31B IT为目标智能体，在VitaBench的3个划分和AgentDyn的3个划分上，PIPES将平均攻击成功率从84.7%降至2.3%，同时保留了平均良性效用（使用PIPES时为92.5%，无防御时为90.6%）。
英文摘要
Tool-using agents consume external data from sources with different levels of trust, yet tool responses rarely identify who produced each component or what it should convey. We show that this gap enables state-corruption attacks, in which attacker-controlled content makes environmental claims beyond the informational authority of its response component and corrupts the agent's perceived environment, making the resulting action appear justified to existing guardrails. We introduce PIPES (Provenance-Informed, Prior-Enforced Screening), which screens response units using semantic priors and source provenance. PIPES uses static field contracts when schemas provide stable expectations, and conditions screening of open-ended content on the pre-response trajectory and trusted provenance metadata. It marks units that violate their semantic prior or the provenance hierarchy; deployments may remove, warn, block, or escalate detected violations. We instantiate atomic removal and evaluate PIPES against adaptive PAIR-style attacks. Across the three VitaBench and three AgentDyn splits with Gemma 4 31B IT as the target agent, PIPES reduces average attack success from 84.7% to 2.3%, while preserving average benign utility (92.5% with PIPES versus 90.6% without defense).
