ENDOPROMPT：面向效用降低的受害者侧伪参考

中文摘要 AI 辅助

提示注入可以在不引发有害内容的情况下降低良性任务性能。然而，许多攻击目标依赖于任务标签或预定义的目标响应。我们提出ENDOPROMPT，一种白盒方法，从无标签指令中学习降低效用的前缀。其生成器以请求文本作为输入。干净的受害者续写作为伪参考：局部搜索识别降低续写可能性的前缀，在同一指令内的比较上进行偏好拟合，随后进行奖励细化，将该信号蒸馏到生成器中。在部署时，生成器为每个请求产生一个前缀，无需进一步的受害者侧搜索。在四个指令调优模型和七个良性基准的完整划分上，ENDOPROMPT产生平均效用变化-26.8个百分点；28个单元中有27个为负。失败分析揭示了输出扩展和前缀重用；对照未建立请求匹配的降级优势。受害者派生的监督可以在没有基准反馈或规定失败响应的情况下揭示效用弱点。代码将在接受后发布。

英文摘要

Prompt injection can degrade benign task performance without eliciting harmful content. Yet many attack objectives depend on task labels or predefined target responses. We present ENDOPROMPT, a white-box method that learns utility-degrading prefixes from unlabeled instructions. Its generator takes the request text as input. Clean victim continuations serve as pseudo-references: local search identifies prefixes that reduce continuation likelihood, and preference fitting on comparisons within the same instruction, followed by reward refinement, distills this signal into a generator. At deployment, the generator produces one prefix per request without further victim-side search. Across four instruction-tuned models and the complete splits of seven benign benchmarks, ENDOPROMPT yields a mean utility change of -26.8 percentage points; 27 of 28 cells are negative. Failure analysis reveals output expansion and prefix reuse; the controls do not establish a degradation advantage from request matching. Victim-derived supervision can reveal utility weaknesses without benchmark feedback or prescribed failure responses. The code will be released upon acceptance.

发表机构

• Defense Innovation Institute, Academy of Military Science（军事科学院国防科技创新研究院）
• Nanjing University（南京大学）
• School of Software Engineering, South China University of Technology（华南理工大学软件学院）

机构由 AI 辅助整理，请以论文原文为准。