Learning to Inject: Automated Prompt Injection via Reinforcement Learning
Learning to Inject: Automated Prompt Injection via Reinforcement Learning
Quick read
Based on 论文全文 （AI 生成）; refer to the original
Researchers from ETH Zürich propose AutoInject, which uses reinforcement learning to automatically generate prompt injection suffixes, achieving attack success rates on AgentDojo against multiple production models that exceed template attacks and optimization baselines such as GCG and TAP. The method uses a comparison-based feedback model to convert the binary injection success signal into a dense reward, trains Qwen2.5-1.5B with GRPO to generate suffixes, and supports both online querying and offline training of transferable suffixes. On Gemini-2.5-Flash the success rate is 58%, on GPT-5-nano it is 11.49%, while template attacks peak at 23.6% and 1.6%, respectively; on Meta-SecAlign-70B, which is specifically fine-tuned to resist prompt injection, it still achieves a 21.88% success rate, whereas template attacks completely fail. Code is open-sourced on GitHub.
- LLM agent 的 prompt injection 攻击目前仍依赖人工红队和手写提示，直接套用 jailbreak 优化器效果有限：jailbreak 追求泛化的顺从，而 injection 要求模型发出参数正确的特定 tool call，成功信号是稀疏的 0/1，随机后缀几乎从不触发，标准优化器没有梯度可循。
- 作者提出 AutoInject，一个黑盒强化学习框架：用学习到的比较式反馈模型，把每个候选后缀与当前最优后缀对比，输出偏好概率作为稠密奖励，再配合安全分与可选的 utility 分，用 GRPO 训练一个 1.5B 策略模型生成对抗后缀；支持在线查询攻击和离线训练的可迁移后缀。
- 在 AgentDojo 上，AutoInject 在多个生产模型上超过模板攻击、GCG、TAP、随机自适应攻击和进化搜索，多数场景下 McNemar 检验 p<0.05；在专门抗注入的 Meta-SecAlign-70B 上达到 21.88% ASR，而模板攻击完全失败；有 utility 信号时攻击后 utility 可持平或超过无攻击基线；离线后缀在跨任务迁移中与 RL-Hammer 竞争，尽管训练任务和查询预算少得多。
- 攻击假设目标模型收到指令即执行 tool call，但实验中 Claude Haiku 4.5 会先请求澄清，破坏该流程；plan-then-execute 类防御（如 CaMeL、IPI-Guard）通过解耦规划与执行绕开此威胁模型，但牺牲灵活性；作者认为需要兼顾 utility 的防御范式，并指出攻击效果可能随策略容量提升，留待未来工作。
The paper raises prompt injection success rates to 58% on AgentDojo and provides transferable suffixes that require no online access, making it easier for defenders to test the generalization of guardrails.