cs.CR提交于 2026-11-03已译

擦除注入区域：基于同策略自蒸馏的多模态提示注入防御

Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation

Shuo Hong · Jiaxin Ma · Xidi Cai · Qianli Ma

中文摘要

多模态间接提示注入将恶意指令嵌入外部媒体，而该媒体同时包含用户任务所需信息。现有防御能阻断攻击，却损害模型对该信息的使用，造成攻击防御与任务保持之间的差距。ERASE 是一种同策略自蒸馏（on-policy self-distillation）方法，通过就地擦除注入区域构造参考视图：以模态适配的空白内容替换注入，同时保留周边媒体。学生模型读取受攻击媒体，从冻结基座模型读取擦除视图的输出中，通过对其自身 rollout 的全分布 token 级反馈学习。在图像、音频、视频三种模态与两种模型规模上，ERASE 在评测基准上观测到的攻击成功率接近零，任务效用接近无防御干净输入水平。在 3B 音频上，ERASE 的受攻击输入准确率达 60.1%，而 ARGUS 为 33.1%，距无防御干净输入水平仅差 0.5 个百分点。实验表明，ERASE 在 3B 音频上将注入依赖度从 6.26 降至 0.0095，同时在擦除输入上接近基座模型。域外准确率也保持在基座水平附近。代码将在录用后公开。

关键要点

01问题：多模态间接提示注入防御常损害模型对媒体中任务信息的利用，防御与任务保持存在差距。
02方法：ERASE 就地擦除注入区域构造参考视图，用冻结基座模型对擦除视图的输出做同策略自蒸馏。
03结果：图像、音频、视频上攻击成功率近零，任务效用接近无防御干净输入水平。
04结果：3B 音频受攻击输入准确率 60.1%，高于 ARGUS 的 33.1%，距干净输入仅 0.5 点。
05局限：仅在两种模型规模与特定评测基准上验证，代码尚未公开。

解读

尚无解读。

原始英文摘要

arXiv:2610.41307v1 Announce Type: cross Abstract: Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place. Modality-appropriate blank content replaces the injection while the surrounding media is preserved. A student reading attacked media learns from a frozen base model reading the erased view through full-distribution token-level feedback on its own rollouts. Across image, audio, and video on two model sizes, ERASE records near-zero observed attack success on the evaluated benchmark while retaining task utility close to the undefended clean-input level. On 3B audio, ERASE reaches 60.1% attacked-input accuracy compared with ARGUS's 33.1%, within 0.5 points of the undefended clean-input level. Experiments show that ERASE reduces injection dependence from 6.26 to 0.0095 on 3B audio while staying close to the base model on the erased input. Out-of-domain accuracy also stays near the base level. Our code will be made publicly available upon acceptance.