AdInject：透過廣告投放對網路代理進行真實世界的黑箱攻擊

AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery

May 27, 2025

作者: Haowei Wang, Junjie Wang, Xiaojun Jia, Rupeng Zhang, Mingyang Li, Zhe Liu, Yang Liu, Qing Wang

cs.AI

摘要

基於視覺-語言模型（VLM）的網絡代理在模擬人類與網站互動以自動化複雜任務方面邁出了重要一步。然而，在不受控的網絡環境中部署這些代理引入了顯著的安全漏洞。現有研究關於對抗性環境注入攻擊往往依賴於不切實際的假設，如直接操縱HTML、知曉用戶意圖或訪問代理模型參數，這限制了其實際應用性。本文提出AdInject，一種新穎且現實的黑盒攻擊方法，利用互聯網廣告投放向網絡代理的環境中注入惡意內容。AdInject在比先前工作更為現實的威脅模型下運作，假設代理為黑盒、惡意內容靜態約束且無特定用戶意圖知識。AdInject包含設計旨在誤導代理點擊的惡意廣告內容的策略，以及一種基於VLM的廣告內容優化技術，該技術從目標網站的上下文中推斷潛在用戶意圖，並將這些意圖整合到廣告內容中，使其對代理的任務顯得更加相關或關鍵，從而提升攻擊效果。實驗評估證明了AdInject的有效性，在大多數場景下攻擊成功率超過60%，在某些情況下接近100%。這強有力地表明，普遍存在的廣告投放構成了針對網絡代理環境注入攻擊的一種強大且現實的途徑。本工作揭示了由於現實世界環境操縱渠道而產生的網絡代理安全中的關鍵漏洞，強調了開發針對此類威脅的強健防禦機制的迫切需求。我們的代碼可在https://github.com/NicerWang/AdInject獲取。

English

Vision-Language Model (VLM) based Web Agents represent a significant step towards automating complex tasks by simulating human-like interaction with websites. However, their deployment in uncontrolled web environments introduces significant security vulnerabilities. Existing research on adversarial environmental injection attacks often relies on unrealistic assumptions, such as direct HTML manipulation, knowledge of user intent, or access to agent model parameters, limiting their practical applicability. In this paper, we propose AdInject, a novel and real-world black-box attack method that leverages the internet advertising delivery to inject malicious content into the Web Agent's environment. AdInject operates under a significantly more realistic threat model than prior work, assuming a black-box agent, static malicious content constraints, and no specific knowledge of user intent. AdInject includes strategies for designing malicious ad content aimed at misleading agents into clicking, and a VLM-based ad content optimization technique that infers potential user intents from the target website's context and integrates these intents into the ad content to make it appear more relevant or critical to the agent's task, thus enhancing attack effectiveness. Experimental evaluations demonstrate the effectiveness of AdInject, attack success rates exceeding 60% in most scenarios and approaching 100% in certain cases. This strongly demonstrates that prevalent advertising delivery constitutes a potent and real-world vector for environment injection attacks against Web Agents. This work highlights a critical vulnerability in Web Agent security arising from real-world environment manipulation channels, underscoring the urgent need for developing robust defense mechanisms against such threats. Our code is available at https://github.com/NicerWang/AdInject.