智能體對抗智能體：用於自動提示注入紅隊演練的智能體系統

摘要

提示注入對大型語言模型智能體構成重大的安全風險。因此，有效率且有效能的紅隊測試至關重要，無論是為了評估這些風險，還是為了收集訓練資料以改善防禦機制。現有的最先進提示注入紅隊測試方法主要依賴於強化學習（RL），其所產生的攻擊者模型通常難以泛化到新的目標大型語言模型。在本工作中，我們開發了PIMiner，一個用於提示注入紅隊測試的智能體系統。在訓練期間，PIMiner在一系列（資料集、目標模型）配對上進行訓練，並從零開始構建策略庫。在測試時，學到的策略庫可以直接遷移到先前未見過的目標大型語言模型，無需額外訓練。PIMiner對每個測試樣本僅需對目標智能體進行少量查詢（例如10次）。實驗結果表明，PIMiner取得了強勁的表現。在IPIArena上，它對Gemini-2.5-Pro達到76.2%的攻擊成功率（ASR），對GPT-5.1達到61.9%的ASR，對Claude-Sonnet-4.5達到42.9%的ASR。在AgentDojo上，它對Gemini-2.5-Pro達到86.7%的ASR，對GPT-5.1達到53.3%的ASR，對Claude-Sonnet-4.5達到40.0%的ASR。

English

Prompt injection poses significant security risks to LLM agents. Efficient and effective red-teaming is therefore critical, both for evaluating these risks and for collecting training data to improve defenses. Existing state-of-the-art prompt injection red-teaming methods primarily rely on reinforcement learning (RL), producing attacker models that often generalize poorly to new target LLMs. In this work, we develop PIMiner, an agentic system for prompt injection red-teaming. During training, PIMiner is trained on a sequence of (dataset, target model) pairs and builds a strategy library from scratch. At test time, the learned strategy library can be directly transferred to a previously unseen target LLM without additional training. PIMiner requires only a small number of queries to a target agent (e.g., 10) per test sample. Experimental results demonstrate that PIMiner achieves strong performance. On IPIArena, it attains a 76.2% ASR against Gemini-2.5-Pro, 61.9% ASR against GPT-5.1, and 42.9% ASR against Claude-Sonnet-4.5. On AgentDojo, it achieves an 86.7% ASR against Gemini-2.5-Pro, 53.3% ASR against GPT-5.1, and 40.0% ASR against Claude-Sonnet-4.5.