DeepSeek Harness 與 A.I.G 之安全性評估：間接提示注入之抵禦能力評析

摘要

我們使用AI-Infra-Guard（A.I.G）評估DeepSeek Harness（DSH）中的間接提示注入，透過A.I.G建構測試、傳遞受控污點、執行DSH、收集軌跡並判定結果。本研究涵蓋16個間接內容通道、文字與檔案載體模式、35種負載目標、一個未修改的基線以及12種攻擊方法，共計14,560次受控執行。實驗保留了DSH的代理迴圈、工具註冊表、模型適配器與會話事件路徑；來源工具與敏感匯點均為本地測試裝置，因此嘗試的動作會被記錄而不產生外部副作用。我們使用基於規則的確定性評判器（RuleJudge）與基於語義的LLM評判器（LLMJudge）評估每一條軌跡。觀察到的最強攻擊成功率分別為：文字模式下虛假完成攻擊在RuleJudge下為17.0%，檔案模式下隱藏Unicode在LLMJudge下為25.5%，以及檔案模式下技能通道在LLMJudge下為16.0%。LLMJudge也比RuleJudge更頻繁地賦予部分符合（7.3%對比2.0%）。我們將這些結果與DSH處理工具結果、額外上下文及工具呼叫策略鉤子的方式相關聯，進而識別應置於不受信任內容與敏感動作之間的控制措施。我們的程式碼可在https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment取得。

English

We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, (RuleJudge), and a semantic LLM-based judge, (LLMJudge). The strongest observed attack success rates are 17.0% under for fake-completion attack in text mode, 25.5% under for hidden Unicode in file mode, and 16.0% under for the skills channel in file mode. also assigns partial compliance more often than (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .