智能体对抗智能体：用于自动提示注入红队测试的智能体系统

摘要

提示注入对LLM智能体构成了重大的安全风险。因此，高效且有效的红队测试对于评估这些风险以及收集训练数据以改进防御措施都至关重要。现有的先进提示注入红队测试方法主要依赖于强化学习（RL），其产生的攻击模型往往对新目标LLM的泛化能力较差。在本工作中，我们开发了PIMiner，一个用于提示注入红队测试的智能体系统。在训练阶段，PIMiner在一系列（数据集，目标模型）对上训练，并从零开始构建策略库。在测试阶段，学习到的策略库可以直接迁移到之前未见过的新目标LLM，无需额外训练。PIMiner对每个测试样本仅需少量查询目标智能体（例如10次）。实验结果表明，PIMiner取得了优异的性能。在IPIArena上，其对Gemini-2.5-Pro的攻击成功率（ASR）达到76.2%，对GPT-5.1达到61.9%，对Claude-Sonnet-4.5达到42.9%。在AgentDojo上，其对Gemini-2.5-Pro的ASR达到86.7%，对GPT-5.1达到53.3%，对Claude-Sonnet-4.5达到40.0%。

English

Prompt injection poses significant security risks to LLM agents. Efficient and effective red-teaming is therefore critical, both for evaluating these risks and for collecting training data to improve defenses. Existing state-of-the-art prompt injection red-teaming methods primarily rely on reinforcement learning (RL), producing attacker models that often generalize poorly to new target LLMs. In this work, we develop PIMiner, an agentic system for prompt injection red-teaming. During training, PIMiner is trained on a sequence of (dataset, target model) pairs and builds a strategy library from scratch. At test time, the learned strategy library can be directly transferred to a previously unseen target LLM without additional training. PIMiner requires only a small number of queries to a target agent (e.g., 10) per test sample. Experimental results demonstrate that PIMiner achieves strong performance. On IPIArena, it attains a 76.2% ASR against Gemini-2.5-Pro, 61.9% ASR against GPT-5.1, and 42.9% ASR against Claude-Sonnet-4.5. On AgentDojo, it achieves an 86.7% ASR against Gemini-2.5-Pro, 53.3% ASR against GPT-5.1, and 40.0% ASR against Claude-Sonnet-4.5.