DeepSeek Harness与A.I.G的安全评估：针对间接提示注入的抵抗能力评测

摘要

我们使用AI-Infra-Guard（A.I.G）评估DeepSeek Harness（DSH）中的间接提示注入：构建测试、传递受控污点、执行DSH、收集轨迹并判定结果。该研究涵盖14,560次受控执行，涉及16个间接内容通道、文本和文件载体模式、35个有效载荷目标、一个未修改的基线以及12种攻击方法。实验保留了DSH的智能体循环、工具注册表、模型适配器和会话事件路径；源工具和敏感汇聚点为本地夹具，因此尝试的操作被记录下来而不会产生外部副作用。我们使用一个确定性的基于规则的判断器（RuleJudge）和一个基于语义的LLM判断器（LLMJudge）对每条轨迹进行评估。观察到的最高攻击成功率分别为：文本模式下伪造完成攻击在RuleJudge下为17.0%，文件模式下隐藏Unicode在LLMJudge下为25.5%，文件模式下技能通道在RuleJudge下为16.0%。LLMJudge分配部分合规的频率也高于RuleJudge（7.3%对比2.0%）。我们将这些结果与DSH对工具结果、附加上下文和工具调用策略钩子的处理相关联，然后指出应位于不可信内容与敏感操作之间的控制措施。我们的代码可在 https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment 获取。

English

We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, (RuleJudge), and a semantic LLM-based judge, (LLMJudge). The strongest observed attack success rates are 17.0% under for fake-completion attack in text mode, 25.5% under for hidden Unicode in file mode, and 16.0% under for the skills channel in file mode. also assigns partial compliance more often than (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .