NUWA 风险评测 · 评测基准
AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
NUWA 研究解读 · 独立复核待完成
NUWA Research Note
研究问题研究设计与假设来源发现NUWA 解读局限与相反证据研究与决策意义机构与角色原始资源模型辅助整理 · 选读原始全文或官方文章中的相关章节；尚未完成逐章节审计。
研究速读
NUWA 解读：抗攻击能力须与基础能力及合法任务完成共同解释。
研究问题
工具智能体处理攻击者控制的外部数据时能否保持任务效用？
研究设计与假设
可执行有状态环境含97项用户任务、629个安全案例，配对合法任务与攻击目标。
来源发现
没有攻击时智能体也会失败。
攻击下效用要求完成合法任务且无攻击副作用（§3.4），不只是拒绝注入。
NUWA 解读
NUWA 解读：抗攻击能力须与基础能力及合法任务完成共同解释。
局限与相反证据
工具无法预先规划或合法工具已足以攻击时，隔离会失败；持续多任务上下文覆盖有限。
研究与决策意义
模型建议：分别报告良性效用、攻击下效用及目标攻击成功率。
精确来源位置
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents · AbstractSelected original resource https://arxiv.org/html/2406.13352v3; sha256:7b6e97faaedcf0e1b5f3635b92a0da33afbe8529699d54a5c44ad58ce2fa8b02; archived source capture; exact capture time not independently established
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents · §3 Designing and Constructing AgentDojoSelected original resource https://arxiv.org/html/2406.13352v3; sha256:7b6e97faaedcf0e1b5f3635b92a0da33afbe8529699d54a5c44ad58ce2fa8b02; archived source capture; exact capture time not independently established
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents · §3.4 Reporting AgentDojo ResultsSelected original resource https://arxiv.org/html/2406.13352v3; sha256:7b6e97faaedcf0e1b5f3635b92a0da33afbe8529699d54a5c44ad58ce2fa8b02; archived source capture; exact capture time not independently established
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents · §4.3 Prompt Injection DefensesSelected original resource https://arxiv.org/html/2406.13352v3; sha256:7b6e97faaedcf0e1b5f3635b92a0da33afbe8529699d54a5c44ad58ce2fa8b02; archived source capture; exact capture time not independently established
来源核查、数据提取、编辑批准与实验复现分别记录。 方法说明 →
机构与角色
作者 (4)
Edoardo Debenedetti · Jie Zhang · Mislav Balunovic · Luca Beurer-Kellner Marc Fischer Florian Tramèr
评测协议
引用与复用
引用研究发现时请引用原始出版物；引用 NUWA 的整理与解释时，单独引用本站记录及对应快照。
原始出版物 · BibTeX
@misc{agentdojo,
title = {AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents},
url = {https://arxiv.org/html/2406.13352v3},
author = {Edoardo Debenedetti and Jie Zhang and Mislav Balunovic and Luca Beurer-Kellner Marc Fischer Florian Tramèr},
year = {2024},
date = {2024-11-24},
version = {arXiv:2406.13352v3},
note = {arXiv:2406.13352v3}
}
NUWA 记录 · BibTeX
@misc{agentdojo-nuwa,
title = {AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents — NUWA research record},
url = {https://whitzard.tech/nuwa/whitzard-index/work/agentdojo/},
version = {2026-10-29.1},
organization = {NUWA Frontier AI Safety Lab},
howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentdojo.json},
note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentdojo.json.}
}
证据快照 2026-10-29.1 · 索引更新 · RSS
参考文献
- [1] Edoardo Debenedetti, Jie Zhang 等. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. 2024-11-24. v3 ; Author affiliations on the original paper title page; Abstract; §3 Designing and Constructing AgentDojo