NUWA RESEARCH RECORD
Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game
原始文献 ↗ · BibTeX · RIS研究发现简单授权指令仍可能被绕过，并报告部分游戏外迁移演示。
研究问题
指令遵循模型对人工编写的提示提取和劫持有多强的抵抗力？
设计与前提
在线游戏提供人工攻防交互，经筛选后形成独立的提取与劫持评测，并显式核验防御是否正常工作。
研究发现
研究发现简单授权指令仍可能被绕过，并报告部分游戏外迁移演示。
局限与反证
对抗筛选和参考模型选择塑造了测试样本；游戏成功基于狭窄字符串判定，不等同于真实应用被攻破。
来源证据
| 系统 | 测量 | 原值 | 条件与位置 |
|---|---|---|---|
| gpt-3.5-turbo-0613 | Hijacking robustness rate | 18.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-3.5-turbo-0613; column Hijacking robustness rate; condition Hijacking |
| gpt-3.5-turbo-0613 | Defense validity | 89.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-3.5-turbo-0613; column Defense validity; condition Hijacking |
| claude-instant-1.2 | Hijacking robustness rate | 45.9%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-instant-1.2; column Hijacking robustness rate; condition Hijacking |
| claude-instant-1.2 | Defense validity | 77.6%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-instant-1.2; column Defense validity; condition Hijacking |
| chat-bison@001 | Hijacking robustness rate | 10.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row chat-bison@001; column Hijacking robustness rate; condition Hijacking |
| chat-bison@001 | Defense validity | 89.3%% | Prompt hijacking benchmark / Hijacking#A3.T1; row chat-bison@001; column Defense validity; condition Hijacking |
| gpt-4-0613 | Hijacking robustness rate | 84.3%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-4-0613; column Hijacking robustness rate; condition Hijacking |
| gpt-4-0613 | Defense validity | 81.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row gpt-4-0613; column Defense validity; condition Hijacking |
| claude-2.0 | Hijacking robustness rate | 53.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-2.0; column Hijacking robustness rate; condition Hijacking |
| claude-2.0 | Defense validity | 52.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row claude-2.0; column Defense validity; condition Hijacking |
| Llama-2-7b-chat-hf | Hijacking robustness rate | 66.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-7b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-7b-chat-hf | Defense validity | 19.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-7b-chat-hf; column Defense validity; condition Hijacking |
| Llama-2-13b-chat-hf | Hijacking robustness rate | 49.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-13b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-13b-chat-hf | Defense validity | 27.2%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-13b-chat-hf; column Defense validity; condition Hijacking |
| Llama-2-70b-chat-hf | Hijacking robustness rate | 50.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-70b-chat-hf; column Hijacking robustness rate; condition Hijacking |
| Llama-2-70b-chat-hf | Defense validity | 45.4%% | Prompt hijacking benchmark / Hijacking#A3.T1; row Llama-2-70b-chat-hf; column Defense validity; condition Hijacking |
| CodeLlama-34b-Instruct-hf | Hijacking robustness rate | 41.1%% | Prompt hijacking benchmark / Hijacking#A3.T1; row CodeLlama-34b-Instruct-hf; column Hijacking robustness rate; condition Hijacking |
| CodeLlama-34b-Instruct-hf | Defense validity | 63.7%% | Prompt hijacking benchmark / Hijacking#A3.T1; row CodeLlama-34b-Instruct-hf; column Defense validity; condition Hijacking |
| gpt-3.5-turbo-0613 | Exact extraction robustness rate | 12.3%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-3.5-turbo-0613; column Exact extraction robustness rate; condition Extraction |
| gpt-3.5-turbo-0613 | Defense validity | 91.1%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-3.5-turbo-0613; column Defense validity; condition Extraction |
| claude-instant-1.2 | Exact extraction robustness rate | 42.1%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-instant-1.2; column Exact extraction robustness rate; condition Extraction |
| claude-instant-1.2 | Defense validity | 81.8%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-instant-1.2; column Defense validity; condition Extraction |
| chat-bison@001 | Exact extraction robustness rate | 12.1%% | Prompt extraction benchmark / Extraction#A3.T2; row chat-bison@001; column Exact extraction robustness rate; condition Extraction |
| chat-bison@001 | Defense validity | 89.5%% | Prompt extraction benchmark / Extraction#A3.T2; row chat-bison@001; column Defense validity; condition Extraction |
| gpt-4-0613 | Exact extraction robustness rate | 69.1%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-4-0613; column Exact extraction robustness rate; condition Extraction |
| gpt-4-0613 | Defense validity | 89.5%% | Prompt extraction benchmark / Extraction#A3.T2; row gpt-4-0613; column Defense validity; condition Extraction |
| claude-2.0 | Exact extraction robustness rate | 50.9%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-2.0; column Exact extraction robustness rate; condition Extraction |
| claude-2.0 | Defense validity | 53.5%% | Prompt extraction benchmark / Extraction#A3.T2; row claude-2.0; column Defense validity; condition Extraction |
| Llama-2-7b-chat-hf | Exact extraction robustness rate | 44.9%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-7b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-7b-chat-hf | Defense validity | 17.4%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-7b-chat-hf; column Defense validity; condition Extraction |
| Llama-2-13b-chat-hf | Exact extraction robustness rate | 30.0%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-13b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-13b-chat-hf | Defense validity | 25.6%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-13b-chat-hf; column Defense validity; condition Extraction |
| Llama-2-70b-chat-hf | Exact extraction robustness rate | 18.1%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-70b-chat-hf; column Exact extraction robustness rate; condition Extraction |
| Llama-2-70b-chat-hf | Defense validity | 51.6%% | Prompt extraction benchmark / Extraction#A3.T2; row Llama-2-70b-chat-hf; column Defense validity; condition Extraction |
| CodeLlama-34b-Instruct-hf | Exact extraction robustness rate | 33.3%% | Prompt extraction benchmark / Extraction#A3.T2; row CodeLlama-34b-Instruct-hf; column Exact extraction robustness rate; condition Extraction |
| CodeLlama-34b-Instruct-hf | Defense validity | 69.6%% | Prompt extraction benchmark / Extraction#A3.T2; row CodeLlama-34b-Instruct-hf; column Defense validity; condition Extraction |
| gpt-4-0613 | Accuracy | 90.9%% | Zero-shot prompt extraction detection / Accuracy#A4.T4; row gpt-4-0613; column Accuracy; condition Accuracy |
| gpt-4-0613 | Precision | 97.0%% | Zero-shot prompt extraction detection / Precision#A4.T4; row gpt-4-0613; column Precision; condition Precision |
| gpt-4-0613 | Recall | 84.3%% | Zero-shot prompt extraction detection / Recall#A4.T4; row gpt-4-0613; column Recall; condition Recall |
| gpt-3.5-turbo-0613 | Accuracy | 56.5%% | Zero-shot prompt extraction detection / Accuracy#A4.T4; row gpt-3.5-turbo-0613; column Accuracy; condition Accuracy |
| gpt-3.5-turbo-0613 | Precision | 100.0%% | Zero-shot prompt extraction detection / Precision#A4.T4; row gpt-3.5-turbo-0613; column Precision; condition Precision |
| gpt-3.5-turbo-0613 | Recall | 13.0%% | Zero-shot prompt extraction detection / Recall#A4.T4; row gpt-3.5-turbo-0613; column Recall; condition Recall |
阅读范围与复核
Selected original HTML sections and table context; not a complete paper/appendix audit or independent reproduction.
模型辅助整理，独立证据复核待完成。
核对原始来源 ↗