Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation

查看原文 / View Original 编辑 / Edit

Computer Science > Cryptography and Security arXiv:2610.41307 (cs) [Submitted on 30 Oct 2026] Title: Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation Authors: Shuo Hong, Jiaxin Ma, Xidi Cai, Qianli Ma.

计算机科学 > 密码学与安全 arXiv:2610.41307 (cs) [提交于 2026 年 10 月 30 日] 标题：擦除注入区域：基于在线策略自蒸馏的多模态提示注入防御作者：Shuo Hong, Jiaxin Ma, Xidi Cai, Qianli Ma。

Abstract: Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user’s task. Existing defenses can block the attack yet impair the model’s use of that information, leaving a gap between attack defense and task preservation.

摘要：多模态间接提示注入将恶意指令嵌入到同时包含用户任务所需信息的外部媒体中。现有的防御措施虽然可以阻止攻击，但会损害模型对这些信息的利用，从而在攻击防御和任务保留之间留下了缺口。

We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place. Modality-appropriate blank content replaces the injection while the surrounding media is preserved.

我们提出了 ERASE，这是一种在线策略自蒸馏方法，通过原地擦除注入区域来构建参考基准。该方法使用模态适用的空白内容替换注入部分，同时保留周围的媒体信息。

A student reading attacked media learns from a frozen base model reading the erased view through full-distribution token-level feedback on its own rollouts. Across image, audio, and video on two model sizes, ERASE records near-zero observed attack success on the evaluated benchmark while retaining task utility close to the undefended clean-input level.

学生模型在读取受攻击媒体时，通过自身输出的完整分布标记级反馈，向读取擦除后视图的冻结基础模型学习。在两种模型规模的图像、音频和视频测试中，ERASE 在评估基准上记录了近乎为零的攻击成功率，同时保持了接近未防御干净输入水平的任务效用。

On 3B audio, ERASE reaches 60.1% attacked-input accuracy compared with ARGUS’s 33.1%, within 0.5 points of the undefended clean-input level. Experiments show that ERASE reduces injection dependence from 6.26 to 0.0095 on 3B audio while staying close to the base model on the erased input. Out-of-domain accuracy also stays near the base level.

在 3B 音频模型上，ERASE 的受攻击输入准确率达到 60.1%，而 ARGUS 为 33.1%，与未防御的干净输入水平相差不到 0.5 个百分点。实验表明，ERASE 将 3B 音频上的注入依赖性从 6.26 降低至 0.0095，同时在擦除后的输入上保持与基础模型相近的性能。域外准确率也保持在接近基础模型的水平。