Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques. We demonstrate two approaches for bypassing LLM prompt injection and jailbreak detection systems via traditional character injection methods and algorithmic Adversarial Machine Learning (AML) evasion techniques. Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial utility achieving in some instances up to 100% evasion success. Furthermore, we demonstrate that adversaries can enhance Attack Success Rates (ASR) against black-box targets by leveraging word importance ranking computed by offline white-box models. Our findings reveal vulnerabilities within current LLM protection mechanisms and highlight the need for more robust guardrail systems.

本文研究了大型语言模型护栏系统在防范提示注入和越狱攻击方面的不足，提出了两种传统字符注入和算法对抗性机器学习（AML）逃避技术的方法。研究发现，针对六个显著保护系统的测试显示，这两种方法能够达到最高100%的逃避检测成功率，揭示了现有模型保护机制的脆弱性，并强调了开发更强大护栏系统的必要性。

绕过大型语言模型护栏中的提示注入和越狱检测