We introduce a new family of prompt injection attacks, termed Neural Exec.
Unlike known attacks that rely on handcrafted strings (e.g., "Ignore previous
instructions and..."), we show that it is possible to conceptualize the
creation of execution triggers as a differentiable search problem and use
learning-based methods to autonomously generate them.
Our results demonstrate that a motivated adversary can forge triggers that
are not only drastically more effective than current handcrafted ones but also
exhibit inherent flexibility in shape, properties, and functionality. In this
direction, we show that an attacker can design and generate Neural Execs
capable of persisting through multi-stage preprocessing pipelines, such as in
the case of Retrieval-Augmented Generation (RAG)-based applications. More
critically, our findings show that attackers can produce triggers that deviate
markedly in form and shape from any known attack, sidestepping existing
blacklist-based detection and sanitation approaches.

我们引入了一种新型的注入攻击家族，被称为神经执行。与依赖手工制作字符串（例如 “忽略之前的指令并...”）的已知攻击不同，我们展示了将执行触发器的创建概念化为可微分的搜索问题，并使用基于学习的方法自动生成它们的可能性。我们的结果表明，一个有动机的对手可以伪造出比当前手工制作的触发器效果显著更好，并且在形状、属性和功能上具有固有的灵活性。在这方面，我们展示了攻击者可以设计和生成能够通过多阶段预处理管道持久存在的神经执行。更重要的是，我们的研究结果表明，攻击者可以产生与任何已知攻击明显不同的触发器形式，规避现有的基于黑名单的检测和净化方法。