大语言模型对抗性攻击与防御综述

Summary

This survey, published in Journal of Computer Research and Development (vol. 62, no. 3, pp. 563–588, 2025), examines how attackers manipulate large language models into producing false, harmful or unethical output. It also reviews how such manipulation can be countered. The authors note that existing surveys focus mostly on jailbreaks and do not cover attacks across all stages of the LLM lifecycle, from dataset construction and pre-training to deployment and tool-chain integration. To address this gap, they organise recent work into four attack families: prompt injection, indirect prompt injection, jailbreak and backdoor attacks. For each family, they explain the underlying mechanisms, implementation techniques, findings and risks, and they compare the families to show how they relate and reinforce one another. The survey then groups defensive approaches, identifies weaknesses in current security research and discusses future directions, including multimodal models. The work is a structured map of the LLM threat landscape and is useful for anyone deploying or integrating LLMs.

Key points

• Prompt injection taxonomy.
  • Following Perez et al., the goals of prompt injection are split into goal hijacking and prompt leaking.
  • Building on Kang et al., the techniques are split into obfuscation, payload splitting, virtualized scenarios and code injection.
  • Additional categories cover SQL injection through LLM middleware and algorithm-generated attacks.
• Example attack systems.
  • HOUYI uses a third-party LLM to infer context, generate injections and score their effect.
  • GCG optimizes adversarial suffixes with gradients.
  • Judge Deceiver simulates the attack environment using local data.
• Tensor Trust. This online red-team game gathered more than 126,000 prompt attacks and 46,000 defenses. It showed that even simple prompts written by non-experts can succeed against current models.
• Defenses covered. The surveyed defenses include:
  • reward models,
  • prompt review and perplexity filtering,
  • review by third-party models,
  • adversarial training,
  • chain-of-thought,
  • multi-objective optimization,
  • eliciting the model's own safety abilities.
• Research trend. The paper charts a rising number of publications on LLM attacks and defenses, with data through August 2024.