arXiv cs.AI· Shuo Hong, Jiaxin Ma, Xidi Cai, Qianli Ma·· 11 小时前AI 评分42
ERASE：用在线自蒸馏擦除注入区域，防御多模态提示注入
Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation
AI 导读
ERASE 是一种在线自蒸馏方法，通过在原始媒体中就地擦除注入区域、以模态适配的空白内容替换，让读取受攻击媒体的学生模型向读取擦除视图的冻结基座模型学习。在图像、音频、视频和两种模型规模上，ERASE 在评测基准上观察到接近零的攻击成功率，任务效用接近无防御的干净输入水平。
正文 · 原文
Abstract:Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place. Modality-appropriate blank content replaces the injection while the surrounding media is preserved. A student reading attacked media learns from a frozen base model reading the erased view through full-distribution token-level feedback on its own rollouts. Across image, audio, and video on two model sizes, ERASE records near-zero observed attack success on the evaluated benchmark while retaining task utility close to the undefended clean-input level. On 3B audio, ERASE reaches 60.1% attacked-input accuracy compared with ARGUS's 33.1%, within 0.5 points of the undefended clean-input level. Experiments show that ERASE reduces injection dependence from 6.26 to 0.0095 on 3B audio while staying close to the base model on the erased input. Out-of-domain accuracy also stays near the base level. Our code will be made publicly available upon acceptance.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.41307 [cs.CR] |
| (or arXiv:2610.41307v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.41307 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Shuo Hong [view email]
[v1]
Fri, 30 Oct 2026 06:15:10 UTC (2,650 KB)
来源：arXiv cs.AI · arxiv.org