标签伪装防御（LDD）能否抵御 LLM 情感分类中的提示注入？

View PDF HTML (experimental)

Abstract:Prompt injection can cause large language models (LLMs) to deviate from their intended tasks by following instructions embedded in untrusted input. We investigate whether changing a classifier's output labels improves accuracy under such attacks, using sentiment classification as a case study. Label Disguise Defense (LDD) replaces positive/negative with alternatives such as good/bad or cat/dog, introduced through demonstrations, and maps predictions back to sentiment classes. We analyze retained aggregate results for 200 IMDb reviews, nine recorded model configurations, and eight alternative label pairs under a fixed attack that always requests the incorrect class using the original labels. Averaged over four pairs per group, sentiment-associated labels outperform the other tested labels in all nine configurations, but exceed a baseline using the original labels and the same demonstration and attack conditions in only three. At least one alternative pair improves on this baseline in seven configurations, with the best pairs identified retrospectively. These results show that a consistent advantage between label groups does not imply consistent improvement over standard labels. Missing matched evaluations on unattacked reviews prevent separating changes in ordinary classification performance from changes in the effect of the attack.

Comments:	8 pages, 3 figures. Substantially revised presentation, analysis, and discussion
Subjects:	Computation and Language (cs.CL); Artificial Intelligence (cs.AI)
Cite as:	arXiv:2511.21752 [cs.CL]
	(or arXiv:2511.21752v3 [cs.CL] for this version)
	https://doi.org/10.48550/arXiv.2511.21752 arXiv-issued DOI via DataCite

Submission history

From: Yanxi Li [view email]
[v1] Sun, 23 Nov 2025 20:16:51 UTC (1,260 KB)
[v2] Tue, 3 Feb 2026 22:03:52 UTC (1,260 KB)
[v3] Tue, 13 Oct 2026 03:55:48 UTC (85 KB)