attack arXiv Sep 9, 2025 · Sep 2025
Minghui Li, Hao Zhang, Yechao Zhang et al. · Huazhong University of Science and Technology · Nanyang Technological University +1 more
Transfers direct prompt injection across black-box LLMs using surrogate activations and gradient-free MCMC token optimization
Prompt Injection nlp
Direct Prompt Injection (DPI) attacks pose a critical security threat to Large Language Models (LLMs) due to their low barrier of execution and high potential damage. To address the impracticality of existing white-box/gray-box methods and the poor transferability of black-box methods, we propose an activations-guided prompt injection attack framework. We first construct an Energy-based Model (EBM) using activations from a surrogate model to evaluate the quality of adversarial prompts. Guided by the trained EBM, we employ the token-level Markov Chain Monte Carlo (MCMC) sampling to adaptively optimize adversarial prompts, thereby enabling gradient-free black-box attacks. Experimental results demonstrate our superior cross-model transferability, achieving 49.6% attack success rate (ASR) across five mainstream LLMs and 34.6% improvement over human-crafted prompts, and maintaining 36.6% ASR on unseen task scenarios. Interpretability analysis reveals a correlation between activations and attack effectiveness, highlighting the critical role of semantic patterns in transferable vulnerability exploitation.
llm transformer Huazhong University of Science and Technology · Nanyang Technological University · City University of Macau
ML Security Papers