Original post · AI translation
@alexbieyx 非常有意思。恭喜论文发表。
@rohanpaul_ai 谢谢分享！我们想强调的一个结果是模型相对能力强弱所起的作用。强大的攻击模型能攻破较弱的模型，而较弱的攻击模型很少能攻破强大的模型。
https://t.co/ORYxMZVl9E https://t.co/V7Xo8iXS09
Original
@rohanpaul_ai Thanks for sharing! One result we want to highlight is the role of the relative strengths of models. Strong attackers break weaker models, and are rarely broken by weaker attackers. https://t.co/ORYxMZVl9E https://t.co/V7Xo8iXS09
Google DeepMind 的一篇新论文表明，提示注入问题尚未解决，因为一群强大的 AI 攻击智能体仍能骗过防护最严密的模型。
提示注入是指在 AI 智能体读取的数据（例如工具返回结果）中藏入指令，让它为攻击者行事。如今，人工红队攻击对较新的 Gemini 模型几乎从不奏效，因此这个问题看起来可能已经解决。
他们构建了 Agentic Optimizer，由 8 个 AI 智能体团队组成；这些团队测试注入手法、共享笔记，并在彼此最成功的尝试基础上继续改进。他们在 100 项工具使用任务中进行了测试，在这些任务中，攻击者只想让模型随机调用一次无害的工具。
在最多尝试 320 次的情况下，最强的攻击模型在 34% 的任务中攻破了防御能力最强的模型 Gemini 4 Argon。开放权重模型 Kimi K3、GLM-5.3 和 DeepSeek-V4.1-Flash 仅在 1% 的任务中抵御了攻击。
Original
New Google DeepMind paper shows prompt injection is not solved, since a swarm of strong AI attacker agents still tricks even the best-defended models. Prompt injection means hiding instructions in data an AI agent reads, like a tool result, to make it act for the attacker. Human red-teaming attacks now almost never work on recent Gemini models, so the problem can look solved. They built Agentic Optimizer, 8 teams of AI agents that test injections, share notes, and build on each other's best attempts. They tested it on 100 tool-use tasks where the attacker only wanted one random, harmless tool call. With up to 320 tries, the strongest attacker beat Gemini 4 Argon, the most robust model, on 34% of tasks. Open-weight Kimi K3, GLM-5.3, and DeepSeek-V4.1-Flash resisted only 1% of tasks.
我们的主要结果表明，Gemini 4 Argon 同时具备以下两点：
(1) 它是强大的红队测试者，能在针对较弱模型的大多数场景中找到成功的提示注入方法；以及
(2) 它能抵御使用同一套测试框架、但由先前模型实施的红队测试。尽管如此，Argon 也能够对自身实施提示注入！
2/4
Original
Our main results show that Gemini 4 Argon is both: (1) A strong red-teamer; finding successful prompt injections for most scenarios on weaker models; and (2) Robust against red-teaming carried out with the same harness, but with prior models. Nevertheless, Argon is capable of prompt injecting itself! 2/4