ERASE：基于在策略自蒸馏的多模态提示词注入防御方法
Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation
AI 导读
arXiv 论文提出 ERASE，一种在策略自蒸馏的多模态提示词注入防御方法：将媒体中被注入的区域擦除并替换为空白内容，让模型从读取擦除视图的冻结基座模型学习。
正文 · 原文
Abstract:Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We propose ERASE, an on-policy self-distillation method that constructs its reference by erasing the injected region in place. Modality-appropriate blank content replaces the injection while the surrounding media is preserved. A student reading attacked media learns from a frozen base model reading the erased view through full-distribution token-level feedback on its own rollouts. Across image, audio, and video on two model sizes, ERASE records near-zero observed attack success on the evaluated benchmark while retaining task utility close to the undefended clean-input level. On 3B audio, ERASE reaches 60.1% attacked-input accuracy compared with ARGUS's 33.1%, within 0.5 points of the undefended clean-input level. Experiments show that ERASE reduces injection dependence from 6.26 to 0.0095 on 3B audio while staying close to the base model on the erased input. Out-of-domain accuracy also stays near the base level. Our code will be made publicly available upon acceptance.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.41307 [cs.CR] |
| (or arXiv:2610.41307v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.41307 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Shuo Hong [view email]
[v1]
Fri, 30 Oct 2026 06:15:10 UTC (2,650 KB)
来源：arXiv cs.AI · arxiv.org