ENDOPROMPT: Victim-Side Pseudo-References for Utility Degradation
ENDOPROMPT learns prompt-injection prefixes that cut benign LLM task utility without requiring target labels.
ENDOPROMPT is a white-box prompt-injection method that trains a generator to emit utility-degrading prefixes from unlabeled instructions. Clean continuations from the victim model serve as pseudo-references: local search finds prefixes that reduce continuation likelihood, then preference fitting and reward refinement distill that signal so deployment produces one prefix per request without further victim-side search. Across four instruction-tuned models and the full splits of seven benign benchmarks, the authors report a mean utility change of -26.8 percentage points, with 27 of 28 cells negative. They note output expansion and prefix reuse, and say their controls did not show a degradation advantage from request matching.
- White-box method learns prefixes from unlabeled instructions.
- Uses victim continuations as pseudo-references, not target labels.
- Mean utility change was minus 26.8 percentage points.
- 27 of 28 model-benchmark cells were negative.
- Authors plan to release code after acceptance.
From the original article
1 min read at arxiv.orgPrompt injection can degrade benign task performance without eliciting harmful content. Yet many attack objectives depend on task labels or predefined target responses. We present ENDOPROMPT, a white-box method that learns utility-degrading prefixes from unlabeled instructions.
By Qingyu Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.