Tensor Trust players reused prompt injections that broke their defenses
Original title: What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks
Within a week, targets reused 10.0% of successful attacks versus 0.03% of matched attacks that never reached them.
Researchers analyzed all 563,349 attack records from Tensor Trust, where players attacked and defended LLM-guarded accounts and could read attacks they received. Reuse mainly followed success, consistent with payoff-biased social learning, while near-misses were reused about as rarely as failures. After breaches, defense changes made same-family attacks 24.5 percentage points less successful against that target. Previously received texts accounted for 23.2% of the successful hijacks analyzed.
- The adjusted reuse gap was 8.8 to 10.0 percentage points.
- Near-misses beginning with "access granted" were rarely reused.
- Reuse came mainly from existing attackers, not newcomers.
- Authors suggest disclosing the technique without the full attack text.
From the original article
1 min read at arxiv.orgAttack logs and red-team reports show targets the attacks used against them, to help them repair their defenses. Prompt injections against large language models (LLMs) are plain text, so such records also hand targets a working copy.
By Zihan Chen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.