# 用A.I.G评估DeepSeek Harness对间接提示注入的抵抗能力

- 来源：HuggingFace Daily Papers（社区热门论文）
- 发布时间：2026-08-18 08:00
- AIHOT 分数：54
- AIHOT 链接：https://aihot.virxact.com/items/cmszieman0euwrodpartksj9a
- 原文链接：https://arxiv.org/abs/2608.16393

## AI 摘要

研究用AI-Infra-Guard（A.I.G）对DeepSeek Harness（DSH）开展间接提示注入评估，覆盖14,560次受控执行、16个间接内容渠道、35个载荷目标及12种攻击方法。最强攻击成功率分别为：文本模式伪造完成17.0%、文件模式隐藏Unicode 25.5%、文件模式技能渠道16.0%。语义LLM评判器比规则评判器更常判定部分合规（7.3%对2.0%）。

## 正文

We assess indirect prompt injection in DeepSeek Harness (DSH), using AI-Infra-Guard (A.I.G) to construct tests, deliver controlled taint, execute DSH, collect traces, and judge outcomes. The study covers 14,560 controlled executions over 16 indirect-content channels, text and file carrier modes, 35 payload objectives, one unmodified baseline, and 12 attack methods. The experiment preserves DSH's agent loop, tool registry, model adapter, and session-event path; source tools and sensitive sinks are local fixtures, so attempted actions are recorded without external side effects. We evaluate each trace with a deterministic rule-based judge, (RuleJudge), and a semantic LLM-based judge, (LLMJudge). The strongest observed attack success rates are 17.0% under for fake-completion attack in text mode, 25.5% under for hidden Unicode in file mode, and 16.0% under for the skills channel in file mode. also assigns partial compliance more often than (7.3% versus 2.0%). We relate these results to DSH's treatment of tool results, additional contexts, and tool-call policy hooks, then identify controls that should sit between untrusted content and sensitive actions. Our code is available at https://github.com/Tencent/AI-Infra-Guard/tree/main/Research/deepseek-harness-security-assessment .