这篇论文提出了一个聪明的思路：用误导性回复代替直接拒绝，让AI自动攻击更难判断是否成功。实验显示CMPE方法在PAIR和GPTFuzz上几乎完全阻挡了越狱攻击，做AI安全的朋友值得一看。
该论文通过概率模型分析了针对智能体AI系统的攻击-防御场景，发现传统的检测-拦截防御在查询预算充足时，攻击成功率(ASR)可趋近于1，因为可预测的拒绝为攻击自动搜索提供了有效反馈。作者提出检测-误导策略，通过受控但非操作性的响应诱导攻击者判断器产生假阳性错误，实现有界的渐进ASR。具体实现方法CMPE（Contextual Misdirection via Progressive Engagement）在jailbreak基准上，将ASR上限估计降低两个数量级，并在端到端PAIR和GPTFuzz攻击运行中几乎消除了验证成功的攻击。
Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems
Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents. These capabilities make prompt-injection and jailbreak attacks more consequential, especially as attackers adopt model-guided automation to scale probing, prompt refinement, and response evaluation. This work analyzes the resulting attack-defense setting through a probabilistic model of a target system, its defense mechanism, and the attacker's automated judge. Our analysis shows that conventional detect-and-block defenses can allow attacker success rate (ASR) to approach one as the query budget grows, since predictable refusals provide useful feedback to automated search. We then examine detect-and-misdirect, where detected malicious interactions receive controlled, non-operational responses designed to induce false-positive errors in the attacker's judge. This strategy reduces the positive predictive value of attacker-selected candidates and yields a bounded asymptotic ASR. We evaluate a proof-of-concept realization of this strategy through Contextual Misdirection via Progressive Engagement (CMPE), a lightweight conversational misdirection method designed to replace predictable refusal text with safe but strategically misleading responses in automated jailbreak settings. On jailbreak benchmarks, CMPE reduces estimated ASR upper bounds by up to two orders of magnitude and nearly eliminates verified attack success in end-to-end PAIR and GPTFuzz attack runs.