Google DeepMind 论文：多智能体攻击可突破 Gemini 4 Argon 的提示注入防御
DeepMind 用 8 组攻击智能体互相学习迭代，结果 Gemini 4 Argon 也被攻破 34% 的任务，开源模型更是几乎全败。做智能体工具调用的开发者都得看看，别以为人测不出漏洞就安全了。
Google DeepMind 发布论文指出提示注入问题尚未解决：人工红队攻击在近期 Gemini 模型上几乎不再奏效，容易让人误以为问题已被解决，但自动化智能体攻击仍能突破最强防御。
团队构建了 Agentic Optimizer，由 8 组攻击智能体组成，各自测试注入方案、共享笔记并迭代彼此的最优尝试。在 100 个工具调用任务上测试，攻击者目标仅是诱导一次随机的无害工具调用。在最多 320 次尝试下，最强攻击者在 34% 的任务上成功攻破 Gemini 4 Argon——这是防御最稳健的模型。
对比之下，开源模型 Kimi K3、GLM-5.3 和 DeepSeek-V4.1-Flash 仅在 1% 的任务上抵御了攻击，表明开源与闭源模型在提示注入防御能力上差距显著。
New Google DeepMind paper shows prompt injection is not solved, since a swarm of strong AI attacker agents still tricks even the best-defended models.
Prompt injection means hiding instructions in data an AI agent reads, like a tool result, to make it act for the attacker. Human red-teaming attacks now almost never work on recent Gemini models, so the problem can look solved.
They built Agentic Optimizer, 8 teams of AI agents that test injections, share notes, and build on each other's best attempts. They tested it on 100 tool-use tasks where the attacker only wanted one random, harmless tool call.
With up to 320 tries, the strongest attacker beat Gemini 4 Argon, the most robust model, on 34% of tasks. Open-weight Kimi K3, GLM-5.3, and DeepSeek-V4.1-Flash resisted only 1% of tasks.
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include Gemini 4 Argon, Google DeepMind, Kimi K3, prompt engineering.
Source attribution: curated from rohanpaul_ai (@rohanpaul_ai).
