一句话：系统刻画了 prompt-to-SQL 注入攻击，评估七个 LLM 与五个真实应用的风险，并提出四种防御技术。
论文关注基于 LangChain、LlamaIndex 等中间件构建的 LLM 集成 Web 应用：用户 prompt 被翻译为 SQL 查询，而未净化的 prompt 可能导致 SQL 注入。作者系统性地刻画了 prompt-to-SQL（P2SQL）注入，通过多个具体实例分析其变体与对应用安全的影响。评估方面，作者测试了七种先进 LLM，表明 P2SQL 攻击在不同语言模型上普遍存在风险；并通过手工与自动化方法在五个真实应用中发现了 P2SQL 漏洞。结果表明 LLM 集成应用极易受到此类注入攻击，亟需健壮防御。为此，作者提出四种有效防御技术，可作为 LangChain 框架的扩展集成。
Large Language Models (LLMs) have found widespread applications in various domains, including web applications with chatbot interfaces. Aided by an LLM-integration middleware such as LangChain, user prompts are translated into SQL queries used by the LLM to provide meaningful responses to users. However, unsanitized user prompts can lead to SQL injection attacks, potentially compromising the security of the database. In this paper, we present a comprehensive examination of prompt-to-SQL ($\mathbf{P}_{2} \mathbf{S Q L}$) injections targeting web applications based on frameworks such as LangChain and LlamaIndex. We characterize$\mathrm{P}_{2} \text{SQL}$injections, exploring their variants and impact on application security through multiple concrete examples. We evaluate seven state-of-the-art LLMs, demonstrating the risks of$P_{2}$SQL attacks across language models. By employing both manual and automated methods, we discovered$\mathrm{P}_{2} \text{SQL}$vulnerabilities in five real-world applications. Our findings indicate that LLMintegrated applications are highly susceptible to$\mathrm{P}_{2} \text{SQL}$injection attacks, warranting the adoption of robust defenses. To counter these attacks, we propose four effective defense techniques that can be integrated as extensions to the LangChain framework.
@inproceedings{paperbot8767,
title = {Prompt-to-SQL Injections in LLM-Integrated Web Applications: Risks and Defenses},
author = {Rodrigo Pedro and Miguel E. Coimbra and Daniel Castro and Paulo Carreira and Nuno Santos},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00007}
}