一句话：提出 IPH 提示词劫持攻击，以黑盒方式逆向 LLM 应用的隐藏指令，并在 5000 个真实应用中验证超 95.1% 存在指令泄露风险。
OpenAI 等平台允许开发者以自定义应用的形式封装隐藏的系统指令（inception prompt）并调用外部工具，形成了超过 300 万个应用的大型生态，但其中的指令泄露会威胁开发者的知识产权与隐私。本文提出一种面向 LLM 应用的 inception prompt hijacking 攻击 IPH，以黑盒方式逆向这些应用的隐藏提示词：攻击者无需访问模型内部或应用源码，仅通过精心构造的对抗性提示即可诱导应用逐步暴露其系统指令。作者在 5000 个真实商用 LLM 应用上系统评估了该威胁，结果显示超过 95.1% 的应用可通过一个或多个对抗提示被泄露指令。该工作量化了真实 LLM 应用生态中指令保护的整体脆弱性，并提醒开发者需要在指令设计中集成针对性的防御策略。
Large language models (LLMs) demonstrate powerful natural language semantics understanding capabilities and are widely integrated into applications. OpenAI provides a platform for developers to construct custom applications, extending ChatGPT's functions and integrating external tools. Since its release in November 2023, over 3 million custom applications have been created. However, such a vast ecosystem also conceals security and privacy threats. For developers, instruction leaking attacks threaten the intellectual property of instructions in LLM applications through carefully crafted adversarial prompts. To systematically evaluate the scope of threats in real-world LLM applications, we develop an inception prompt hijacking attack, namely IPH, target LLM applications. Our experiments on 5,000 real-world LLM applications reveal that over 95.1% of applications are vulnerable to instruction-leaking attacks via one or more adversarial prompts. Our findings raise awareness among LLM applications developers about the importance of integrating specific defensive strategies in their instructions.