一句话：提出黑盒攻击「提示克隆」，从输出行为轨迹中重建功能等价的系统提示，而非逐字窃取原文。
论文提出「提示克隆」（prompt cloning）这一新型黑盒攻击：其目标不是提取原始系统提示文本，而是重建功能等价的系统提示。作者基于一个关键观察——系统提示即使在强对齐与提示级防御下，仍会在模型输出中留下持续的行为痕迹。方法上，将系统行为分解为若干语义可解释的要素，通过精心设计的查询有选择性地诱发这些要素，再聚合具有代表性的行为轨迹，合成高保真度的克隆提示。大量评估表明，克隆提示在功能行为上可达到最高 85% 的语义相似度，较基座大模型最高提升 8%；当迁移到不同后端模型时，其表现甚至可超过原始系统提示。作者还对 GitHub 仓库进行大规模调研，发现单提示架构在开源 LLM 应用中仍普遍存在，说明该威胁模型具有现实意义。研究结果揭示提示克隆可导致机密 LLM 行为的未授权复制，并指出防御不应止于隐藏提示文本。
We introduce prompt cloning, a new black-box attack that reconstructs functionally equivalent system prompts rather than extracts original system prompts. Unlike prompt stealing, prompt cloning exploits the insight that system prompts leave persistent behavioral traces in outputs, even under strong alignment and prompt-level defenses. Our method decomposes system behavior into semantically interpretable elements, selectively elicits them through carefully designed queries, and aggregates representative traces to synthesize high-fidelity cloned prompts. Extensive evaluations show that cloned prompts replicate functional behavior with up to 85% semantic similarity, outperforming base LLMs by up to 8%, and even exceeding original system prompts when transferred to different back-end models. We also conduct a large-scale study on GitHub repositories, revealing that single-prompt architectures remain widespread in open-source LLM applications, reinforcing the real-world relevance of our threat model. Our findings reveal that prompt cloning enables unauthorized replication of confidential LLM behavior and underscore the urgent need for defenses that go beyond hiding prompt text.
DOI 原文 ·
@inproceedings{paperbot9275,
title = {Uncovering Prompt Elements: Cloning System Prompts from Behavioral Traces},
author = {Yi Qian and Fei Peng and Hao Wu and Ligeng Chen and Bing Mao},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00045}
}