Abstract
Multi-modal large language model (MLLM)-based web agents interact with webpage environments by generating actions based on screenshots of the webpages. Environmental prompt injection attacks manipulate the environment to induce the web agent to perform a specific, attacker-chosen action--referred to as the target action. However, existing attacks suffer from limited effectiveness or stealthiness, or are impractical in real-world settings. In this work, we propose EnvInjection, a new attack that addresses these limitations. Our attack adds a perturbation to the raw pixel values of the rendered webpage, which can be implemented by modifying the webpage's source code. After these perturbed pixels are mapped into a screenshot, the perturbation induces the web agent to perform the target action. We formulate the task of finding the perturbation as an optimization problem. A key challenge in solving this problem is that the mapping between raw pixel values and screenshot is non-differentiable, making it difficult to backpropagate gradients to the perturbation. To overcome this, we train a neural network to approximate the mapping and apply projected gradient descent to solve the reformulated optimization problem. Extensive evaluation on multiple webpage datasets shows that EnvInjection is highly effective and significantly outperforms existing baselines.
Abstract (translated)
基于多模态大型语言模型（MLLM）的网页代理通过根据网页截图生成动作来与网页环境互动。环境提示注入攻击通过操控环境，诱使网页代理执行特定的、由攻击者选定的动作——称为目标动作。然而，现有的攻击方法在有效性或隐蔽性方面存在局限，或者在现实世界场景中难以实施。在这项工作中，我们提出了一种新的攻击方式EnvInjection，旨在克服这些限制。 我们的攻击通过向渲染后的网页的原始像素值添加干扰来实现，这可以通过修改网页源代码完成。当这些被干扰的像素映射到截图后，干扰会诱使网页代理执行目标动作。我们将寻找这一干扰的任务形式化为一个优化问题。解决这个问题的关键挑战在于，原始像素值与截图之间的映射是非可微分的（non-differentiable），这使得难以将梯度反向传播到干扰上。为了克服这一点，我们训练了一个神经网络来近似该映射，并应用投影梯度下降法来求解重新表述后的优化问题。 在多个网页数据集上的广泛评估表明，EnvInjection具有高度有效性，并且显著优于现有的基准方法。
URL
https://arxiv.org/abs/2505.11717
