Search papers, labs, and topics across Lattice.
This paper introduces PromptFuzz-SC, a novel black-box framework for evaluating LLM robustness against prompt injection attacks by combining semantic transformations and character-level obfuscation. It employs a hybrid search strategy (epsilon-greedy exploration and hill-climbing refinement) to efficiently discover adversarial prompts, and evaluates them using misuse success rate (MSR), Average Queries to Success (AQS), and Stealth. Experiments on DeepSeek show that the dual-space mutation strategy outperforms single-dimensional attacks, achieving a mean MSR of 0.189 and highlighting the need for composite mutation strategies in red-teaming.
DeepSeek LLMs are surprisingly vulnerable to prompt injection attacks that combine semantic and character-level mutations, outperforming single-strategy attacks by 12.5% in misuse success rate.
Prompt injection has emerged as a critical security threat to large language models (LLMs), yet existing studies predominantly focus on single-dimensional attack strategies, such as semantic rewriting or character-level obfuscation, which fail to capture the combined effects of multi-space perturbations in realistic scenarios. In addition, systematic black-box robustness evaluations of recent Chinese LLMs, such as DeepSeek, remain limited. To address these gaps, we propose PromptFuzz-SC, a semantic-character dual-space mutation framework for evaluating LLM robustness against prompt injection. The framework integrates semantic transformations (e.g., paraphrasing and word-order perturbation) with character-level obfuscation (e.g., zero-width insertion and encoding-based mutation), forming a unified and extensible mutation operator library. A hybrid search strategy combining epsilon-greedy exploration and hill-climbing refinement is adopted to efficiently discover high-quality adversarial prompts. We further introduce a unified evaluation protocol based on three metrics: misuse success rate (MSR), Average Queries to Success (AQS), and Stealth. Experimental results on DeepSeek demonstrate that dual-space mutation achieves the strongest overall attack performance among the evaluated strategies, attaining the highest mean MSR (0.189), peak MSR (0.375), and mean Stealth. Compared with semantic-only and character-only mutation, it improves mean MSR by 12.5% and 5.6%, respectively. While not consistently minimizing query cost, the proposed method achieves competitive best-case efficiency and maintains strong imperceptibility, indicating a more favorable balance between attack effectiveness and concealment. These findings highlight the importance of composite mutation strategies for robust red-teaming of LLMs and provide practical insights for the design of multi-layer defense mechanisms.
