---
title: "重新思考AI系统的渗透测试：从资源损害到行为目标违规"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.14006v1"
permalink: "https://feed.astralor.com/items/itm_960fa450a96feb34dd32c266"
published: "2026-07-15T16:36:54.000Z"
score: 79
channel: "ai"
tags: ["Agent失调","AI安全","AI系统评估","提示注入","渗透测试","行为目标违规"]
---

# 重新思考AI系统的渗透测试：从资源损害到行为目标违规

## AI 点评

> 这篇论文精准地击中当前AI系统安全评估的痛点：传统渗透测试只管资源破坏，却忽略了AI独有的行为操控风险。对于从事AI安全、红蓝对抗、模型审计的从业者来说，这是一份必须阅读的基线文献，它提供了系统化的思考框架和可复用的测试流程。

## 速览

本文提出AI系统的渗透测试应从传统的资源损害转向行为目标违规。作者定义了AI渗透为诱导AI行为违反操作目标，并引入攻击途径如提示注入、数据投毒、传感器操纵、工具滥用等。论文提出一个包含识别目标、映射行为、分析攻击面、定义失败标准、执行场景测试和报告证据的工作流，并以AI安全运营中心助手为例说明。这一框架为部署中AI系统的对抗成功评估提供了技术基础。

## 关键点

- 传统渗透测试（资源破坏）不足以应对AI系统，因为攻击者可通过行为操纵而不直接破坏基础设施。
- 重新定义AI渗透测试为基于目标的行为评估，攻击途径包括提示注入、数据投毒、检索污染、Agent失调等。
- 提出七步测试工作流：识别操作目标→映射AI行为→分析对抗影响面→定义行为失败标准→执行场景测试→报告证据链条。
- AI安全运营中心（SOC）助理示例展示了如何通过行为影响而非基础设施破坏实现渗透。

## 全文

Penetration testing traditionally evaluates whether adversaries can exploit weaknesses in software, infrastructure, configurations, or operational controls to achieve security-relevant compromise. This paradigm remains necessary for AI-enabled systems, but it is no longer sufficient. In such systems, adversaries may influence prompts, retrieved content, sensor inputs, training data, memory, tools, or human-AI interaction loops to alter system behavior without directly compromising the underlying infrastructure. This paper reframes penetration testing for AI-enabled systems as objective-driven behavioral evaluation. We define an AI-enabled system as one in which learned models materially influence behavior affecting operational outcomes, and we define AI-enabled penetration as the feasible induction of AI-governed behavior that violates one or more operational objectives under an explicit threat model. This definition preserves conventional penetration testing while extending it to adversarial pathways such as prompt injection, indirect prompt injection, data poisoning, sensor manipulation, retrieval poisoning, tool misuse, and agentic misalignment. We further propose a testing workflow that identifies operational objectives, maps AI-governed behavior, analyzes adversarial influence surfaces, defines behavioral failure criteria, executes scenario-based tests, and reports evidence linking adversarial action to objective violation. A running example involving an AI-enabled security operations center assistant illustrates how penetration may occur through behavioral influence rather than infrastructure compromise. Together, the definitions, workflow, and example provide a technical framework for evaluating adversarial success in deployed AI-enabled systems.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_960fa450a96feb34dd32c266