---
title: "针对Web Agent的安全保证的不信任内容屏蔽方法"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05277v1"
permalink: "https://feed.astralor.com/items/itm_cd6bafc3954ab8a87752ed71"
published: "2026-07-06T16:22:37.000Z"
score: 81
channel: "ai"
tags: ["Web Agent","不信任内容屏蔽","提示注入","文档对象模型"]
---

# 针对Web Agent的安全保证的不信任内容屏蔽方法

## AI 点评

> 这篇论文精准切中了Web Agent安全部署的痛点，提出了一种简单却优雅的解决方案。对于任何正在构建或使用Web Agent的团队，这都是一篇必读之作。它展示了如何在不牺牲安全性的前提下保持Agent的感知与交互能力。

## 速览

本论文针对Web Agent面临的提示注入攻击，提出一种名为“不信任内容屏蔽”（UCM）的防御方法。核心洞察是网页的文档对象模型（DOM）足以区分可信与不可信区域，无需读取内容。UCM通过在数据到达Agent前屏蔽不可信区域，并将交互路由到沙箱接口，恢复信任边界，实现安全保证。代码已开源。该方法简单有效，为Web Agent的可证明安全部署提供了实用方案。

## 关键点

- 提出UCM方法，利用DOM结构区分可信与不可信区域，无需内容分析。
- 通过屏蔽不可信内容并路由交互到沙箱，恢复Web环境中的信任边界。
- 为Web Agent提供可证明安全保证，解决结构化纠缠导致的防御失效问题。
- 代码开源，便于复现与应用。

## 全文

Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage's Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_cd6bafc3954ab8a87752ed71