Adapt ASTRA to dynamic target strings

Extend the ASTRA attention-based prompt injection attack to scenarios with dynamic adversarial targets that depend on conversation history or contextual data (such as data leakage tasks), beyond fixed target strings, and evaluate its effectiveness in these dynamic target settings.

Background

The evaluation in the paper uses a fixed adversarial target string, aligning with prior defense benchmarks (e.g., SecAlign and StruQ) that test whether the model outputs a predetermined phrase. Real-world prompt injections often require dynamic targets, for instance exfiltrating specific sensitive information from the conversation history.

The authors explicitly state that adapting ASTRA to dynamic targets is left for future work, highlighting an important unresolved extension necessary to assess the attack’s applicability to realistic adversarial objectives.