Prompt injection attacks manipulate webpage content to cause web agents to execute attacker-specified tasks instead of the user's intended ones. Existing methods for detecting and localizing such attacks achieve limited effectiveness, as their underlying assumptions often do not hold in the web-agent setting. In this work, we propose WebSentinel, a two-step approach for detecting and localizing prompt injection attacks in webpages. Given a webpage, Step I extracts \emph{segments of interest} that may be contaminated, and Step II evaluates each segment by checking its consistency with the webpage content as context. We show that WebSentinel is highly effective, substantially outperforming baseline methods across multiple datasets of both contaminated and clean webpages that we collected. Our code is available at: https://github.com/wxl-lxw/WebSentinel.

翻译：提示注入攻击通过操纵网页内容，诱导网络代理执行攻击者指定的任务而非用户预期任务。现有检测与定位方法因基本假设在网络代理场景中往往不成立，导致效果有限。本研究提出WebSentinel——一种针对网页提示注入攻击的双阶段检测与定位方法。给定目标网页，第一阶段提取可能受污染的\textbf{兴趣片段}，第二阶段通过检查各片段与网页上下文内容的一致性进行评估。实验表明，WebSentinel在自建污染/清洁网页混合数据集上表现优异，显著超越基线方法。代码已开源：https://github.com/wxl-lxw/WebSentinel。