arXiv cs.AI· Hasan Demirkiran, Jens Ernstberger·· 2 天前AI 评分31
AI 智能体安全评估中的捷径敏感性研究
Shortcut Sensitivity in Agent-Safety Evaluations
AI 导读
研究者提出三级捷径审计框架，审计 LinuxArena 轨迹和两个 TS-Bench 衍生数据集，发现基准数据的表征方式会实质性改变安全守卫的决策与评估表现。
正文 · 原文
Abstract:AI agents take actions through tools. Some actions are sensitive, so guards that supervise them must themselves be evaluated reliably. Yet the data used to evaluate a guard can include cues that make labels predictable without measuring the intended safety construct, and those cues can also influence guard decisions. We introduce a three-level shortcut-auditing framework and audit completed LinuxArena trajectories and two TS-Bench-derived step datasets. We distinguish label predictability, observational guard association, and paired decision sensitivity. In LinuxArena, shorter average shell commands strongly predict trajectory labels. In AgentDojo-Traj, exact-tool lookup falls from F_1=.901 with mixed-domain folds to .495 under domain holdout. In AgentHarm-Traj, released TS-Guard F_1 falls from .902 under row weighting to .719 with equal interaction weighting, while balanced accuracy rises. We then test the strongest safe-row marker association in a seven-configuration screen on a frozen 64-step AgentDojo-Traj cohort using repeated, interleaved Haiku calls. Rewriting the <INFORMATION> marker lowers blocking by 8.33 percentage points, while opaque tool aliases raise it by 11.46 points. All unsafe calls remain blocked; the changes concern false positives against inherited labels. Both effects remain nonzero after subtracting the formatting-placebo effect, with exploratory 95% ranges excluding zero. The same edits also change measured accuracy against inherited labels. This provides direct evidence that benchmark representation can materially change a guard's decisions and measured evaluation performance. The Haiku-sized effects do not reproduce in Luna or deterministic Q8 TS-Guard. We recommend domain group holdouts, evaluation-unit metrics, and placebo-controlled paired interventions.
| Comments: | Accepted at the NeurIPS 2026 workshops TAE (Can We Trust AI Evaluation?) and AIWILD (Agents in the Wild: Safety, Security, and Beyond) |
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.22243 [cs.AI] |
| (or arXiv:2610.22243v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.22243 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Hasan Demirkiran [view email]
[v1]
Thu, 15 Oct 2026 17:18:05 UTC (34 KB)
来源：arXiv cs.AI · arxiv.org