arXiv cs.AI· Chenyuan Yang, Hwiwon Lee, Jongseong Kim, Yihan Yang, Dongjun Kim, Yinfang Chen, Lingming Zhang·· 15 小时前AI 评分58
CyberDual：AI 攻击者与 AI 代码评审者在真实软件维护中的对抗评测
CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance
AI 导读
论文提出 CyberDual 对抗评测场，让攻击智能体在真实开源项目维护中植入可利用漏洞，再由评审智能体查找修复，并以重跑 PoC 是否成功作为胜负判定。三个评审智能体拦截了六个攻击者 1,088 次有效攻击中的 85-91%，但当攻击分散到真实上游提交时，约六分之一的攻击槽在评审后仍留下可用漏洞利用。
正文 · 原文
Abstract:Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE) |
| Cite as: | arXiv:2610.34435 [cs.CR] |
| (or arXiv:2610.34435v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34435 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Chenyuan Yang [view email]
[v1]
Sun, 25 Oct 2026 16:44:07 UTC (735 KB)
来源：arXiv cs.AI · arxiv.org