arXiv cs.CL· Hasan Demirkiran, Jens Ernstberger·· 2 天前AI 评分30
语言是智能体安全护栏的攻击面：LinguaGuardBench 揭示多语言请求下的判定翻转
Language Is a Security Surface for Agent Guards
AI 导读
研究者构建 LinguaGuardBench，将 TS-Bench AgentDojo-Traj 的 1,220 条标注步骤中的用户指令翻译成德语、法语、土耳其语、斯瓦希里语和阿姆哈拉语，工具调用与标签保持逐字节一致，以检验护栏判定是否随语言变化。
正文 · 原文
Abstract:Step-level guards decide, before each tool call, whether an agent's next action is safe given the user's request and the trajectory so far. Users write those requests in many languages, while guard prompts and the benchmarks on which purpose-built guards are trained and evaluated are English. We ask whether a guard's verdict depends on the language of the request. We build LinguaGuardBench from the 1,220 labelled steps of TS-Bench AgentDojo-Traj: we translate only the user instruction into German, French, Turkish, Swahili and Amharic, and keep every tool call, observation and label byte-identical, so any change in a verdict is attributable to language alone. Six English rewordings and a whitespace placebo serve as controls, and managed guards are run three times to measure their noise. Across 19 guards, from frontier APIs to 4B open models and four purpose-built agent guards, most open, small and purpose-built guards change verdicts under translation beyond their own noise floor, and the effect grows with the rarity of the language: among the nine guards below 13B parameters, the mean placebo-adjusted flip rate rises from +1.5 pp on French to +4.4 pp on Amharic. Purpose-built guards are the most sensitive. The direction of the damage tends to follow guard size: open guards of 12-30B parameters block more benign steps (up to +5.0 pp false positives), and every significant loss of recall is in a guard below 10B (up to -7.4 pp). Frontier guards shift by at most about one point; the strongest, Gemini 3.8 Flash, returns identical verdicts with and without the request. The damage is concentrated in a few instructions and, in a post-hoc analysis, falls on steps where the agent's reasoning restates the English request, consistent with guards reacting to inconsistency between channels. English paraphrase moves every guard less than translation does. We release the benchmark and all 489k verdicts.
| Comments: | Accepted at the NeurIPS 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond (AIWILD). 9 pages plus appendices |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.22244 [cs.CR] |
| (or arXiv:2610.22244v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.22244 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Hasan Demirkiran [view email]
[v1]
Thu, 15 Oct 2026 17:19:40 UTC (82 KB)
来源：arXiv cs.CL · arxiv.org