arXiv cs.AI· Seyedarmin Azizi, Erfan Baghaei Potraghloo, Massoud Pedram·· 9 天前AI 评分51
研究：类型化决策模型作智能体护栏存在选项通道攻击
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
AI 导读
一篇 arXiv 论文评测了七个开放权重模型作为智能体护栏的表现，在提示词注入、越狱和有害内容筛查任务上，允许或拦截的决策准确率在 36% 到 72% 之间，而随机水平为 50%。
正文 · 原文
Abstract:A typed decision model reads a piece of text and returns a probability over caller-defined options, each with a short written definition, generating no text. Recent work places these models in agent systems as guardrails: the component that reads a proposed tool call or incoming message and decides whether to allow it. We evaluate seven open-weight models in that role and report the two error directions separately: a fail-open error allows a prohibited action and is a vulnerability; a fail-closed error blocks a permitted one and is only a cost. On prompt-injection, jailbreak and toxic-content screening, accuracy at the allow-or-block decision ranges from 36% to 72% against a chance level of 50%. A low error rate in one direction only reflects which answer a model defaults to: one allows nearly everything, another blocks nearly everything. On a synthetic suite of agent tool calls, six lines of server log text that say nothing about the policy raise a gate's fail-open rate from 0% to 63% on a policy it otherwise decides correctly. Giving the permissive option a misleading name, with its definition and the judged text untouched, raises that rate to between 93% and 100% on the four models that place the label in their input. Every defense we tested is defeated, either by an attacker who targets its mechanism or by attacker-controlled text. Escalating the least confident decisions does not help either: a decision an attack has reversed is no less confident than the one it replaced. Parsing each policy field into a typed value does eliminate one attack, but it also makes the model unnecessary: a deterministic rule over those values reaches 100% accuracy on all six policies. These models can reduce how many cases reach a reviewer, but on this evidence they should not be the component that decides. Code is available at this https URL.
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.12292 [cs.AI] |
| (or arXiv:2610.12292v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.12292 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Erfan Baghaei Potraghloo [view email]
[v1]
Thu, 8 Oct 2026 16:46:43 UTC (116 KB)
来源：arXiv cs.AI · arxiv.org