arXiv cs.AI· Kaixiang Wang, Junjie Li, Zhaojiacheng Zhou, Jiong Lou, Jie Li·· 1 天前AI 评分31
S1-Evo：针对类型化 System-1 决策模型的体验引导证据竞争攻击
S1-Evo: Experience-Guided Evidence Competition Attacks on Typed System-1 Decision Models
AI 导读
S1-Evo 是一种针对 LLM 智能体中类型化 System-1 决策模型的自进化攻击框架，通过契约感知的证据通道扰动不可信字段，诱发证据竞争并保持事实不变。
正文 · 原文
Abstract:Typed System-1 (S1) decision models are increasingly deployed in LLM agents for routing, moderation, and authorization to cut inference cost, yet untrusted context can still manipulate typed outputs and alter execution branches. Unlike autoregressive System-2 (S2) models, S1 interfaces score dynamic rules and options without token-by-token decoding, mismatching attacks targeting text continuation or explicit override commands. We propose S1-Evo, a self-evolving framework tailored to S1's contract-based option competition and margin feedback. S1-Evo perturbs untrusted fields via contract-aware evidence channels to induce \emph{evidence competition} with original task evidence while preserving fact invariance. Offline on seed tasks, it optimizes candidates via feedback search guided by directional margins and re-verification, distilling verified flips into experience cards. At test time, S1-Evo retrieves relevant cards to construct perturbations for unseen tasks. Across four benchmarks and three S1 models, S1-Evo reaches 71.99\% mean ASR and 57.47\% high-confidence ASR on \texttt{jev-1.14}, and causes up to 24.00\% E2E agent violations.
| Comments: | none |
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2611.16937 [cs.AI] |
| (or arXiv:2611.16937v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.16937 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Kaixiang Wang [view email]
[v1]
Thu, 12 Nov 2026 15:21:44 UTC (727 KB)
来源：arXiv cs.AI · arxiv.org