arXiv cs.CL· Chiyu Zhang, Lu Zhou, Xiaogang Xu, Huiqin Yang, Bendong Jiang, Xiaolei Zhang, Yiran Zhao, Ruyi Chen, Jiafei Wu, Liming Fang, Zhe Liu·· 12 小时前AI 评分58
LITMUS：在真实操作系统环境中评测 LLM 智能体的行为越狱
LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments
AI 导读
LITMUS 是面向 LLM 智能体在真实操作系统环境中行为越狱的基准，包含 819 个高风险测试用例，覆盖越狱话术、技能注入和实体包装三类攻击范式，并通过语义与物理双层验证及 OS 级状态回滚隔离测试用例。
正文 · 原文
Authors:Chiyu Zhang, Lu Zhou, Xiaogang Xu, Huiqin Yang, Bendong Jiang, Xiaolei Zhang, Yiran Zhao, Ruyi Chen, Jiafei Wu, Liming Fang, Zhe Liu
Abstract:The rapid proliferation of LLM-based autonomous agents in real operating system environments introduces a new category of safety risk beyond content safety: behavior jailbreak, where an adversary induces an agent to execute dangerous OS-level operations with irreversible consequences. Existing benchmarks either evaluate safety at the semantic layer alone, missing physical-layer harms, or fail to isolate test cases, letting earlier runs contaminate later ones. We present LITMUS (LLM-agents In-OS Testing for Measuring Unsafe Subversion), a benchmark addressing both gaps via a semantic-physical dual verification mechanism and OS-level state rollback. LITMUS comprises 819 high-risk test cases organized into one harmful seed subset and six attack-extended subsets covering three adversarial paradigms (jailbreak speaking, skill injection, and entity wrapping), plus a fully automated multi-agent evaluation framework judging behavior at both conversational and OS-level physical layers. Evaluation across frontier agents reveals three findings: (1) current agents lack effective safety awareness, with strong models (e.g., Claude Sonnet 4.6) still executing 40.64% of high-risk operations; (2) agents exhibit pervasive Execution Hallucination (EH), verbally refusing a request while the dangerous operation has already completed at the system level, invisible to every prior semantic-only framework; and (3) skill injection and entity wrapping attacks achieve high success rates, exposing pronounced agent vulnerabilities. LITMUS provides the first standardized platform for reproducible, physically grounded behavioral safety evaluation of LLM agents in real OS environments.
| Comments: | Accepted at NeurIPS 2026 Oral. 32 pages, including appendices |
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL) |
| Cite as: | arXiv:2605.10779 [cs.CR] |
| (or arXiv:2605.10779v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2605.10779 arXiv-issued DOI via DataCite |
Submission history
From: Chiyu Zhang [view email]
[v1]
Mon, 11 May 2026 16:14:04 UTC (3,352 KB)
[v2]
Wed, 4 Nov 2026 12:30:56 UTC (3,451 KB)
来源：arXiv cs.CL · arxiv.org