---
title: "超越攻击成功率：面向工具使用AI Agent的动作分级危害量表"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.07474v1"
permalink: "https://feed.astralor.com/items/itm_69be98291ef21efaa1963bcc"
published: "2026-07-08T14:38:01.000Z"
score: 81
channel: "ai"
tags: ["AgentDojo","AI Agent安全","危害评估","红队测试"]
---

# 超越攻击成功率：面向工具使用AI Agent的动作分级危害量表

## AI 点评

> 这篇论文直击当前AI Agent安全评估的痛点：二值指标掩盖了真实危害。对于AI安全研究人员和防御者来说，这个七级量表提供了一个可落地的评估框架，尤其值得关注的是它对“零攻击成功率”防御的揭露，说明简单指标可能产生虚假安全感。建议读者重点阅读实验部分，了解如何将量表应用到自己的红队日志中。

## 速览

现有AI Agent红队测试仅报告攻击是否成功（二值指标），忽略了实际危害程度。本文提出一个七级动作危害量表（L0-L6），基于动作是否可逆、是否跨范围影响第三方、是否权限提升来评估工具调用轨迹。在AgentDojo数据集上测试表明，该量表能揭示被二值指标掩盖的安全漏洞，例如某个防御报告零攻击成功率但实际存在跨范围泄露。使用三个前沿语言模型作为裁判，在序数一致性上与确定性神谕高度一致（Krippendorff's alpha=0.91），但仍存在系统性盲点（如未能识别升级链）。论文开源了全部代码和日志。

## 关键点

- 提出七级动作危害量表（L0-L6），从可逆性、跨范围影响、权限提升三个维度评估AI Agent工具调用轨迹的危害程度。
- 在AgentDojo数据集上，该量表发现了二值指标（攻击成功率）无法反映的安全漏洞，例如零攻击成功率下的跨范围泄露。
- 使用三个前沿大语言模型作为自动裁判，与确定性神谕的序数一致性高达0.91（Krippendorff's alpha），但存在系统性盲点，如未能识别升级链。

## 全文

Agentic red-teaming benchmarks report whether an injected agent was compromised as a single bit: the attack succeeded, or it did not. We argue that this binary attack-success rate discards the information a defender most needs, namely how harmful the resulting action was. We introduce an action-graded harm rubric that scores an agent's tool-call trajectory on a seven-level ordinal scale (L0 to L6) according to whether the executed action was reversible, whether it crossed scope to reach another party, and whether it expanded privilege. We compute the scale two ways: a deterministic oracle that reads the trajectory and the attacker's stated goal, and a panel of three frontier language-model judges that read a tag-free account of the same trajectory. Across four victim models and two defenses on the AgentDojo workspace suite, severity grading exposes three cases the binary metric hides, including a defense that reports a zero attack-success rate while still permitting an externally visible cross-scope leak through an unfiltered tool. The judge panel reproduces the oracle with high ordinal agreement (Krippendorff's alpha = 0.91) but shares systematic blind spots that we characterize, most notably a failure to recognize escalation chains. Unlike prior work that provides harm taxonomies, harmful-task completion tests, execution-level safety benchmarks, or severity-aware simulation, our contribution is a reusable, trace-grounded severity instrument applied to the actual actions recorded in existing red-team logs. All code, prompts, and per-episode logs are released.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_69be98291ef21efaa1963bcc