SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents
SEAD shows a state-aware defense cutting tool-agent attack success from 48 percent to 4 percent.
SEAD treats attack and defense of tool-using language-model agents as partially observed control of external state, because earlier actions can change files, permissions, or records. The DART attacker breaks harmful goals into locally plausible steps and uses feedback from actual tool execution to search trajectories, improving semantic attack success by 18.8 to 35.9 percentage points across four target models. The SAGE defender investigates relevant state with read-only queries before allowing or blocking each action. It preserves 95.79% of benign trajectories, intercepts 92.73% of harmful paths, and in online evaluation reduces DART's executable success from 48.0% to 4.0%.
- DART raises semantic attack success by 18.8 to 35.9 points.
- Gains hold under executable checks across four target models.
- SAGE preserves 95.79% of benign trajectories.
- It blocks 92.73% of harmful paths by the harm boundary.
- Online, executable attack success falls from 48% to 4%.
From the original article
1 min read at huggingface.co
Language-model agents increasingly use tools to act on external systems. Earlier actions can alter files, permissions, database records, or other state, making a later routine-looking action harmful. Yet the visible interaction may not reveal the underlying state needed to assess that action.
By Xinjie Shen, Junran Wang, Rongzhe Wei · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.