AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination
AgentLSD benchmark shows deceptive CTF artifacts like fake flags and decoy endpoints steer AI security agents wrong, inflating turns and tokens.
The paper defines adversarial task contamination, where deceptive artifacts in agent environments, including non-instructional evidence beyond prompt injection, influence AI security agents. AgentLSD injects trap artifacts such as fake flags, misleading hints, decoy endpoints, and hidden cues into 11 web CTF challenges, evaluating six models with paired clean and trap-augmented runs. Clean-condition agents capture 41% of flags, and even successful captures see roughly +20 turns and +2k reasoning tokens, with heterogeneous solve-rate effects. The framework, configurations, and traces are released.
- Task contamination extends prompt injection with non-instructional deceptive evidence like fake results
- Six models evaluated on 11 web CTF challenges; 41% clean flag-capture rate
- Traps add about 20 turns and 2k reasoning tokens even when flags are recovered
- Some model-challenge pairs follow decoys or submit wrong flags
From the original article
1 min read at arxiv.orgAI agents for security inspect web pages, source code, logs, configuration files, and command outputs. These environments may contain deceptive artifacts that influence the agent's behavior. We call this adversarial task contamination.
By Matteo Golinelli · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.