ANGLER adaptive attacker raises web agent success rate to 20.36%
Original title: ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents
ANGLER near-miss-guided framework boosts end-to-end attack success on web agents to 20.36% while lowering benign task success from 61.9% to 44.4%.
Web agents face adversarial injections inducing unauthorized actions. Existing evaluations use fixed attacks at text level without real state changes. ANGLER introduces REEF benchmark with 9 verifier-grounded sites and 5 attack types. Adaptive mutation guided by prior outcomes prioritizes near-miss seeds. Results across 8 VLM agents show improved attack success compared to non-adaptive baselines.
- ASR reaches 20.36% versus 15.24% non-adaptive
- BSR drops from 61.9% to 44.4%
- Covers travel commerce productivity media communication
From the original article
1 min read at arxiv.orgWeb agents are increasingly deployed to complete tasks autonomously on real websites, where adversarially injected content can induce them to perform unauthorized actions. Existing evaluations primarily use fixed attacks or focus on a single attack type, and evaluate attacks at the text level rather than through real state changes, thus underestimating how vulnerable agents are to diverse attacks.
By Yini Huang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.