ErosionBench scores alignment decay in enterprise multi-agent systems
Original title: ErosionBench: Probing Alignment Decay in Enterprise Multi-Agent Systems
The benchmark has 1,728 scenarios and 198 image attacks; a Meta-Auditor reached 98.5% recall at 2.9% false positives.
ErosionBench executes cross-session attacks in which poisoned shared state, long documents and trusted peer messages combine into unauthorized tool actions. Scenarios are authored as deterministic state graphs and scored against authorized intent and provenance rather than output text. It covers four enterprise domains and four decay mechanisms, labeled to the OWASP Top-10 for LLM Applications. Perimeter defenses suppressed attacks only by over-refusing 54-92% of legitimate work.
- The reference Meta-Auditor was tested on a family-disjoint 906-scenario held-out split.
- Image attacks were flagged about as reliably as text equivalents, with a recall gap of at most 2 points.
- Calibration kept false positives low across GPT, Gemini and Claude auditors.
- Recall tracked model capability and was strongest for Claude.
- Products
- ErosionBench
- Organizations
- OWASP
From the original article
1 min read at arxiv.orgAs enterprises delegate consequential work to multi-agent LLM systems, benign-looking requests can escalate into unsafe actions as they propagate across sessions through poisoned shared state, long-context documents, and trusted peer messages: no single message is malicious, yet the assembled tool action is.
By Riya Bharathwaj · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.