“我强烈怀疑这个网站是骗局”：自主网络代理中无防御的PII泄露与检测基准测试
"I Strongly Suspect This Website Is a Scam": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents
AI总结：
本文通过构建包含91个攻击者控制环境和10个良性孪生基线的基准Scammer4U，评估前沿自主网络代理在社交工程攻击下的PII泄露风险，发现关键PII泄露率高达54-93%，并揭示了代理检测到攻击但仍有35.9%概率提交PII的检测-行动差距。
摘要：
欺骗性网络内容广泛存在于互联网上，通常被称为社交工程攻击，它操纵自主网络代理将用户的个人身份信息（PII）提交给攻击者控制的端点。在本文中，我们表明社交工程攻击在从前沿网络代理中提取关键级PII方面非常有效，对已部署的代理系统构成严重风险。为了量化这一风险，我们引入了Scammer4U，一个预先注册的基准测试，包含91个攻击者控制的环境和10个良性孪生基线，涵盖8个攻击向量和16个站点类别，采用8轴因子分类法，隔离单个攻击设计因素的因果贡献。在前沿代理中，我们发现无隐私指导时关键级PII泄露率达到54-93%，而良性孪生基线为0%，证实泄露归因于攻击而非偶然的表单填写。升级提示级缓解措施在四个模型家族中产生急剧的模型依赖性降低，并且在汇总水平上仍不足以可靠地防止关键PII提交。最关键的是，我们识别出一个检测-行动差距：独立LLM法官确认代理推理已标记网站为可疑的情况下，代理仍然在35.9%的会话中提交关键PII，而代理未表达怀疑时为66.1%，这一30.2%的差距在四个模型家族中均稳健。我们的发现表明，基于代理自身对攻击识别的防御措施依赖于错误的信号，这激发了独立于代理推理循环的出站提交输出级拦截。
英文摘要：
Deceptive web content, widely instantiated across the internet and commonly known as \textit{social-engineering attacks}, manipulates autonomous web agents into submitting users' personally identifiable information (PII) to attacker-controlled endpoints. In this paper, we show that social-engineering attacks are highly effective at extracting critical-tier PII from frontier web agents, posing a severe risk to deployed agentic systems. To quantify this risk, we introduce \textbf{\textsc{Scammer4U}}, a pre-registered benchmark of 91 attacker-controlled environments and 10 benign-twin baselines, spanning 8 attack vectors and 16 site categories on an 8-axis factorial taxonomy that isolates the causal contribution of individual attack design factors. Across frontier agents, we find that critical-tier PII leakage reaches 54--93\% under no privacy guidance, compared to 0\% on benign-twin baselines, confirming that leakage is attack-attributable rather than incidental form-filling. Escalating prompt-level mitigation yields sharply model-dependent reductions across the four families and remains insufficient to reliably prevent critical PII submission at the pooled level. Most critically, we identify a detection--action gap: agents whose reasoning an independent LLM judge confirms has flagged the site as suspicious still submit critical PII in 35.9\% of sessions, versus 66.1\% when no suspicion is verbalized, a 30.2\% gap robust across all four model families. Our findings reveal that defenses conditioned on the agent's own recognition of an attack are gating on the wrong signal, motivating output-level interception of outbound submissions that operates independently of the agent's reasoning loop.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
