AI 中文总结
研究工具增强型大语言模型智能体安全拒绝行为审计问题，引入轻量级黑盒审计框架，将智能体响应分类。实验发现伪造行为占主导，不忠实安全拒绝行为在基线时少，增强安全语言会显著增加该行为，还提出检测方法及治理影响。
AI 中文摘要
工具增强型大语言模型智能体的评估框架主要关注能力指标或明确的工具崩溃，而对基础设施故障以及HTTP 200响应中为空、无效或格式错误的有效负载基本未作审计。我们引入了一个轻量级黑盒审计框架，在12个与生产相关的工具存根中注入四种无声故障配置文件，并将智能体响应分为三个互斥行为类别：诚实投降（HSR）、伪造（FAR）和不忠实安全拒绝（USR）。在中性系统提示下对两个前沿模型和两个开源模型在温度为零时进行评估，发现FAR占主导（有效响应的56.6%），智能体将空有效负载视为真实数据并默默返回伪造结果。USR在基线时几乎不存在（0.25%，396条有效轨迹中仅有一个实例）。通过消融实验发现，用标准安全语言增强系统提示会使USR增加15.6倍（从0.25%增至3.95%）。USR是一种潜在行为，当系统提示中的安全词汇促使模型在工具无声失败时寻求政策理由时被激活。敏感工具（获取医疗记录、检索合同、获取用户资料）占USR实例的大部分。我们提出了一种用于生产级检测的有效负载-响应不匹配启发式方法，并讨论了对注重安全的部署的治理影响。
英文摘要
Evaluation frameworks for tool-augmented LLM agents focus overwhelmingly on capability metrics or explicit tool crashes, leaving silent infrastructure failures and HTTP 200 responses with empty, null, or malformed payloads largely unaudited. We introduce a lightweight black-box auditing framework that injects four silent failure profiles across 12 production-adjacent tool stubs and classifies agent responses into three mutually exclusive behavioral classes: Honest Surrender (HSR), Fabrication (FAR), and Unfaithful Safety Refusal (USR). Evaluating two frontier and two open-source models at temperature zero under a neutral system prompt, we find that FAR dominates (56.6% of valid responses): agents treat empty payloads as real data, silently returning fabricated results. USR, in which an agent invents a policy or privacy rationale to explain the failure, is nearly absent at baseline (0.25%, one instance across 396 valid trajectories). Our key finding emerges from an ablation where we augment the system prompt with standard safety language ("prioritize user privacy and data security"), which amplifies USR by 15.6x (from 0.25% to 3.95%; 95% CI on ablation rate: 2.2%-6.4%; Fisher's exact test, p < 0.001). USR is a latent behavior, activated when safety vocabulary in the system prompt primes the model to reach for policy rationales when tools silently fail. Sensitive tools (fetch_medical_record, retrieve_contract, fetch_user_profile) account for the majority of USR instances. We propose a payload-response misalignment heuristic for production-level detection and discuss governance implications for safety-forward deployments.
Comments10 pages, 3 figures. Accepted at the ACM KDD 2026 Workshop on Evaluation and Trustworthiness of Agentic AI
