AI 中文总结
本研究审计LLM解释器在主动推理智能体中的可靠性，发现其面对观测扰动、错误行动和恶意文本时会产生流畅但错误的解释，并提出缓解措施，强调解释器测试应纳入智能体部署审计。
AI 中文摘要
LLM解释器正越来越多地被附加到自主智能体上作为运行时监督，操作员阅读生成的智能体信念和行动描述，而非其内部状态。我们审计该描述本身，将一个跟踪德国电网需求并调整发电量的主动推理（AIF）智能体与基于三个后端（GPT-4o、Claude-3-Opus、Gemini）的LLM解释器配对，并用三个黑盒触发条件探测该组合。每步向观测流注入600 MW的扰动，使智能体的后验移动490 MW，约占电网容量的0.9%。在注入期间产生的30个解释中，没有一个在既定规则下标记任何问题，且每个解释都流畅地叙述了被污染的信念。在智能体采取客观上错误行动的时间步上，所有三个解释器在80-95%的情况下（每个后端n=20）产生奉承性的合理化解释。观测元数据字段中攻击者控制的文本引导了解释器，其敏感性因提供商而异，且数据外泄在所有三个后端上均成功。我们针对每种失败提出了缓解措施，但未对其进行评估。在我们观察到的每次失败中，解释都是流畅且错误的。此外，解释器架构中没有任何机制在操作员依据解释行动之前检查解释的真实性。因此，对解释器的测试应属于任何智能体部署审计的一部分。
英文摘要
LLM explainers are increasingly attached to autonomous agents as runtime oversight, with operators reading a generated account of the agent's beliefs and actions rather than its internal state. We audit the account itself, pairing an Active Inference (AIF) agent that tracks German grid demand and adjusts generation with an LLM explainer on three backends (GPT-4o, Claude-3-Opus, Gemini), and probing the pair with three black-box triggers. Corrupting the observation stream by 600 MW per step moves the agent's posterior by 490 MW, roughly 0.9% of grid capacity. None of the 30 explanations produced during the injection flag anything under a stated rubric, and each narrates the corrupted belief fluently. On timesteps where the agent takes an objectively wrong action, all three explainers produce a sycophantic rationalization 80-95% of the time (n = 20 per backend). Attacker-controlled text in the observation metadata field steers the explainer, with susceptibility differing by provider and data exfiltration succeeding on all three. We propose mitigations for each failure but do not evaluate them. In every failure we observed, the explanation was fluent and wrong. Moreover, nothing in the explainer architecture checks whether an explanation is true before an operator acts on it. Testing the explainer therefore belongs in any audit of an agentic deployment.
Comments13 pages, 4 figures. Accepted at the ICML 2026 Workshop on Failure Modes in Agentic AI
