当工具悄然撒谎：评估与缓解工具增强型数据智能体的盲从行为
When Tools Silently Lie: Evaluating and Mitigating Blind Compliance in Tool-Augmented Data Agents
- Tongji University（同济大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
针对工具增强型数据智能体盲从工具错误输出的问题，提出ToxicBench基准，通过污染实验与人工审计揭示检查与采纳的失败模式，并指出证据可用性与答案选择是可靠性的互补维度。
AI中文摘要：
工具增强型数据智能体依赖工具输出进行分析决策。然而，成功的执行可能返回看似合理但不正确的证据，这要求智能体决定是信任还是验证该证据。理解这一失败需要同时考察通过检查获得的证据以及最终采纳的答案。我们引入了ToxicBench，用于在数值、标签、模式和检索错误下衡量检查与采纳行为，并在固定源数据上配对干净与受污染的观测。在跨三个适配器的118任务GPT评估中，污染使任务成功率降低了26至39个百分点。普通重试在一次性污染下有所帮助，而重复污染则揭示了检查后错误答案的采纳。对三个公开表格的控制实验隔离了提供的证据如何影响恢复。在冻结评分器后，我们将其判断与200条轨迹上的人工标注进行比较，发现任务成功率一致性达96%。人工判断支持重试相对于Base的增益，并确认了在审计任务上检查后的采纳行为。我们发布了轨迹、版本化评分以及参考与交付审计。这些发现凸显了证据可用性和答案选择作为智能体可靠性的互补维度。
英文摘要：
Tool-augmented data agents rely on tool outputs for analytical decisions. Yet successful execution can return plausible but incorrect evidence, requiring agents to decide whether to trust or verify it. Understanding this failure requires examining both the evidence obtained through checking and the answer ultimately adopted. We introduce ToxicBench to measure checking and adoption under numerical, label, schema, and retrieval errors, pairing clean and poisoned observations over fixed source data. In the 118-task GPT evaluation across three adapters, poisoning lowers task success by 26 to 39 percentage points. Ordinary retries help under one-shot poisoning, whereas repeated poisoning reveals wrong-answer adoption after checking. Controls on three public tables isolate how supplied evidence affects recovery. After freezing the scorer, we compare its judgments with human annotations on 200 trajectories, finding 96% task-success agreement. Human judgments support retry gains over Base and confirm adoption after checking on audited tasks. We release trajectories, versioned scoring, and reference and delivery audits. These findings highlight evidence availability and answer selection as complementary dimensions of agent reliability.
