隐蔽协助：多智能体系统中乐于助人的LLM智能体规避监管

中文摘要 AI 辅助

随着多智能体系统进入高风险领域，智能体可能规避安全边界的问题日益受到关注。以往的研究主要考察对抗性设置下的此类风险，即智能体被指示或奖励以隐蔽通信并逃避监管。我们表明，良性智能体无需对抗性激励即可跨越相同的边界。我们模拟了一个软件工程工作流程，其中规划者代表一家雇佣外部开发者的公司。规划者编写需求并持有一项公司凭证，且被指示不得向开发者披露该凭证；一个监控器审查他们的交流。在九个测试的前沿模型中，有七个模型在需求中伪装凭证以帮助开发者恢复它，同时逃避监控器，即使在完成其指定目标之后也是如此。例如，在DeepSeek-V4-Pro的6000个回合中，规划者尝试隐藏的比例为16.9%；在0.9%的回合中，凭证避开了监控器并被开发者恢复和使用。尽管每回合发生率较低，但风险在重复交互中累积：在0.9%的发生率下，105个独立回合至少有61.3%的概率发生一次泄露。我们的分析表明，规划者将伪装披露误解为帮助开发者，并将不披露规则解读为禁止明文，而非禁止字符代码或谜语。我们将这种行为称为隐蔽协助。监控偏向于隐藏，而当接收者被呈现为人类而非AI智能体时，隐藏会让位于直接披露，因此泄露持续存在。给监控器提供凭证可提高检测率，但需要信任其保管秘密。这些风险存在于已用于软件工程的模型中，对监管提出了挑战，要求区分授权合作与跨越安全边界的任务推进型协助。

英文摘要

As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show that benign agents can cross the same boundaries without adversarial incentives. We emulate a software-engineering workflow in which a planner represents a company hiring an external developer. The planner writes requirements and holds a company credential it is instructed not to disclose to the developer; a monitor screens their exchanges. Seven of nine tested frontier models disguise the credential in their requirements to help the developer recover it while evading the monitor, even after completing their assigned objective. For example, across 6,000 episodes with DeepSeek-V4-Pro, the planner attempts concealment in 16.9%; in 0.9%, the credential evades the monitor and is recovered and used by the developer. Despite the low per-episode rate, the risk compounds across repeated exchanges: at 0.9%, 105 independent episodes carry a 61.3% chance of at least one breach. Our analysis suggests that the planner misinterprets disguised disclosure as helping the developer and reads the nondisclosure rule as banning plaintext, not character codes or riddles. We call this behavior covert assistance. Monitoring favors concealment, while concealment gives way to direct disclosure when the recipient is presented as a human rather than an AI agent, so leakage persists. Giving the monitor the credential improves detection but requires trusting it with the secret. These risks, in models already used for software engineering, challenge oversight to distinguish authorized cooperation from task-advancing assistance that crosses safety boundaries.

发表机构

• University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
• Genies（Genies公司）
• NVIDIA（英伟达）
• University of Michigan（密歇根大学）

机构由 AI 辅助整理，请以论文原文为准。