X-AgentRed：在不断演进的多服务生态中对个人智能体进行红队测试
X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems
AI总结：
X-AgentRed是一种自演进红队测试框架，通过工具依赖图和执行反馈发现跨服务有害路径，在四个前沿智能体模型上的有害路径率和工具覆盖率均显著优于STAC。
摘要：
个人智能体越来越多地通过工具连接到网络和应用中的各类服务。由于其行动的效果会在不同服务间累积并相互作用，当智能体执行良性用户请求时，可能会产生意外或有害的结果。主动识别这类组合故障需要系统地探索多样化的跨服务路径。现有的红队测试方法通常仅提示大型语言模型（LLM）从任务和环境描述中识别潜在有害路径，或将人类或LLM指定的有害目标分解为看似良性的动作组合。然而，生成过程存在训练数据中学习到的模式偏差，可能偏向熟悉的工具组合，导致对新颖的跨服务交互探索不足。为解决这一问题，我们提出X-AgentRed，这是一种自演进的红队测试框架，它通过工具依赖图发现有害的工具调用路径，并利用执行反馈对这些路径进行扩展和优化。通过分析每个工具的效果、潜在危害及执行前置条件，红队测试智能体构建了一个有向图，用于捕捉一个工具的效果如何满足另一个工具的执行前置条件。从该图中采样的路径会被实例化为现实场景，使智能体能够产生有害结果。执行反馈通过工具替换多样化有害路径，并优化失败路径中受阻步骤的前置条件以实现进一步执行，从而实现自改进。在四个前沿智能体模型上，X-AgentRed实现了STAC方法1.77倍的有害路径率，且探索了更多样化的工具，平均工具覆盖率达到STAC的2.99倍。
英文摘要：
Personal agents increasingly connect to services across the web and applications by using tools. As the effects of their actions accumulate and interact across services, unintended or harmful outcomes can arise when agents fulfill benign user requests. Proactively identifying these compositional failures requires systematically exploring diverse cross-service paths. Existing red-teaming methods often simply prompt LLMs to identify potentially harmful paths from task and environment descriptions or decompose harmful objectives specified by humans or LLMs into seemingly benign action combinations. However, generation is biased toward patterns learned during training, potentially favoring familiar tool combinations and leaving novel cross-service interactions underexplored. To address this, we propose X-AgentRed, a self-evolving red-teaming framework that discovers harmful tool call paths through a graph of tool dependencies and expands and refines them using execution feedback. By analyzing each tool's effects, potential harms, and preconditions for execution, the red-teaming agent constructs a directed graph that captures how one tool's effects can satisfy another's execution preconditions. Recipes sampled from this graph are instantiated as realistic scenarios in which agents can produce harmful outcomes. Execution feedback enables self-improvement by diversifying paths that produce harm through tool substitution and refining preconditions at blocked steps in unsuccessful paths to enable further execution. Across four frontier agentic models, X-AgentRed achieves $1.77\times$ the harmful path rate of STAC and explores a more diverse set of tools, yielding $2.99\times$ the tool coverage on average.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
