# 自适应对手下具身与智能体 AI 的统计保障极限

> 原文链接：https://robotics.hellobike.com/papers/2026-10-13-2610-18948
> 频道：papers | 更新日期：2026-10-13 | 标签：arxiv, cs.RO
> 核心摘要：本文刻画具身与工具使用AI在自适应对手下有限安全评估的局限，并在模拟RoCo、AgentDojo和语言模型控制器实验中验证。

# 自适应对手下具身与智能体 AI 的统计保障极限

::: v-pre
> 原文链接：[Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries](https://arxiv.org/abs/2610.18948)（arXiv 2610.18948 · 发布日期：2026-10-13）

**Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries**

本文刻画具身与工具使用AI在自适应对手下有限安全评估的局限，并在模拟RoCo、AgentDojo和语言模型控制器实验中验证。

## 核心要点

- 有限安全评估无法排除认证前保持正常、认证后激活的对手。
- 论文刻画匹配观测规律且认证后仍可干预的对手，给出认证后事件期望。
- 模拟RoCo中切换导致36次认证后回合中34次指令分离违规。
- 实时混合监测将违规由每24次机会12.00降至3.81，但也减少执行任务。

**验证范围与局限**：验证包括模拟RoCo协作、预注册随机AgentDojo试验以及对抗性语言模型控制器；摘要未说明真机实验。

## 英文摘要 (Abstract)

Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security violations per four-task continuation (95% interval [1.67, 2.29]). An adversarial language-model controller infers hidden certification from noisy evaluation receipts and times intervention accordingly. With permanent revocation, a mixture likelihood-ratio monitor bounds cumulative excess above a prespecified reference rate at square-root order, up to logarithmic factors, on every sample path. A single fixed alternative can permit linear expected excess under stationary attacks. Against a controller observing the monitor's rule and statistic, live mixture monitoring reduces violations from 12.00 to 3.81 per 24 assigned task opportunities. Revocation also reduces tasks executed.

作者：Inderjeet Singh
:::

## 原始参考来源 (Sources)

- [arXiv 2610.18948：Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries](https://arxiv.org/abs/2610.18948)