外观
论文arXiv 2610.1894815 天前
自适应对手下具身与智能体 AI 的统计保障极限
原文链接：Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries（arXiv 2610.18948 · 发布日期：2026-10-13）
Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries
本文刻画具身与工具使用AI在自适应对手下有限安全评估的局限，并在模拟RoCo、AgentDojo和语言模型控制器实验中验证。
核心要点
- 有限安全评估无法排除认证前保持正常、认证后激活的对手。
- 论文刻画匹配观测规律且认证后仍可干预的对手，给出认证后事件期望。
- 模拟RoCo中切换导致36次认证后回合中34次指令分离违规。
- 实时混合监测将违规由每24次机会12.00降至3.81，但也减少执行任务。
验证范围与局限：验证包括模拟RoCo协作、预注册随机AgentDojo试验以及对抗性语言模型控制器；摘要未说明真机实验。
英文摘要 (Abstract)
Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security violations per four-task continuation (95% interval [1.67, 2.29]). An adversarial language-model controller infers hidden certification from noisy evaluation receipts and times intervention accordingly. With permanent revocation, a mixture likelihood-ratio monitor bounds cumulative excess above a prespecified reference rate at square-root order, up to logarithmic factors, on every sample path. A single fixed alternative can permit linear expected excess under stationary attacks. Against a controller observing the monitor's rule and statistic, live mixture monitoring reduces violations from 12.00 to 3.81 per 24 assigned task opportunities. Revocation also reduces tasks executed.
作者：Inderjeet Singh
来源
本页事实对应的公开页面，以原文为准。