Who Verifies the Graph? Misspecification Attacks on Causal Action Verification for Language Agents· 谁验证了图模型？
Causal action verifiers gate an agent's state-changing tool calls by checking whether each proposed intervention is identifiable against a committed action-state graph, and they issue a certificate that carries the identification argument and a one-sided lower confidence bound. One such verifier, CIVeX, reports zero false executions on a confounded tool-use benchmark. We red-team it by corrupting only the committed graph. Omitting a single bidirected edge takes it from zero false executions to 15.3% at the benchmark's published confounding strength, with 91% of its executions harmful and utility falling from +2.27 to +0.35. Reversing one arrowhead, so that a mediator is committed as a confounder, gives 48.9% false executions and no correct ones. Every one of these actions carries an intern
论文揭示了对图模型的错误指定攻击对因果行为验证器的影响。
- 核心方法
- 作者通过省略单个双向边或逆转一个箭头的方式，改变已提交的因果图，测试CIVeX模型在错误指定图模型下的表现。
- 适合谁读
- 适合研究者和安全工程师阅读，了解因果行为验证器的潜在安全威胁。
- 要解决的问题
- 论文关注的是如何通过图模型的错误指定来攻击基于因果关系的语言代理人的行为验证器，导致其错误执行率上升并造成损害。
- 关键实验
- 实验表明，在标准干扰强度下，省略单个双向边导致CIVeX模型错误执行率从0%上升至15.3%，其中91%的执行是有害的；而逆转一个箭头则导致48.9%的错误执行率且无一正确执行。
- 主要贡献
- 展示了即使是很小的图模型错误指定也能导致高比例的错误执行，对CIVeX模型的安全性和可靠性提出了质疑。
- 意义与局限
- 该研究揭示了因果图模型在现实应用中的脆弱性，对依赖这些模型的系统提出了重要的安全警示。但实验仅针对单一模型，可能不具有普遍适用性。