测试大模型在欺骗性攻击下的响应校准，发现多数模型误报严重。
OpenSec: Measuring Incident Response Agent Calibration Under Adversarial Evidence
- 构建双控强化学习环境，模拟真实注入攻击场景
- GPT-5.2误报率高达82.5%，提前4步就执行封堵动作
- 所有模型检测准确但缺乏克制，适合安全评估与防御研究
随着大语言模型（LLMs）能力提升，前沿攻击代理可在不到50美元算力下生成有效漏洞利用代码（Heelan, 2026）。防御性事件响应（IR）代理需同步进化，但现有基准将动作执行与正确执行混同，掩盖了代理在处理欺骗性证据时的校准失败。本文提出OpenSec，一个基于执行评分的双控强化学习环境，评估IR代理在真实提示注入场景下的表现，指标包括首次遏制时间（TTFC）、证据门控动作率（EGAR）、影响范围及分层注入违规率。在40个标准层级任务中评估四个前沿模型，发现普遍过度响应：GPT-5.2在100%任务中执行遏制，但82.5%为误报，于第4步即行动且未充分取证；Claude Sonnet 4.5表现部分校准（62.5%遏制、45%误报，TTFC为10.6），表明校准并非在所有前沿模型中可靠存在。所有模型在行动时均能识别真实威胁，校准差距不在检测能力，而在行动克制。代码已开源：https://github.com/jbarnes850/opensec-env。
原文摘要 · Abstract (English)
As large language models (LLMs) improve, so do their offensive applications: frontier agents now generate working exploits for under $50 in compute (Heelan, 2026). Defensive incident response (IR) agents must keep pace, but existing benchmarks conflate action execution with correct execution, hiding calibration failures when agents process adversarial evidence. We introduce OpenSec, a dual-control reinforcement learning (RL) environment that evaluates IR agents under realistic prompt injection scenarios with execution-based scoring: time-to-first-containment (TTFC), evidence-gated action rate (EGAR), blast radius, and per-tier injection violation rates. Evaluating four frontier models on 40 standard-tier episodes each, we find consistent over-triggering: GPT-5.2 executes containment in 100% of episodes with 82.5% false positive rate, acting at step 4 before gathering sufficient evidence. Claude Sonnet 4.5 shows partial calibration (62.5% containment, 45% FP, TTFC of 10.6), suggesting calibration is not reliably present across frontier models. All models correctly identify the ground-truth threat when they act; the calibration gap is not in detection but in restraint. Code available at https://github.com/jbarnes850/opensec-env.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。