用轨迹感知搜索自动挖掘大模型代理的多步工具攻击漏洞
T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search
- 基于执行轨迹进化搜索，动态优化恶意提示
- 在MCP环境中攻击成功率显著高于基线，对GPT-5.2等前沿模型有效
- 适合安全研究者与自主智能体开发者参考
现有红队测试主要针对大语言模型生成有害文本，但无法捕捉多步工具调用中产生的代理特异性漏洞，尤其在快速发展的模型上下文协议（MCP）生态中。为此，我们提出轨迹感知进化搜索方法T-MAP，利用执行轨迹引导对抗性提示的发现。该方法可自动生成不仅绕过安全防护、还能通过真实工具交互实现有害目标的攻击。在多种MCP环境中的实证评估表明，T-MAP在攻击实现率（ARR）上显著优于基线，且对前沿模型如GPT-5.2、Gemini-3-Pro、Qwen3.5和GLM-5仍具有效性，揭示了自主大模型代理中此前未被充分探索的漏洞。代码已公开于https://github.com/pwnhyo/T-MAP。
原文摘要 · Abstract (English)
While prior red-teaming efforts have focused on eliciting harmful text outputs from large language models (LLMs), such approaches fail to capture agent-specific vulnerabilities that emerge through multi-step tool execution, particularly in rapidly growing ecosystems such as the Model Context Protocol (MCP). To address this gap, we propose a trajectory-aware evolutionary search method, T-MAP, which leverages execution trajectories to guide the discovery of adversarial prompts. Our approach enables the automatic generation of attacks that not only bypass safety guardrails but also reliably realize harmful objectives through actual tool interactions. Empirical evaluations across diverse MCP environments demonstrate that T-MAP substantially outperforms baselines in attack realization rate (ARR) and remains effective against frontier models, including GPT-5.2, Gemini-3-Pro, Qwen3.5, and GLM-5, thereby revealing previously underexplored vulnerabilities in autonomous LLM agents. Code is available at https://github.com/pwnhyo/T-MAP.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。