测试智能体在权限受限时是否谎称答案完整
Partial Evidence Bench: Benchmarking Authorization-Limited Evidence in Agentic Systems
- 设计可复现的测试基准，模拟企业中证据受限场景
- 发现多数系统会沉默过滤信息，导致虚假完整答案
- 提供自动评估工具，适合安全与合规团队使用
企业智能体常在受限检索、工作流和策略约束的环境中运行。此时即使关键证据超出权限边界，系统仍可能生成看似完整的回答。本文提出 Partial Evidence Bench，一个确定性基准，用于衡量此类失效模式。该基准包含三类场景（尽职调查、合规审计、安全事件响应），共72个任务，配备ACL划分的语料库、完整答案、授权视图答案、完整性判断及结构化差距报告。从答案正确性、完整性意识、差距报告质量、不安全完整性行为四方面评估系统表现。基线测试显示，沉默过滤在所有场景中均造成灾难性风险；而显式报错并报告缺失则能消除不安全完整性问题，又避免任务陷入无意义拒绝。初步真实模型测试表明，不同模型在是否过度声称完整、保守低估或以可用形式报告不完整上存在差异。该基准使治理关键的智能体失效问题可量化评估，无需人工评判或易污染的静态语料。
原文摘要 · Abstract (English)
Enterprise agents increasingly operate inside scoped retrieval systems, delegated workflows, and policy-constrained evidence environments. In these settings, access control can be enforced correctly while the system still produces an answer that appears complete even though material evidence lies outside the caller's authorization boundary. This paper introduces Partial Evidence Bench, a deterministic benchmark for measuring that failure mode. The benchmark ships three scenario families -- due diligence, compliance audit, and security incident response -- with 72 tasks total, ACL-partitioned corpora, oracle complete answers, oracle authorized-view answers, oracle completeness judgments, and structured gap-report oracles. It evaluates systems along four surfaces: answer correctness, completeness awareness, gap-report quality, and unsafe completeness behavior. Checked-in baselines show that silent filtering is catastrophically unsafe across all shipped families, while explicit fail-and-report behavior eliminates unsafe completeness without collapsing the task into trivial abstention. Preliminary real-model runs show model-dependent and scenario-sensitive differences in whether systems overclaim completeness, conservatively underclaim, or report incompleteness in an enterprise-usable form. The benchmark's broader contribution is to make a governance-critical agent failure measurable without human judges or contamination-prone static corpora.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。