自动化测试框架Vera可大规模发现并验证大模型代理的安全漏洞。
Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification
- 构建三阶段自增强流水线，从文献中挖掘风险并生成可执行测试用例。
- 在四个生产级代理框架上测试，多通道攻击成功率高达93.9%。
- 适合关注智能体安全评估的研究者与开发者，支持可扩展验证。
大语言模型代理通过外部工具执行自主行为，带来复杂且动态演化的安全风险。现有安全测试依赖专家设计的违规场景，结果由硬编码规则判断，难以随代理演化扩展。为此，我们提出Vera——一个端到端自动化安全测试框架，将软件工程测试原则应用于非确定性代理，采用三阶段自增强流程：首先，基于文献持续发现并结构化新兴风险，形成安全风险、攻击方法与工具执行环境的分类体系；其次，跨分类维度组合生成可执行的安全案例，每个案例包含具体安全目标、程序化构建的初始状态及基于可观测证据的确定性验证谓词；第三，通过适应性执行，在隔离沙箱中由控制代理根据运行时观察引导多轮交互，证据基验证器基于环境状态与工具调用证据判断结果，而非模型自我报告。我们在四个生产级代理框架（OpenClaw, Hermes, Codex, Claude Code）上评估Vera，揭示显著安全缺陷，多通道攻击平均成功率达93.9%；同时发布Vera-Bench，包含1600个可执行安全案例，覆盖124类风险，涵盖三种执行场景。结果表明，模块化、可执行的测试基础设施对大规模、可持续的安全评估至关重要。代码已开源：https://github.com/Yunhao-Feng/Vera。
原文摘要 · Abstract (English)
LLM agents increasingly perform autonomous actions through external tools, leading to complex and evolving safety risks. However, existing safety testing targets expert-designed safety violations, and the corresponding outcomes are evaluated by hard-coded rules, making them costly to extend as agents evolve. To this end, we present Vera, an end-to-end automated safety testing framework that instantiates software engineering testing principles for non-deterministic agents through a three-stage, self-reinforcing pipeline. First, a literature-driven exploration continuously discovers and structures emerging risks into taxonomies of safety risks, attack methods, and tool execution environments. Second, combinatorial composition across taxonomy dimensions produces executable safety cases, each specifying a concrete safety goal, a programmatically constructed initial state, and a deterministic verification predicate grounded in observable artifacts. Third, adaptive execution runs heterogeneous agents in isolated sandboxes where a control agent steers multi-turn interaction based on runtime observations, while evidence-grounded verifiers judge outcomes from environment state and tool-call evidence rather than model self-report. We evaluate Vera on four production agent frameworks (OpenClaw, Hermes, Codex, Claude Code), revealing substantial safety weaknesses, with average attack success rates reaching 93.9\% under multi-channel attacks; we also release Vera-Bench, comprising 1600 executable safety cases spanning 124 risk categories across three execution settings. These results indicate that modular, executable testing infrastructure is essential for rigorous and maintainable safety evaluation of rapidly evolving agentic systems at scale. The code is publicly available at https://github.com/Yunhao-Feng/Vera.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。