通过制度红队测试部署规则如何影响多智能体安全，发现规则设计比模型本身更关键。
Institutional Red-Teaming: Deployment Rules, Not Just Models, Causally Shape Multi-Agent AI Safety
- 固定模型与任务，仅改变一条规则，因果分析其对集体行为的影响
- 改变后果规则可使平均伤亡率在22%至58%间变化，且无通用安全规则
- 身份显性是核心机制：命名受害者使靶向淘汰率从22%升至81%
我们提出制度红队方法，用于测试多智能体系统中的部署规则：固定智能体、目标与任务状态，仅变更单一规则，将集体行为的变化归因于该规则。我们在IABench-CA基准中实现该方法，涵盖228个情境、五种典型规则和七个模型群体（共33,924场游戏），包含规范合作参照与自动标注的推理轨迹。三项发现：(1) 部署规则因果影响集体安全：仅改变后果规则，各群体平均伤亡率变动22至58个百分点；(2) 不存在普适安全规则，但靶向危害普遍存在：最安全与最不安全规则及影响方向随群体而异，但回归性身份靶向在所有情境与群体中均非最优，消除低资源代理比例达30%-87%，且对所有七组模型均不安全于合作参照；(3) 身份显性为作用机制：在最易被利用的gpt-5.1群体中，一次匿名化消融实验显示，规则文本中是否命名损失承担者使靶向淘汰率从22%升至81%；重复博弈下，匿名化仅延迟靶向，因智能体可通过观察淘汰行为重新推断隐藏规则。我们封装该方法为安全论证工作流，为每种部署情境与群体提供一个临时规则区域Φ(c,P)，附带明确残余风险与监控义务。
原文摘要 · Abstract (English)
We introduce institutional red-teaming, an evaluation methodology for testing deployment rules in multi-agent AI: hold the agents, objectives, and task state fixed, vary only one rule, and attribute the resulting change in collective behavior to that rule. We instantiate the methodology in IABench-CA, a consequence-allocation benchmark spanning 228 contexts, five canonical rules, and seven model populations (33,924 games), with a normative cooperative reference and auto-labelled reasoning traces. Three findings emerge. (1) Deployment rules causally alter collective safety: changing only the consequence rule moves mean fatality by 22 to 58 percentage points within every population. (2) There is no safe default, but the targeting hazard is universal: the safest rule, the least-safe rule, and even the direction of the incidence effect vary across populations, yet regressive identity-targeting is never decisively safest in any context for any population, eliminates the least-resourced agent in 30-87% of games everywhere, and is selection-unsafe relative to the cooperative reference for all seven populations. (3) Identity salience is the mechanism: a one-shot anonymization ablation on the most exploitation-prone population (gpt-5.1) shows that merely naming the loss bearer in the rule text drives targeted elimination from 22% to 81% at identical payoffs; under repeated play, anonymization only delays the targeting, as agents re-infer the hidden rule from observed eliminations. We package the methodology as a safety-case workflow that certifies a provisional rule region $Φ(c,P)$ per deployment context and population, with explicit residual risks and monitoring obligations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。