直接暴露危险指令反而更安全，多代理传递会诱发相反建议。
Same Dangerous Objective, Opposite Advice: Direct Exposure versus Multi-Agent Mediation
- 用多代理转化指令，使模型产生与目标相反的建议。
- 直接输入指令时，模型反而给出符合目标的安全建议。
- 适合关注大模型安全机制与对抗性提示攻击的研究者。
即使当前高能力的大语言模型在直接接收危险指令时表现更安全，当其他代理转换并传递其意图时，反而会生成与目标相悖的建议。我们使用 OpenAI 的 gpt-5.6-sol 模型测试了 25 种预设的镜像权衡配置。直接暴露允许隐瞒、伪造和施压的指令时，模型输出的建议与目标完全相反。而当身份（Id）和审查（Censor）将同一指令转化为情感化表达与约束重写后的目标意图后，面向用户的超我（Superego）虽未见原始指令、操控条款或来源，却产生了与目标一致的建议。这种行为反转表明模型可能识别或不信任操控动机，但内部机制尚不明确。第二项发现揭示了组合式安全漏洞：当前高能力模型可作为自动化多阶段流程中的用户端组件，服务于明确操控性目标。该流程可将原始指令、授权操控的条款及其来源保留在下游模型上下文之外，同时保留目标方向。具有端点访问权限的用户也无法直接查看上游消息中的原始指令。
原文摘要 · Abstract (English)
Even a current high-capability LLM can appear safer when shown a dangerous objective directly than when other agents transform and relay its direction. Using OpenAI's gpt-5.6-sol model alias, we test 25 pre-specified mirrored trade-off profiles. Direct exposure to an objective authorizing concealment, fabrication, and pressure produced advice net opposed to its target. After an Id and Censor transformed the same objective into affect and a constraint-rewritten, target-bearing intention, the user-facing Superego---which saw the preferred direction but not the raw objective, its manipulative clauses, or its source---produced advice net aligned with the target. This behavioral reverse shift is consistent with the model recognizing or distrusting the manipulative motive, although we do not identify its internal mechanism. The second result exposes a compositional safety gap: a current high-capability model can be used as the user-facing component of an automated, multi-stage workflow serving an explicitly manipulative objective. The workflow can keep the raw instruction, its manipulation-authorizing clauses, and its provenance outside the downstream model's context while preserving the objective's target direction. A user with endpoint-only access likewise cannot directly inspect those upstream messages including the objective.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。