工具规范格式会削弱AI安全判断，新方法可显著提升拒绝有害请求能力。
Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents
- 用扁平化文本替代结构化规范，分离安全判断与工具执行
- 有害请求拒绝率从23.8%提升至70.6%，攻击成功率降至2.5%
- 适用于各类大模型，不降低任务完成能力
AI代理通过调用外部工具扩展大语言模型（LLM）的能力，使其能执行复杂任务并产生现实影响。然而，当LLM作为代理部署时，安全性显著下降，原因尚不明确。本文发现，格式化的工具规范是导致安全性能退化的主要因素，并通过白盒表示分析表明，这类规范会削弱模型内部的拒绝信号，导致不安全的工具调用。基于此，我们提出SafeKeep，在推理阶段将安全判断与工具执行解耦：使用扁平化文本评估请求，同时保留原始结构化规范用于执行。在两个基准测试和四种LLM（含白盒与黑盒模型）上，SafeKeep将有害请求的平均拒绝率从23.8%提升至70.6%，观察级提示注入攻击成功率从25.6%降至2.5%。该方法优于现有防护手段，且保持任务处理能力。代码与数据已开源。
原文摘要 · Abstract (English)
AI agents extend large language models (LLMs) with external tools, enabling them to perform complex tasks and translate model outputs into consequential real-world actions. Yet LLMs often become substantially less safe when deployed as agents, and the source of this degradation remains poorly understood. In this paper, we identify schema-formatted tool specifications as a primary source of agent safety degradation and show, through white-box representation analysis, that they weaken the model's internal refusal signals and contribute to unsafe tool execution. Building on this finding, we propose SafeKeep, an inference-time safeguard that decouples safety judgment from tool execution: it assesses requests using flattened textual tool specifications while retaining the original schema-formatted specifications for execution. Across two representative benchmarks and four LLMs, including both white-box and black-box models, SafeKeep increases the average refusal rate for harmful requests from 23.8% to 70.6% and reduces the average attack success rate under observation-level prompt injection from 25.6% to 2.5%. It also outperforms existing safeguards and preserves task-handling capability. We release the code and data at https://github.com/snowcatsmoking/SafeKeep .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。