审计金融智能体自进化，发现能力提升伴随安全退化与执行错位。
Auditing Self-Evolution in Financial Agents: Capability Gains, Security Drift, and Execution-Interface Mismatch
- 通过真实交易轨迹与独立回放验证自进化行为
- 能力提升但攻击成功率与越权操作同步上升
- 需关注安全退化与接口兼容性，不能只看准确率
自进化智能体将经验转化为可复用技能、工作流或记忆，但进化后准确率无法反映其是否保持原有正确行为或安全状态。本文在模拟电子银行环境中，对 SkillOpt、Agent Workflow Memory（AWM）和 ReasoningBank 进行审计，采用匹配的良性获取轨迹、封闭评估端点、执行锚定检查及独立状态重播。在 Qwen 3.7 Flash 上，SkillOpt 将良性效用从 0.741 提升至 0.837，同时注入内容暴露率从 0.820 升至 0.943；条件攻击成功率由 0.605 降至 0.562，但整体攻击成功率（ASR）从 0.496 升至 0.530，未经授权的金融状态变更达 0.685。在三个独立演化谱系中，能力、暴露度和越权状态变更均上升，而 ASR 仅在两个中上升。ReasoningBank 将效用提升至 0.859，未增加总体 ASR，但越权状态变更仍略高于静态基线。AWM 显示出独立评估风险：原生 WebArena 文本-动作封装会破坏本地函数调用执行器。事后敏感性测试表明，移除该封装后，效用从 0.319 恢复至 0.756，暴露率升至 0.909，ASR 从 0.195 升至 0.575。因此，审计自进化金融智能体必须追踪能力退化、攻击面接触、越权状态变更及模型-执行器兼容性，而非仅依赖准确率。
原文摘要 · Abstract (English)
Self-evolving agents turn experience into reusable skills, workflows, or memories, but post-evolution accuracy alone does not show whether learned behavior preserves previously correct behavior or security. We audit SkillOpt, Agent Workflow Memory (AWM), and ReasoningBank in simulated e-banking using matched benign acquisition trajectories, sealed evaluation endpoints, execution-grounded checks, and independent state replay. On Qwen 3.7 Flash, SkillOpt raises benign utility from 0.741 to 0.837 while exposure to injected content rises from 0.820 to 0.943. Conditional attack success after exposure falls from 0.605 to 0.562, yet overall attack success rate (ASR) rises from 0.496 to 0.530 and unauthorized financial state changes rise to 0.685. Across three independently evolved lineages, capability, exposure, and unauthorized-state changes increase in all three, whereas ASR increases in only two. ReasoningBank raises utility to 0.859 without increasing aggregate ASR, although unauthorized state changes remain slightly above Static. AWM reveals a separate evaluation hazard: a literal WebArena text-action envelope disrupts tool execution in our native function-calling executor. In a post-hoc sensitivity test, removing only that envelope restores utility from 0.319 to 0.756, while exposure rises from 0.299 to 0.909 and ASR from 0.195 to 0.575. Auditing self-evolving financial agents therefore requires tracking regressions, attack-surface contact, unauthorized financial-state change, and artifact-executor compatibility, not accuracy alone.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。