暴露不等于承诺：工具使用智能体潜在监控器的双重分层评估
原标题：Exposure Is Not Commitment: Double-Stratified Evaluation of Latent Monitors for Tool-Using Agents
AI 摘要
该论文指出，针对工具使用型语言智能体的潜在监控器研究结果相互矛盾，很大程度上是评估方法造成的假象。作者提出双重分层协议，将注入暴露与行为承诺在评估和训练人群中分开。在 Qwen AgentDojo 网格上，用朴素混合对比训练的监控器主要学到的是暴露信号，几乎无法预测智能体是否会执行不安全工具调用；仅在暴露案例上重新训练后，同一类探针可提前最多两步预测模型自身的不安全工具调用（logistic AUROC 0.853），Mistral-7B 和 OLMo-2-7B 分别达到 0.896 和 0.912。作者认为未分层的 AUROC 会高估潜在监控器实际掌握的信息，评估应同时分层。
正文节选
Agents in the Wild: Safety, Security, and Beyond Exposure Is Not Commitment: Double-Stratified Evaluation of Latent Monitors for Tool-Using Agents Abstract Tool-using language agents are vulnerable to indirect prompt injection, and a growing literature probes model internals to catch unsafe actions before they execute, with sharply conflicting results. We argue much of the conflict is an evaluation artifact, and propose a double-stratification protocol: separate injection exposure from behaviora