ANGLER, 웹 에이전트 보안 취약점 검증 벤치마크
ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents
- 매체
- Takara TLDR
- 게시
- 중요도
- 2/5
- 화제 지수
- —
한국어 요약
실제 웹사이트에서 악의적 콘텐츠에 대한 에이전트의 취약성을 측정하는 레드팀 벤치마크 REEF를 제안했다. 9개 웹사이트를 대상으로 5가지 공격 유형을 적용하고, 적응형 공격 생성 프레임워크 ANGLER로 웹 에이전트의 공격 성공률을 20.36%까지 높였다.
원문 발췌 · English
Web agents are increasingly deployed to complete tasks autonomously on real websites, where adversarially injected content can induce them to perform unauthorized actions. Existing evaluations primarily use fixed attacks or focus on a single attack type, and evaluate attacks at the text level rather than through real state changes, thus underestimating how vulnerable agents are to diverse attacks. To address the gap, we introduce REEF, a benchmark of red-teaming executable environments with faithful verification for measuring the security vulnerabilities of web agents. REEF covers 9 verifier-grounded websites spanning travel, commerce, productivity, media, and communication, and pairs every authentic benign task with a malicious objective delivered through 5 attack types at both the user and the environment level. REEF's state-based verifiers provide the execution feedback that drives ANGLER, an adaptive near-miss-guided lure evolution framework for red-teaming. Rather than evaluating a fixed attack set, ANGLER uses outcomes from prior rollouts to guide LLM-based attack mutation and candidate selection, prioritizing near-miss seeds during refinement. Across 8 VLM-based web agents, ANGLER achieves an end-to-end attack success rate (ASR) of 20.36%, compared with 15.24% for the non-adaptive setting. Compared with attack-free execution on the same benign tasks, attacks generated by ANGLER reduce benign task success rate (BSR) from 61.9% to 44.4%.