SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents
The paper frames agent attacks and defenses as a problem of hidden state, where a harmless-looking tool call can become dangerous because of earlier changes.
SEAD models that risk as partially observed state control. Its attack method, DART, breaks harmful goals into plausible steps and uses tool-execution feedback to search for working paths. Its defense method, SAGE, runs read-only checks before deciding whether to allow or block each action. In the authors’ online evaluation, SAGE cut DART’s executable attack success from 48.0% to 4.0%.
Source: HF Daily Papers' note
SEAD models that risk as partially observed state control. Its attack method, DART, breaks harmful goals into plausible steps and uses tool-execution feedback to search for working paths. Its defense method, SAGE, runs read-only checks before deciding whether to allow or block each action. In the authors’ online evaluation, SAGE cut DART’s executable attack success from 48.0% to 4.0%.
Source: HF Daily Papers' note
score 5