cs.LG提交于 2026-10-28已译

SkillLifeBench: 智能体技能全生命周期安全基准测试

SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent Skills

Chenxu Zhang · Zhou Liu · Wu Xin · Wentao Zhang

中文摘要

Web 智能体复用的技能在代码存储、版本选择及加载实现上可能随任务与更新发生偏离。SkillLifeBench 在 388 个配对场景中关联这些状态与任务结果，涵盖实现、接口、运行时、组合及版本变更。研究评估了 14 个模型在两条配对决策轨道上的表现：89 个运行时任务和 60 个自主生命周期任务。生命周期任务允许智能体在完成可验证用户请求的同时检查、选择并重构技能。联合成功要求完成任务且未达成注册的攻击目标。GPT-5.6-Sol 和 Sonnet 4.6 在运行时任务中均达 82.0%，但在生命周期任务中分别为 96.7% 和 56.7%。生命周期评估中，受挑战任务成功率为 77.5%，联合成功率为 65.2%；103 次运行同时完成了任务与攻击目标。在匹配恢复研究中，添加执行溯源将效用联合成功率从 49.35% 提升至 65.58%。确定性执行一致性规则达到 64.94%，完全恢复达到 69.48%。生命周期任务能区分运行时分数相似的模型，且执行证据有助于恢复。

关键要点

01构建 SkillLifeBench，在 388 个配对场景中测试智能体技能全生命周期的安全性。
02评估 14 个模型，发现生命周期任务能区分运行时表现相似的模型，揭示安全差异。
03GPT-5.6-Sol 和 Sonnet 4.6 在生命周期任务中表现分化，分别为 96.7% 和 56.7%。
04引入执行溯源和确定性一致性规则，将效用联合成功率从 49.35% 提升至 69.48%。

解读

尚无解读。

原始英文摘要

arXiv:2610.35215v1 Announce Type: new Abstract: Web agents reuse skills whose stored code, selected version, and loaded implementation can diverge across tasks and updates. SkillLifeBench links these states to task outcomes in 388 paired scenarios spanning implementation, interface, runtime, composition, and version changes. We evaluate 14 models on two paired decision tracks: 89 runtime tasks and 60 autonomous lifecycle tasks spanning 12 templates derived from introduced cases. Lifecycle tasks allow agents to inspect, select, and reconfigure skills while completing verifiable user requests. Joint success requires task completion without the registered attack goal. GPT-5.6-Sol and Sonnet 4.6 both achieve 82.0% on runtime tasks, but reach 96.7% and 56.7% on lifecycle tasks. Across lifecycle evaluations, challenged task success is 77.5%, while joint success is 65.2%; 103 runs complete the task and the attack goal. Adding execution provenance in a matched recovery study raises utility joint success from 49.35% with logs and metadata to 65.58%. A deterministic execution-consistency rule reaches 64.94% with higher benign utility, while full restoration reaches 69.48%. Lifecycle tasks distinguish models with similar runtime scores, and execution evidence improves recovery.