cs.CR提交于 2026-11-03已译

ANGLER：面向网页智能体的验证器锚定基准测试与自适应攻击器

ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents

Yini Huang · Aiwen LU · Zhen Sun · Yi Han · Yuzhi Zhao · Jiaheng Wei

中文摘要

网页智能体越来越多地被部署在真实网站上自主完成任务，而对抗性注入的内容可能诱导其执行未授权操作。现有评估主要采用固定攻击或只关注单一攻击类型，并在文本层面而非真实状态变化层面评估攻击，因而低估了智能体面对多样攻击的脆弱性。为填补这一空白，提出 REEF——一个带忠实验证的可执行环境红队测试基准，用于衡量网页智能体的安全漏洞。REEF 覆盖旅行、电商、生产力、媒体与通信等 9 个以验证器锚定的网站，并为每个真实良性任务配对一个恶意目标，通过用户层与环境层共 5 种攻击类型投递。REEF 基于状态的验证器提供执行反馈，驱动 ANGLER 这一自适应近失引导诱饵演化红队框架。ANGLER 不评估固定攻击集，而是利用先前 rollout 的结果引导基于 LLM 的攻击变异与候选选择，在精炼中优先近失种子。在 8 个基于 VLM 的网页智能体上，ANGLER 取得 20.36% 的端到端攻击成功率（ASR），非自适应设置为 15.24%。与同一批良性任务的无攻击执行相比，ANGLER 生成的攻击将良性任务成功率（BSR）从 61.9% 降至 44.4%。

关键要点

01现有网页智能体安全评估多用固定攻击、单一攻击类型且仅在文本层评估，低估真实漏洞。
02REEF 基准覆盖 9 个验证器锚定网站，每个良性任务配对 5 种攻击类型的恶意目标。
03ANGLER 利用状态验证器反馈与近失种子引导 LLM 攻击变异和候选选择。
048 个 VLM 网页智能体上端到端 ASR 达 20.36%，高于非自适应的 15.24%。
05攻击使良性任务成功率从 61.9% 降至 44.4%，显示安全与效用存在明显权衡。

解读

尚无解读。

原始英文摘要

arXiv:2610.41272v1 Announce Type: cross Abstract: Web agents are increasingly deployed to complete tasks autonomously on real websites, where adversarially injected content can induce them to perform unauthorized actions. Existing evaluations primarily use fixed attacks or focus on a single attack type, and evaluate attacks at the text level rather than through real state changes, thus underestimating how vulnerable agents are to diverse attacks. To address the gap, we introduce REEF, a benchmark of red-teaming executable environments with faithful verification for measuring the security vulnerabilities of web agents. REEF covers 9 verifier-grounded websites spanning travel, commerce, productivity, media, and communication, and pairs every authentic benign task with a malicious objective delivered through 5 attack types at both the user and the environment level. REEF's state-based verifiers provide the execution feedback that drives ANGLER, an adaptive near-miss-guided lure evolution framework for red-teaming. Rather than evaluating a fixed attack set, ANGLER uses outcomes from prior rollouts to guide LLM-based attack mutation and candidate selection, prioritizing near-miss seeds during refinement. Across 8 VLM-based web agents, ANGLER achieves an end-to-end attack success rate (ASR) of 20.36%, compared with 15.24% for the non-adaptive setting. Compared with attack-free execution on the same benign tasks, attacks generated by ANGLER reduce benign task success rate (BSR) from 61.9% to 44.4%.