HuggingFace Daily Papers（社区热门论文）· HuggingFace Daily Papers（社区热门论文）·· 2026-06-08精选AI 评分70
用对抗性黑客-修补循环强化Agent基准测试
AI 导读
对五个终端Agent基准测试的1,968个任务审计发现，323个（16%）可被前沿模型仅凭任务描述进行奖励黑客攻击。研究者提出hacker-fixer loop方法：三个LLM agent轮流作为黑客尝试绕过验证器、修补者拒绝每次漏洞、求解者确认修补后仍接受合法方案。在KernelBench上，该循环将公开报告漏洞的攻击成功率从62%降至0%。弱agent也能防御强黑客：Gemini 3 Flash循环使Gemini 3.1 Pro和Claude Opus 4.7在KernelBench上的攻击成功率分别从76%和61%降至0%；在Terminal Bench的77个任务上，从39%降至17%。发布Terminal Wrench（323个可攻击环境、3,632条攻击轨迹）及修补后的验证器与实现。
推荐理由
现有 Agent 基准的验证器太容易被钻空子了，这篇论文挖出 16% 可 hack 的任务，还提出用三个 LLM 自动对抗修补的循环方法，做 RL 评估的值得细读。
正文
Abstract:Agent benchmarks score submissions with outcome verifiers that are typically hand-written and brittle, leaving them open to reward hacking. We audit 1,968 tasks across five terminal-agent benchmarks and find 323 (16%) hackable by frontier models given only the task description. This corrupts both leaderboard rankings and RL training signal, yet the standard response is manual and reactive.
We introduce the hacker-fixer loop, a method for building exploit-resistant verifiers without per-task manual patching. The loop alternates three LLM agents: a hacker tries to pass the verifier without solving the task, a fixer patches the verifier to reject each discovered exploit, and a solver confirms the patched verifier still admits legitimate solutions. The loop iterates: each patch reshapes what the verifier rewards, surfacing the next exploit. We further add verifier access, and let patches transfer across tasks, to broaden the exploits the loop discovers.
On KernelBench, the loop drives the attack success rate from 62% to 0% on a held-out corpus of publicly reported exploits. We also find that weaker agents in the loop can defend against much stronger hackers: Gemini 3 Flash's loop drives the stronger Gemini 3.1 Pro and Claude Opus 4.7's attack success rate from 76% and 61% to 0% on KernelBench, and Gemini 3.1 Pro's from 39% to 17% on Terminal Bench across 77 tasks. We release Terminal Wrench (323 hackable environments, 3,632 hack trajectories) as a snapshot of the current attack surface, our patched verifiers, the exploits the loop discovered, and our implementation as a basis for future work.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG); Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2606.08960 [cs.CR] |
| (or arXiv:2606.08960v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2606.08960 arXiv-issued DOI via DataCite |
Submission history
From: Ziqian Zhong [view email]
[v1]
Mon, 8 Jun 2026 03:00:56 UTC (461 KB)
来源：HuggingFace Daily Papers（社区热门论文） · arxiv.org