SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

arXiv:2609.34518 · cs.CR, cs.AI · Submitted 2026-09-28 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-28

Updated: 2026-09-28

Code: https://github.com/EverywhereSafety/SEAD

Project page: https://everywheresafety.github.io/sead/1

Terminology

• Trace — 14× in this paper · explained in 2 episodes
• Fine-Tuning — 10× in this paper · explained in 5 episodes
• Verification — 8× in this paper · explained in 2 episodes
• Benchmark — 7× in this paper · explained in 2 episodes
• Introspection — 7× in this paper · explained in 2 episodes
• Verifier — 7× in this paper · explained in 2 episodes
• Redundancy — 6× in this paper · explained in 2 episodes
• Adaptation — 4× in this paper · explained in 1 episode
• Benchmarking — 4× in this paper · explained in 3 episodes
• Accuracy — 1× in this paper · explained in 1 episode
• Action Space — 1× in this paper · explained in 1 episode
• Agentic System — 1× in this paper · explained in 2 episodes
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Core — 1× in this paper · explained in 2 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 3 episodes
• State-grounded Execution for Attack and Defense — 1× in this paper

Sources

• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
• ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning
• AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents
• AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
• STAC: When Innocent Tools Form Dangerous Chains for LLM Agents
• Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents
• AgentBench: Evaluating LLMs as Agents
• ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback
• AIRGuard: Guarding Agent Actions with Runtime Authority Control
• Identifying the Risks of LM Agents with an LM-Emulated Sandbox
• One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intent
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search
• TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
• StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing
• WebArena: A Realistic Web Environment for Building Autonomous Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs