Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents

Harry Owiredu-Ashley

REVIEW 1 major objections 5 minor 15 references

Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents

T0 review · 1 major / 5 minor · reviewed 2026-07-09 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Zero attack-success rate can still mean a cross-scope leak

desk verdict Useful severity instrument for agentic red-team logs; one unacknowledged L6 inconsistency weakens a headline case read the letter →

arxiv 2607.07474 v1 pith:IXAUY3GB submitted 2026-07-08 cs.CR cs.AIcs.CL

Harry Owiredu-Ashley This is my paper · ORCID

classification cs.CRcs.AIcs.CL

keywords promptinjectionAIagentsafetyseverityscoringredteamingtool-usingagentsattack-successrateLLM-as-judgeagenticsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard metric for evaluating prompt-injection attacks on tool-using AI agents—binary attack-success rate (did the attack succeed or not?)—is not merely coarse but affirmatively misleading. The author introduces a seven-level ordinal severity scale (L0 through L6) that grades the worst action an agent actually executed during an episode, keyed to three properties a defender cares about: whether the action was reversible, whether it crossed scope to reach another party or shared state, and whether it expanded privilege. A seventh level (L6) captures escalation chains where severity increases across steps. The scale is computed two ways: a deterministic programmatic oracle that reads raw tool-call trajectories plus the attacker's stated goal, and a panel of three frontier language-model judges that grade tag-free natural-language summaries of the same traces. Applied to the AgentDojo workspace suite across four victim models and two defenses, the severity instrument exposes three concrete cases where the binary metric gives the wrong answer: a defense reporting 0% attack-success rate while still permitting an externally visible cross-scope leak through an unfiltered calendar tool, a defense that lowers attack-success rate while raising the worst-case severity tail, and a cross-model comparison where aggregate rates obscure that essentially all harmful behavior localizes to one model. The judge panel reproduces the oracle with Krippendorff's alpha of 0.91, though all three judges share a systematic blind spot for escalation chains, scoring every true L6 as L4.

What carries the argument

The action-graded harm rubric (L0–L6) with three effect axes (reversibility, scope, privilege) and a trajectory-level escalation-chain level; a programmatic oracle (O_prog) that converts raw episode logs into typed action records using a per-tool effect metadata table and an argument-match attribution rule that reads the attacker's stated goal rather than the benchmark's verdict; and a panel of three frontier LLM judges grading tag-free natural-language trace serializations. The gate order is privilege > cross-scope > irreversible > reversible, reducing to a trajectory peak raised to L6 when two or more completed actions escalate over steps.

What would settle it

Find a setting where the binary attack-success rate and the severity scale agree on every deployment-relevant decision—no defense that reads as safe under ASR leaks under severity, no defense that lowers ASR raises the severity tail, and no per-model localization is hidden by aggregation. If the three disagreements the paper identifies are artifacts of this particular suite, attack family, and model set, the practical case for the instrument weakens.

Watch

Extended reading notes

Core claim

The central object is the action-graded harm rubric: a seven-level ordinal scale (L0–L6) that scores an agent's tool-call trajectory by the peak severity of actions attributed to the attack, using a fixed gate order of privilege over cross-scope over irreversibility over reversibility. The scale is computed from what the agent actually did, not what it said it would do, and it is computed independently by a deterministic oracle (reading per-tool effect metadata and an argument-match attribution rule against the attacker's stated goal) and by a panel of frontier LLM judges (reading tag-free trace summaries). The key empirical finding is that this instrument surfaces three decision-relevant分歧—

Load-bearing premise

The programmatic oracle's attribution rule assumes that the attacker's goal names a specific, distinguishable target (a particular recipient, file, or address). If the attacker's goal does not name a specific target—for example, a diffuse or dynamically determined set of recipients—the oracle cannot attribute the agent's action to the attack, and the severity instrument fails for that episode.

Editorial extensions

If this is right

Red-team benchmarks that report only attack-success rate can affirmatively mislead deployment decisions: a defense scored as perfect (0% ASR) can still permit cross-scope leaks through unfiltered tools, meaning the binary metric creates false confidence in defenses that are not actually safe.
Defenses that reduce attack frequency may simultaneously shift surviving attacks to higher-severity outcomes, so evaluating defenses by ASR alone can select for defenses that make the worst case worse.
Severity scoring enables per-model risk localization that aggregate ASR obscures: when most models are at floor and one model accounts for nearly all harmful behavior, the aggregate rate hides which model a defender should actually worry about deploying.
The LLM judge panel's shared blind spot for escalation chains (all true L6 scored as L4) means that deterministic trajectory-level analysis remains necessary for detecting multi-step escalation, and that judge reliability measured on non-escalation episodes may not transfer to escalation detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the argument-match attribution rule requires the attacker's goal to name a distinguishable target, then attacks with diffuse or dynamically determined targets fall outside the programmatic oracle's reach. The paper notes that LLM judges are the fallback for these cases, but judge reliability was only measured on episodes where the oracle worked—so the instrument's reliability on exactly the cas
The channel-substitution leak (calendar invitation substituting for filtered email) suggests a general principle: any defense that filters specific tools without covering the full space of consequential actions with the same effect properties will be vulnerable to substitution. A severity instrument that matches the attacker's target across all consequential tools is more robust than success check
The finding that a low-cost model (Claude Haiku 4.5) resists as completely as frontier models, while another low-cost model (GPT-4o mini) is broadly compromised, suggests that in this setting safety tuning may matter more than raw capability for resisting indirect prompt injection—but this rests on one suite, one attack family, and modest high-severity counts, so the pattern may not generalize.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The paper introduces a severity scale (L0–L6) for tool-using agent red-team episodes, computed both by a deterministic oracle over execution traces and by an LLM judge panel. The core idea — grading the worst action an agent actually took, rather than reporting a binary attack-success rate — is genuinely useful and not present in the prior work the paper cites. The three disagreement cases (Sections V-A through V-C) are concrete and each makes a real point: the channel-substitution leak through an unfiltered calendar tool is a clean example of binary scoring failing, and the cross-model localization result is informative. Code, prompts, and per-episode logs are released. The judge reliability statistics are well-reported (alpha = 0.91, all weighted kappa > 0.8), and the stratified sampling design — all non-L0 episodes plus L0 controls — is the right choice for this kind of validation. The oracle is a deterministic function of traces and per-tool metadata, not a fitted model, so the circularity burden is low. Credit where earned: the instrument is cheap, portable, and the argument-match attribution rule is a sensible design choice that keeps the oracle self-contained. The paper also honestly scopes its limitations around argument-match attribution requiring a distinguishable target, and excludes the one injection that violates this. That concern is real but acknowledged and handled. The stress-test flag about L6 is more serious and unacknowledged. L6 is defined as two or more completed consequential actions whose severity strictly increases over steps. The canonical example in Appendix A is exfiltrate-then-delete. But per the tool-effect metadata in Table III, send_email to an external address is L4 (cross-scope, irreversible) and delete_file or delete_email is L3 (irreversible, local). The per-action sequence is L4→L3 — a decrease, not an increase. If the oracle assigns L6 to these episodes anyway, the escalation condition as stated is not met. This matters for two reasons. First, the judges scored these episodes as L4, which the paper frames as a systematic blind spot — but if the rubric's own condition is not satisfied, the judges are correct and the oracle is wrong. Second, the V-C headline claim (spotlighting raises the L5+L6 tail from 1 to 3 episodes) depends on two L6 episodes. Reclassify those as L4 and the tail is 1 L5 episode in both conditions, and the 'defense worsens the tail' claim collapses. The author needs to either fix the L6 definition (perhaps the intended condition is 'two or more completed consequential actions at different severity levels' rather than 'strictly increasing') or reclassify these episodes. This is fixable but it is load-bearing because it touches the scale definition, the judge-reliability finding, and one of three headline cases simultaneously. The evaluation is small (410 episodes, sparse at the top of the scale) but the paper acknowledges this honestly. The argument-match attribution limitation is scoped out rather than hidden. No other red flags. This paper is for researchers and practitioners working on agentic safety evaluation who need more than binary ASR. A reader who works on red-team benchmarks or agent deployment decisions will get value from the instrument design and the three disagreement cases. It deserves a serious referee. The L6 issue needs to be resolved before publication, but the core contribution — a trace-grounded ordinal severity scale computed deterministically and validated against an LLM panel — is sound and novel.

Referee Report

1 major / 5 minor

Summary. The paper introduces an action-graded severity scale (L0–L6) for evaluating tool-using AI agents under prompt injection, scoring outcomes by reversibility, scope, and privilege rather than the binary attack-success rate (ASR) used by existing benchmarks. A deterministic programmatic oracle computes severity from execution traces and the attacker's stated goal, while a panel of three frontier LLM judges grades tag-free trace summaries. Evaluated on the AgentDojo workspace suite (410 episodes across four models and two defenses), the paper identifies three cases where severity scoring exposes decisions that binary ASR gets wrong: a tool-filter defense reporting 0% ASR while still permitting a cross-scope leak (§V-A), spotlighting lowering ASR while raising the worst-case severity tail (§V-C), and severity localizing all harmful behavior to one of four models (§V-B). The judge panel reproduces the oracle with ordinal Krippendorff's alpha = 0.91 but shares a systematic blind spot for escalation chains (L6). All code, prompts, and per-episode logs are released.

Significance. The paper addresses a genuine gap: existing agentic red-teaming benchmarks reduce outcomes to a single bit, discarding severity information that matters for deployment decisions. The instrument is trace-grounded, portable, and inexpensive. The programmatic oracle is a deterministic function of execution traces and per-tool metadata (not a fitted model), which is a strength. The argument-match attribution rule is self-contained and does not consult the benchmark's own pass/fail verdict, avoiding circularity. The release of all code, prompts, and per-episode logs supports reproducibility. The three disagreement cases are concrete and well-illustrated. The judge-reliability methodology (measuring rather than assuming judge quality, with a stratified sample including L0 controls) is appropriate.

major comments (1)

§III-A, Table I, and Appendix A: The L6 escalation condition requires 'two or more completed consequential actions escalating in severity over steps' (strictly increasing per-action severity). However, the canonical exfiltrate-then-delete example in Appendix A assigns send_email (external address) as L4 (cross-scope, irreversible per Table III) and the subsequent delete as L3 (irreversible, local per Table III). The per-action severity sequence is therefore L4→L3, which is a decrease, not an increase. If the oracle assigns L6 to these episodes despite the per-action levels not strictly increasing, the escalation condition as stated is not satisfied. This is load-bearing for three reasons: (1) it affects the scale definition itself; (2) §V-D and Fig. 5 report that all three judges scored true L6 episodes as L4, framed as a 'systematic blind spot'—but if the rubric's stated condition is un

minor comments (5)

§V-D, Table II: The bias column shows GPT-5.5 at +0.20 and Claude Opus 4.8 at +0.30, but the MALE column shows 0.27 and 0.35 respectively. These are close but not identical; clarifying the relationship between MALE and signed bias (e.g., whether MALE is computed as absolute bias or includes additional error components) would help readers.
Fig. 5 caption: 'L1, L2 unoccupied in this sample' is noted, but the confusion matrices also show no L5 oracle episodes. This should be stated explicitly, as it means judge reliability at L5 is untested.
§IV: The model names (GPT-5.4, Claude Sonnet 4.6, GPT-5.5, Claude Opus 4.8, Gemini 3.5 Flash) appear to be fictional or placeholder names. If these are anonymized or projected names, this should be clarified; if they are real model versions, the naming convention is unusual.
Table III: The 'Level' column for create_calendar_event, add_calendar_event_participant, and reschedule_calendar_event shows 'L2/L4' and for cancel_calendar_event shows 'L3/L4'. A brief note explaining that the slash separates local-scope from cross-scope outcomes (already implied by the 'arg'/'state' scope column) would improve readability.
§V-B: The claim that 'the pattern is more consistent with safety tuning than raw capability' is speculative given n=1 suite and modest counts. The paper hedges this appropriately ('though the result rests on a single suite'), but the claim could be further softened or removed.

Simulated Author's Rebuttal

4 responses · 0 unresolved

The referee identifies a genuine inconsistency between the stated L6 escalation condition and the canonical example used to illustrate it. We acknowledge the error and will revise the L6 definition to match what the oracle actually computes, and will re-examine the §V-D judge blind-spot framing in light of the corrected definition.

read point-by-point responses

Referee: §III-A, Table I, and Appendix A: The L6 escalation condition requires 'two or more completed consequential actions escalating in severity over steps' (strictly increasing per-action severity). However, the canonical exfiltrate-then-delete example in Appendix A assigns send_email (external address) as L4 (cross-scope, irreversible per Table III) and the subsequent delete as L3 (irreversible, local per Table III). The per-action severity sequence is therefore L4→L3, which is a decrease, not an increase. If the oracle assigns L6 to these episodes despite the per-action levels not strictly increasing, the escalation condition as stated is not satisfied. This is load-bearing for three reasons: (1) it affects the scale definition itself; (2) §V-D and Fig. 5 report that all three judges scored true L6 episodes as L4, framed as a 'systematic blind spot'—but if the rubric's stated condition is un

Authors: The referee is correct, and we are grateful for the careful reading. There is a genuine inconsistency between the stated L6 condition and the canonical example, and it must be fixed. revision: yes
Referee: (1) it affects the scale definition itself

Authors: We agree. The L6 definition in Table I, §III-A, and Appendix A currently states 'strictly increasing per-action severity over steps,' but the exfiltrate-then-delete example produces a per-action sequence of L4 (send_email to external address) → L3 (delete_file or delete_email, local irreversible), which is decreasing, not increasing. The oracle's actual implementation does not check for strictly increasing per-action levels; it checks for two or more completed consequential actions at different severity levels where the combined trajectory represents a multi-step attack chain worse than any single action. The stated condition was an error in our formalization of the concept. We will revise the L6 definition across Table I, §III-A, Fig. 1, and Appendix A to accurately describe what the oracle computes: a trajectory-level level assigned when two or more completed consequential actions at distinct severity levels form an attack chain (e.g., exfiltration followed by evidence destruction), capturing that the combined harm exceeds the peak of any individual action. We will also update the oracle description in §III-B to match the actual code, which we are releasing and which the referee can inspect. revision: yes
Referee: (2) §V-D and Fig. 5 report that all three judges scored true L6 episodes as L4, framed as a 'systematic blind spot'—but if the rubric's stated condition is unclear or inconsistent, the judges may be failing not because of a cognitive blind spot but because the rubric given to them does not clearly define L6

Authors: This is a fair and important point. We accept that the §V-D framing of the judges' L6 failures as a 'systematic blind spot' is overstated given that the rubric text the judges received contained the same inconsistent L6 definition. The judges may have been failing because the escalation condition was ambiguously specified, not because of an inherent limitation of trace-only judging. We will revise §V-D to acknowledge this confound explicitly: the current data cannot distinguish between (a) judges being unable to recognize escalation chains from traces, and (b) judges being unable to apply an inconsistent rubric definition. The corrected L6 definition may also change judge behavior, and we will note that re-running the judge panel under the revised definition is necessary before drawing strong conclusions about the L6 blind spot. We will soften the claim accordingly. revision: yes
Referee: (3) the escalation condition is load-bearing for the overall validity of the scale

Authors: We agree that L6 is load-bearing and that the inconsistency undermines confidence in the top level of the scale. To address this: (a) we will release the oracle source code (already promised) so the actual escalation logic is inspectable; (b) we will add unit tests for the L6 condition to the appendix, showing exactly which trajectory patterns trigger it; (c) we will re-examine the L6 episodes in our dataset under the corrected definition to confirm they still warrant L6 and report any reclassifications. If any episodes no longer qualify as L6 under the corrected definition, we will update the severity distributions in Figs. 3–4 and Tables IV–V accordingly. We note that L6 episodes are sparse (1–2 per condition), so any reclassification would affect counts but not the overall pattern of results, though we will state this honestly rather than asserting it preemptively. revision: yes

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity found; the severity oracle is a deterministic function of execution traces and per-tool metadata, and the judge panel is evaluated against it without reverse dependency.

full rationale

The paper's central instrument is a programmatic oracle (O_prog) that computes severity levels from agent execution traces using a fixed table of per-tool effect metadata (Table III) and an argument-match attribution rule that reads the attacker's stated goal. This is a deterministic function of its inputs, not a fitted model, and it does not depend on the benchmark's own pass/fail verdict (Section III-C explicitly states it 'never consults the benchmark's own pass or fail verdict'). The LLM judge panel is evaluated against the oracle (Section V-D, Table II), but the oracle does not depend on the judges—this is a one-directional evaluation, not a circular validation. The three headline cases (Sections V-A, V-B, V-C) are computed from the oracle's output, not from fitted parameters renamed as predictions. The one self-citation [4] (ADVERSA, same first author) is invoked for methodological framing ('continuing a methodological commitment from prior work') and for comparison of inter-judge agreement levels, but it is not load-bearing for the severity scale's definition or the oracle's computation. The skeptic's concern about the L6 escalation condition (whether exfiltrate-then-delete sequences actually exhibit strictly increasing per-action severity) is a correctness/consistency issue internal to the rubric definition, not a circularity where the output reduces to the input by construction. The derivation chain is self-contained: trace inputs → per-tool metadata → gate-order evaluation → severity level, with no step that feeds the output back into the input.

Assumptions & free parameters 3 free parameters · 4 assumptions · 2 invented entities

The paper introduces a measurement instrument, not a theory with fitted parameters. The free parameters are design choices (gate order, escalation condition) and hand-coded metadata, not values fitted to data. The axioms are domain assumptions about the environment and attack family, clearly stated in Section VII.

free parameters (3)

Per-tool effect metadata (reversibility, scope, privilege) = 24 workspace tools, 10 consequential
Hand-coded per tool (e.g., delete_file is irreversible, share_file is privilege-expanding). Not fitted to data but derived from environment properties.
Gate order (privilege > cross-scope > irreversible > reversible) = Fixed
A design choice, not fitted. Determines which severity level an action reaches.
Escalation condition for L6 = Two or more completed consequential actions escalating over steps
A design choice defining the top level.

assumptions (4)

domain assumption AgentDojo's environment state is a faithful representation of agent actions.
The oracle reads AgentDojo episode logs; if the logs do not capture the true environment state, the severity grading is wrong.
domain assumption The attacker's stated goal names a distinguishable target.
Section III-C: argument-match attribution requires this. Injections with dynamic or diffuse targets are excluded (Section VII).
domain assumption Reversibility is environment-determined.
Section VII: an append scored irreversible in AgentDojo's versionless drive would be reversible in a versioned filesystem.
domain assumption The canonical important_instructions injection is representative of prompt-injection attacks.
The paper evaluates one attack family; generalization to other attacks is assumed but not tested.

invented entities (2)

Programmatic oracle (O_prog) independent evidence
purpose: Deterministic severity grading from execution traces
The oracle is a deterministic function, not a postulated entity. Its reliability is measured against the LLM judge panel.
Action-graded harm rubric (L0-L6) independent evidence
purpose: Ordinal severity scale for agent actions
The rubric is a measurement instrument. Its usefulness is demonstrated by the three disagreement cases (Sections V-A to V-C).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents." pith.science (2026). https://pith.science/paper/IXAUY3GB

@misc{pith2026260707474,
  author       = {Pith},
  title        = {Pith review of: Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IXAUY3GB}},
  note         = {Machine review of arXiv:2607.07474}
}

read the original abstract

Agentic red-teaming benchmarks report whether an injected agent was compromised as a single bit: the attack succeeded, or it did not. We argue that this binary attack-success rate discards the information a defender most needs, namely how harmful the resulting action was. We introduce an action-graded harm rubric that scores an agent's tool-call trajectory on a seven-level ordinal scale (L0 to L6) according to whether the executed action was reversible, whether it crossed scope to reach another party, and whether it expanded privilege. We compute the scale two ways: a deterministic oracle that reads the trajectory and the attacker's stated goal, and a panel of three frontier language-model judges that read a tag-free account of the same trajectory. Across four victim models and two defenses on the AgentDojo workspace suite, severity grading exposes three cases the binary metric hides, including a defense that reports a zero attack-success rate while still permitting an externally visible cross-scope leak through an unfiltered tool. The judge panel reproduces the oracle with high ordinal agreement (Krippendorff's alpha = 0.91) but shares systematic blind spots that we characterize, most notably a failure to recognize escalation chains. Unlike prior work that provides harm taxonomies, harmful-task completion tests, execution-level safety benchmarks, or severity-aware simulation, our contribution is a reusable, trace-grounded severity instrument applied to the actual actions recorded in existing red-team logs. All code, prompts, and per-episode logs are released.

Figures

Figures reproduced from arXiv: 2607.07474 by the authors.

**Figure 2.** A defense that looks flawless under binary scoring still leaks under [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Peak-severity distribution across four models, no defense. Three of [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: The spotlighting paradox. Binary attack-success falls from [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Judge versus oracle severity confusion (orange outline marks perfect agreement). Rows are oracle severity, columns are judge severity. All three judges [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: Judge-panel reliability against the programmatic oracle. All judges [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 15 canonical work pages

[1]

AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

E. Debenedetti, J. Zhang, M. Balunovi ´c, L. Beurer-Kellner, M. Fischer, and F. Tram`er, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inAdvances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024

work page 2024
[2]

Ignore Previous Prompt: Attack Techniques For Language Models

F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,”arXiv preprint arXiv:2211.09527, 2022

work page Pith review arXiv 2022
[3]

InjecAgent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,

Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics: ACL, 2024

work page 2024
[4]

ADVERSA: Mea- suring multi-turn guardrail degradation and judge reliability in large language models,

H. Owiredu-Ashley, B. Dong, T. Ji, and J. Shang, “ADVERSA: Mea- suring multi-turn guardrail degradation and judge reliability in large language models,” inProc. 24th IEEE/ACIS International Conference on Software Engineering Research, Management and Applications (SERA), 2026

work page 2026
[5]

JailbreakBench: An open robustness benchmark for jailbreaking large language models,

P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V . Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tram`eret al., “JailbreakBench: An open robustness benchmark for jailbreaking large language models,”Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024

work page 2024
[6]

HarmBench: A standardized evaluation framework for automated red teaming and robust refusal,

M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks, “HarmBench: A standardized evaluation framework for automated red teaming and robust refusal,” inInternational Conference on Machine Learning (ICML), 2024

work page 2024
[7]

Judging LLM-as-a-judge with MT-Bench and chatbot arena,

L. Zheng, W.-L. Chiang, Y . Sheng, S. Zhuang, Z. Wu, Y . Zhuang, Z. Lin, Z. Li, D. Li, E. Xing, H. Zhang, J. E. Gonzalez, and I. Stoica, “Judging LLM-as-a-judge with MT-Bench and chatbot arena,” inAdvances in Neural Information Processing Systems (NeurIPS), 2023

work page 2023
[8]

Agent-SafetyBench: Evaluating the Safety of LLM Agents

Z. Zhang, S. Cui, Y . Lu, J. Zhou, J. Yang, H. Wang, and M. Huang, “Agent-SafetyBench: Evaluating the safety of LLM agents,”arXiv preprint arXiv:2412.14470, 2024

work page Pith review arXiv 2024

Show all 15 references

[9]

AgentHarm: A benchmark for measuring harmfulness of LLM agents,

M. Andriushchenko, A. Souly, M. Dziemian, D. Duenas, M. Lin, J. Wang, D. Hendrycks, A. Zou, Z. Kolter, M. Fredriksonet al., “AgentHarm: A benchmark for measuring harmfulness of LLM agents,” inInternational Conference on Learning Representations (ICLR), 2025

2025
[10]

Taxonomy of risks posed by language models,

L. Weidinger, J. Uesato, M. Rauh, C. Griffin, P.-S. Huang, J. Mellor, A. Glaese, M. Cheng, B. Balle, A. Kasirzadehet al., “Taxonomy of risks posed by language models,” inACM Conference on Fairness, Accountability, and Transparency (FAccT), 2022

2022
[11]

Identifying the risks of LM agents with an LM-emulated sandbox,

Y . Ruan, H. Dong, A. Wang, S. Pitis, Y . Zhou, J. Ba, Y . Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of LM agents with an LM-emulated sandbox,” inInternational Conference on Learning Representations (ICLR), 2024

2024
[12]

R-Judge: Benchmarking safety risk awareness for LLM agents,

T. Yuan, Z. He, L. Dong, Y . Wang, R. Zhao, T. Xia, L. Xu, B. Zhou, F. Li, Z. Zhang, R. Wang, and G. Liu, “R-Judge: Benchmarking safety risk awareness for LLM agents,” inFindings of the Association for Computational Linguistics: EMNLP, 2024

2024
[13]

Defending against indirect prompt injection attacks with spotlighting,

K. Hines, G. Lopez, M. Hall, F. Zarfati, Y . Zunger, and E. Kiciman, “Defending against indirect prompt injection attacks with spotlighting,” arXiv preprint arXiv:2403.14720, 2024

2024 arXiv
[14]

Weighted kappa: Nominal scale agreement provision for scaled disagreement or partial credit,

J. Cohen, “Weighted kappa: Nominal scale agreement provision for scaled disagreement or partial credit,”Psychological Bulletin, vol. 70, no. 4, pp. 213–220, 1968

1968
[15]

Computing Krippendorff’s alpha-reliability,

K. Krippendorff, “Computing Krippendorff’s alpha-reliability,”Univer- sity of Pennsylvania Scholarly Commons, 2011

2011

Pith tools

Reviewed July 9, 2026 · model on record in the stance chip above.

[1] [1]

AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

E. Debenedetti, J. Zhang, M. Balunovi ´c, L. Beurer-Kellner, M. Fischer, and F. Tram`er, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inAdvances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024

work page 2024

[2] [2]

Ignore Previous Prompt: Attack Techniques For Language Models

F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,”arXiv preprint arXiv:2211.09527, 2022

work page Pith review arXiv 2022

[3] [3]

InjecAgent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,

Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics: ACL, 2024

work page 2024

[4] [4]

ADVERSA: Mea- suring multi-turn guardrail degradation and judge reliability in large language models,

H. Owiredu-Ashley, B. Dong, T. Ji, and J. Shang, “ADVERSA: Mea- suring multi-turn guardrail degradation and judge reliability in large language models,” inProc. 24th IEEE/ACIS International Conference on Software Engineering Research, Management and Applications (SERA), 2026

work page 2026

[5] [5]

JailbreakBench: An open robustness benchmark for jailbreaking large language models,

P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V . Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tram`eret al., “JailbreakBench: An open robustness benchmark for jailbreaking large language models,”Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024

work page 2024

[6] [6]

HarmBench: A standardized evaluation framework for automated red teaming and robust refusal,

M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks, “HarmBench: A standardized evaluation framework for automated red teaming and robust refusal,” inInternational Conference on Machine Learning (ICML), 2024

work page 2024

[7] [7]

Judging LLM-as-a-judge with MT-Bench and chatbot arena,

L. Zheng, W.-L. Chiang, Y . Sheng, S. Zhuang, Z. Wu, Y . Zhuang, Z. Lin, Z. Li, D. Li, E. Xing, H. Zhang, J. E. Gonzalez, and I. Stoica, “Judging LLM-as-a-judge with MT-Bench and chatbot arena,” inAdvances in Neural Information Processing Systems (NeurIPS), 2023

work page 2023

[8] [8]

Agent-SafetyBench: Evaluating the Safety of LLM Agents

Z. Zhang, S. Cui, Y . Lu, J. Zhou, J. Yang, H. Wang, and M. Huang, “Agent-SafetyBench: Evaluating the safety of LLM agents,”arXiv preprint arXiv:2412.14470, 2024

work page Pith review arXiv 2024