• The Evolution of AI Risk: The talk begins by contrasting passive chatbots with active agents, illustrating how the threat landscape has shifted from LLMs merely describing harmful acts to executing them via tools. • Defining the Gap: It highlights the limitation of "Universal Security" (standard safety filters) and introduces "Security Steerability" as the metric for measuring adherence to custom application-level constraints. • The solution ** ASTRA Framework: This section details the methodology, which simulates 10 diverse agents (e.g., industrial robots, travel assistants) equipped with 37 tools to test resilience against 140 distinct attacks. Real-World Scenarios: The presentation walks through specific use cases, such as a "Travel Agent Bot" facing attacks like authority exploitation to bypass booking restrictions, to demonstrate the practical implications of steerability failures. ** VeganRibs is a benchmark designed to evaluate "Security Steerability" in chat-only environments by assessing an LLM's ability to adhere to custom application-specific guardrails (such as "do not address questions about motorcycles") when faced with adversarial user inputs. • Benchmarking Results: The conclusion presents findings on multiple open-source models, revealing the "Llama 3 Paradox" where models with high general safety scores surprisingly fail to enforce specific agentic guardrails. • Mitigations: The final section suggests best practices, such as using software-level guardrails and implementing policy reminders during multi-turn interactions.
Tools and Techniques for Reviewers • Agent Architecture: The agents are constructed using LangGraph following the ReAct (Reasoning + Acting) paradigm, allowing the models to iteratively plan and execute tool calls. • Attack Vectors: The evaluation employs sophisticated social engineering techniques, including Role Playing, Authority Exploitation, and Indirect Prompt Injection (attacks embedded in tool responses).
