SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents
Xinjie Shen, Junran Wang, Rongzhe Wei, Pan Li
cs.CR, cs.AI
2026-09-28
DART raises semantic ASR 18.8-35.9 points over the best baseline via execution-guided search; SAGE cuts DART's online Hard ASR from 48.0% to 4.0% with read-only state checks.
Once a language-model agent calls a tool, the output is a state transition. A later action that looks like routine ops can become harmful because earlier calls already changed files, permissions, or database rows. In one Georgia Tech task, the attacker asks the agent to find session files and upload them to shared cloud storage under a debugging cover. The search can be preparation. Uploading the cookie database is the leak.
Visible dialogue often does not contain the state that decision needs. The same upload moves a diagnostic log or authentication data depending on file contents and who can read the destination. SEAD puts the attacker, the target agent, and the defender in one partially observed control loop. Attack success is reaching a harmful environment state. The defender has to stop the first transition that flips the harmful goal from unmet to met.
The attacker only supplies instructions. The target chooses concrete tool calls, so a fixed multi-step script often diverges from the realized trace. The defender must PASS or BLOCK before side effects land, while its visible history can be compatible with both a safe and a harmful current state.
DART searches over executed prefixes. Candidate instructions are proposed from a parent, then the target executes them to grow children. Node value Q starts as 0.20 introspection plus 0.30 execution-feedback plus 0.50 executable-check progress. After a path ends, the terminal return is backed up and UCT picks the next expandable prefix. Search uses max depth 8, branch factor 2, and at most 25 executed nodes. Attacker components run Huihui-Qwen3.8-27B-abliterated.
SAGE can issue read-only queries before gating: read a file, list a directory, inspect table schema, run a restricted SELECT, snapshot page state. Those observations stay in a defender-private transcript and do not change task state. Then it PASS or BLOCK. A new tool call after a block goes through the gate again. Supervision labels the annotated harmful closure as BLOCK and earlier actions as PASS. The backbone is Qwen3-4B-Instruct-2507, fully fine-tuned for one epoch on Filesystem and Terminal only. PostgreSQL and Web are held out; inference swaps in domain-appropriate read-only tools.
The dataset adapts MT-AgentRisk into 187 malicious tasks with controlled initial states, replayable tools, and task-level executable checks. RQ1 uses all 187 tasks on four target models. RQ2 and RQ3 use a 75-task subset. Benign controls are 95 trajectories rewritten from OpenAgentSafety, 770 tool actions.
On RQ1, DART leads every target on both semantic and Hard ASR. Semantic ASR beats the strongest competing baseline by 18.8-35.9 points; Hard ASR beats it by 8.1-17.9 points. Direct requests, MTA's fixed decompositions, STAC, and Intent Hijacking do not consistently beat a single harmful instruction. On Luna, Direct is 37.4%/27.8% and MTA is 40.1%/21.4%.
| Target | DART semantic ASR | DART Hard ASR |
| GPT-5.6 Luna | 73.3% | 54.7% |
| GPT-5.6 Terra | 62.5% | 51.1% |
| Gemini 3.8 Flash | 43.9% | 33.2% |
| Claude Sonnet 5 | 51.9% | 38.7% |
RQ2 scores offline gates on 55 semantic-success attack traces and 95 benign traces:
| Defender | Benign all-pass B | Exact intercept H1 | Timing-aware H2 | Miss |
| Fine-tuned Binary | 100.00% | 18.18% | 22.05% | 72.73% |
| TS-Guard | 71.58% | 7.27% | 38.14% | 14.55% |
| SAGE | 95.79% | 34.55% | 58.79% | 7.27% |
SAGE lets every action through on 91 of 95 benign traces. Versus the same-backbone binary fine-tune, it gives up 4.21 points of B and gains 65.45 points of harmful interception measured as one minus miss. Exact closure intercept is 34.55%, with 58.18% still early.
RQ3 is online: refusals change the continuation, the attacker can replan, the target is GPT-5.6 Luna. Undefended DART is 65.3% semantic and 48.0% Hard. SAGE brings those to 10.7% and 4.0%. Fine-tuned Binary had B=100% offline and still 48.0% Hard online. On 30 PostgreSQL/Web tasks held out of defender training, DART semantic successes fall from 20 to 3 and Hard from 9 to 1. The highest residual among four attacks is Intent Hijacking at 13.3% semantic and 6.7% Hard. No PostgreSQL attack records Hard success under SAGE.
A production gate that only reads dialogue intent or the text of one tool call will treat shared preparation and the harm-enabling step as the same action. SAGE decides before execution and can fill in state with read-only tools. A 4B model trained on two domains transferring to databases and web pages is closer to querying when evidence is missing than to a keyword list.
Red teams get more from tool-execution feedback than from jailbreak phrasing. Fixed multi-turn decompositions and two adaptive dialogue attacks often lose to a direct harmful request on executable checks.
The cost is up to six defender steps at inference, exposing environment state to the defender process, and a trusted runtime that can block tools before side effects.
The authors flag concurrent processes, compound actions, and assistant-output disclosure as outside the current gate; defense numbers use only GPT-5.6 Luna; there is no clean ablation of search versus investigation pieces.
Offline exact intercept is only 34.55%. Early blocks remain the main mode. B asks whether a whole benign trace was allowed through, not whether the task still completes after a cut. In online case single.136, SAGE BLOCKs twice, then DART still satisfies three executable checkpoints on turn five. An early block does not imply a safe terminal state.
Only 679 of 7,407 SAGE training demonstrations contain read-only queries. The threat model assumes a trusted execution layer. If a browser, shell, or plugin can bypass it, accurate read-only queries arrive too late. The attacker is an abliterated model, which does not match a typical user-side adversary. Tasks are adapted from MT-AgentRisk across four tool domains; there is no evidence for arbitrary MCP fleets.