Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces "Owner-Harm," a new threat model for AI agent safety that focuses on agents harming their deployers, a category largely missed by existing benchmarks focused on generic criminal harm. They demonstrate that current compositional safety systems, while effective against generic harm, perform poorly against prompt-injection-mediated owner harm due to a lack of generalization across tool vocabularies, and propose the Symbolic-Semantic Defense Generalization (SSDG) framework to address this. Through experiments, they show that a combination of a gate and a post-audit verifier significantly improves owner-harm detection and that structured goal-action alignment is crucial for effective detection.
Your AI agent's safety net might be full of holes: it's likely blind to the ways it could be sabotaging *you*, its owner.
Existing AI agent safety benchmarks focus on generic criminal harm (cybercrime, harassment, weapon synthesis), leaving a systematic blind spot for a distinct and commercially consequential threat category: agents harming their own deployers. Real-world incidents illustrate the gap: Slack AI credential exfiltration (Aug 2024), Microsoft 365 Copilot calendar-injection leaks (Jan 2024), and a Meta agent unauthorized forum post exposing operational data (Mar 2026). We propose Owner-Harm, a formal threat model with eight categories of agent behavior damaging the deployer. We quantify the defense gap on two benchmarks: a compositional safety system achieves 100% TPR / 0% FPR on AgentHarm (generic criminal harm) yet only 14.8% (4/27; 95% CI: 5.9%-32.5%) on AgentDojo injection tasks (prompt-injection-mediated owner harm). A controlled generic-LLM baseline shows the gap is not inherent to owner-harm (62.7% vs. 59.3%, delta 3.4 pp) but arises from environment-bound symbolic rules that fail to generalize across tool vocabularies. On a post-hoc 300-scenario owner-harm benchmark, the gate alone achieves 75.3% TPR / 3.3% FPR; adding a deterministic post-audit verifier raises overall TPR to 85.3% (+10.0 pp) and Hijacking detection from 43.3% to 93.3%, demonstrating strong layer complementarity. We introduce the Symbolic-Semantic Defense Generalization (SSDG) framework relating information coverage to detection rate. Two SSDG experiments partially validate it: context deprivation amplifies the detection gap 3.4x (R = 3.60 vs. R = 1.06); context injection reveals structured goal-action alignment, not text concatenation, is required for effective owner-harm detection.