Search papers, labs, and topics across Lattice.
This paper critiques the binary attack-success rate used in agentic red-teaming benchmarks, arguing that it fails to convey the severity of harmful actions taken by compromised AI agents. The authors introduce a seven-level ordinal scale for action-graded harm assessment, which evaluates tool-call trajectories based on reversibility, scope, and privilege expansion. Their findings reveal that this new metric uncovers critical vulnerabilities in existing defenses, including cases where a zero attack-success rate masks significant risks, and demonstrate high agreement between human judges and a deterministic oracle in scoring actions.
A new seven-level harm scale reveals hidden vulnerabilities in AI agent defenses that binary metrics overlook, exposing risks even when attack-success rates appear low.
Agentic red-teaming benchmarks report whether an injected agent was compromised as a single bit: the attack succeeded, or it did not. We argue that this binary attack-success rate discards the information a defender most needs, namely how harmful the resulting action was. We introduce an action-graded harm rubric that scores an agent's tool-call trajectory on a seven-level ordinal scale (L0 to L6) according to whether the executed action was reversible, whether it crossed scope to reach another party, and whether it expanded privilege. We compute the scale two ways: a deterministic oracle that reads the trajectory and the attacker's stated goal, and a panel of three frontier language-model judges that read a tag-free account of the same trajectory. Across four victim models and two defenses on the AgentDojo workspace suite, severity grading exposes three cases the binary metric hides, including a defense that reports a zero attack-success rate while still permitting an externally visible cross-scope leak through an unfiltered tool. The judge panel reproduces the oracle with high ordinal agreement (Krippendorff's alpha = 0.91) but shares systematic blind spots that we characterize, most notably a failure to recognize escalation chains. Unlike prior work that provides harm taxonomies, harmful-task completion tests, execution-level safety benchmarks, or severity-aware simulation, our contribution is a reusable, trace-grounded severity instrument applied to the actual actions recorded in existing red-team logs. All code, prompts, and per-episode logs are released.
