Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks

What it claims

Agent-security ASR partly measures how a benchmark words the threat, not only how robust the agent is. Across 28,904 agent runs on three benchmarks, renaming a tool moves ASR in both directions and by uneven amounts. The finding beyond the summary is this: explicit threat vocabulary is not what drives most of the effect. On MCPTox, a threat-neutral name matched to the threat-explicit name on token count, length and casing reproduces 8.54 of the 11.00-point drop on GPT-5-mini. The paper also shows that the size of the effect depends on how "success" is defined, and on whether you look at security or benign utility.

How it works

A benchmark instance has six parts:

1. environment
2. attacker objective
3. violation policy
4. attack-success criterion
5. evaluator
6. agent-visible representation

A transformation T is threat-preserving if it changes only part 6. TPRS is defined as Δ = ASR(T(B), m) − ASR(B, m). The new wording does not have to mean the same as the old. Changes to the attack itself, such as removing the injected instruction, are not allowed. Where a scoring rule depends on benchmark text, the authors check that the text is byte-identical across arms.

The transformation is applied in a different place in each benchmark:

The paper also runs orthographic and semantic-neutral control arms, including the form-matched MCPTox arm described above.

Evidence

• ASB: neutral names raise committed ASR by +11.67 pp on GPT-5-mini and +13.21 pp on Claude Haiku 4.5. The effect looks different if success is counted at tool invocation instead of also requiring that the agent did not refuse.
• MCPTox: threat-explicit names lower ASR by −11.00 pp on GPT-5-mini and −4.11 pp on Haiku 4.5. The form-matched neutral control recovers 8.54 of the 11.00 pp on GPT-5-mini.
• AgentDojo (GPT-4o-mini only): the ASR change is −0.50 pp, 95% CI [−3.65, +2.51], which is effectively null. Benign utility falls 5.36 pp on tasks that need the renamed tool.

ASB and MCPTox agree on direction: more threat-explicit naming goes with lower measured ASR.

How to use it

The paper gives no released code or commands in the text shown. The practical takeaways for anyone reporting or consuming agent-security scores:

• Re-run with a few threat-preserving renames of the attack-relevant tools and report the spread, not a single ASR.
• Include a form-matched neutral arm, so that a lexical effect is not mistaken for a semantic one.
• Report the success definition (invocation vs. invocation-without-refusal) next to the score.
• Track benign utility together with ASR. AgentDojo shows the cost can appear there even when ASR does not move.

The authors also draw a distinction. If an attacker controls the name, the representation is part of the attack surface. If the benchmark designer controls it, the effect is a measurement artifact.

Limits

• The fetched text cuts off partway through the methodology. Per-benchmark setups, prompts, defenses tested and full result tables are not visible here.
• Coverage is narrow. Only three small/mini models were used, and AgentDojo was tested on GPT-4o-mini alone.
• The effect is not uniform across benchmarks or models: Haiku shows 4.11 pp on MCPTox versus GPT-5-mini's 11.00 pp.
• The authors explicitly do not identify a "correct" representation. They only show that scores may fail to generalize across representations.