S1-Evo：经验引导的证据竞争攻击针对 Typed System-1 决策模型
S1-Evo: Experience-Guided Evidence Competition Attacks on Typed System-1 Decision Models
AI 导读
研究者提出 S1-Evo，一个针对 Typed System-1（S1）决策模型的攻击框架，利用合同感知的证据通道扰动不可信字段来触发证据竞争。该框架在种子任务上离线优化并将验证后的翻转蒸馏为经验卡，测试时检索经验卡构造针对未见任务的扰动。
正文 · 原文
Abstract:Typed System-1 (S1) decision models are increasingly deployed in LLM agents for routing, moderation, and authorization to cut inference cost, yet untrusted context can still manipulate typed outputs and alter execution branches. Unlike autoregressive System-2 (S2) models, S1 interfaces score dynamic rules and options without token-by-token decoding, mismatching attacks targeting text continuation or explicit override commands. We propose S1-Evo, a self-evolving framework tailored to S1's contract-based option competition and margin feedback. S1-Evo perturbs untrusted fields via contract-aware evidence channels to induce \emph{evidence competition} with original task evidence while preserving fact invariance. Offline on seed tasks, it optimizes candidates via feedback search guided by directional margins and re-verification, distilling verified flips into experience cards. At test time, S1-Evo retrieves relevant cards to construct perturbations for unseen tasks. Across four benchmarks and three S1 models, S1-Evo reaches 71.99\% mean ASR and 57.47\% high-confidence ASR on \texttt{jev-1.14}, and causes up to 24.00\% E2E agent violations.
| Comments: | none |
| Subjects: | Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2611.16937 [cs.AI] |
| (or arXiv:2611.16937v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.16937 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Kaixiang Wang [view email]
[v1]
Thu, 12 Nov 2026 15:21:44 UTC (727 KB)
来源：arXiv cs.AI · arxiv.org