arXiv cs.AI· Chenyuan Yang, Hwiwon Lee, Jongseong Kim, Yihan Yang, Dongjun Kim, Yinfang Chen, Lingming Zhang·· 3 小时前精选AI 评分64
CyberDual 论文提出 AI 攻击者对抗 AI 代码审查者的攻防竞技场
CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance
AI 导读
论文提出 CyberDual 竞技场，让攻击者智能体在真实开源项目维护中隐藏可利用漏洞，由审查者智能体查找并修复，以重放攻击者的 PoC 执行结果判定胜负。三个智能体审查者从六名攻击者的 1,088 个有效攻击中捕获 85-91%，但当攻击分散在真实上游提交中时，约六分之一攻击在审查后仍能成功利用。
推荐理由
论文用真实开源维护中的攻防对抗评估 AI 代码审查，给出了可复现的量化结果和部署监测思路。
正文 · 原文
Abstract:Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE) |
| Cite as: | arXiv:2610.34435 [cs.CR] |
| (or arXiv:2610.34435v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34435 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Chenyuan Yang [view email]
[v1]
Sun, 25 Oct 2026 16:44:07 UTC (735 KB)
来源：arXiv cs.AI · arxiv.org