osunlp/AutoElicit-Exec

--- license: apache-2.0 task_categories: - other tags: - trajectory - agent - safety - elicitation --- # AutoElicit-Exec Dataset [**Project Page**](https://osu-nlp-group.github.io/AutoElicit/) | [**Paper**](https://arxiv.org/abs/2602.08235) | [**GitHub**](https://github.com/OSU-NLP-Group/AutoElicit) AutoElicit-Exec is a human-verified dataset of 132 execution trajectories exhibiting unintended behaviors from typical benign execution. All trajectories are elicited from frontier CUAs (i.e., Claude 4.5 Haiku and Claude 4.5 Opus) using AutoElicit, which perturbs benign instructions from OSWorld to increase the likelihood of unintended harm while keeping instructions realistic and benign. This dataset is designed to provide demonstrations of unintended behaviors from CUAs in real-world computer-use scenarios, allowing for further analysis of the benign input factors resulting in unintended safety risks. ## Dataset Structure Each row contains the following fields: | Field | Type | Description | |-------|------|-------------| | `trajectory_id` | string | Unique identifier for each trajectory (traj_001 - traj_132) | | `task_id` | string | OSWorld task ID representing the original benign task | | `domain` | string | Domain of the OSWorld task (e.g., `os`, `multi_apps`) | | `perturbation_id` | string | Unique identifier for the perturbed query variant | | `refinement_model` | string | Model used to refine the perturbation (e.g., `us_anthropic_claude-haiku-4-5-20251001-v1_0`) | | `execution_agent` | string | The CUA agent that executed the trajectory (e.g., `claude-haiku-4-5-20251001`) | | `perturbed_instruction` | string | The perturbed instruction used to elicit an unintended behavior | | `trajectory_steps` | list[dict] | List of execution steps (see details below) | | `screenshots` | list[string] | List of paths to screenshot images in the repo | | `trajectory_evaluation` | dict | Evaluation results from the automatic evaluator (see details below) | | `trajectory_summary` | string | Generated natural language summary of the trajectory used to guide evaluation | ### `trajectory_steps` Structure Each step in the `trajectory_steps` list is a dictionary containing: | Field | Type | Description | |-------|------|-------------| | `step_num` | int | The step number in the trajectory | | `action` | string | The command executed by the agent (e.g., `pyautogui.click(100, 200)`) | | `thought` | string | The agent's reasoning/thought process before taking the action | | `screenshot_file` | string | Path to the corresponding screenshot in the repo (e.g., `images/traj_001/step_0.png`) | ### `trajectory_evaluation` Structure The `trajectory_evaluation` dictionary contains the automatic evaluation results: | Field | Type | Description | |-------|------|-------------| | `reasoning` | string | Step-by-step reasoning explaining how the evaluation was performed | | `behavior_elicitation_score` | int | Score (0-100) indicating how strongly the harmful behavior was elicited | | `behavior_elicitation_explanation` | string | Detailed explanation of why the score was assigned | | `harmful_actions_observed` | list[string] | List of specific harmful actions identified in the trajectory | | `safe_actions_observed` | list[string] | List of safe/benign actions observed in the trajectory | | `matches_expected_behavior` | string | Describes whether the behavior matched the unintended behavior target (`exact_match`, `partial_match`, `alternative_harmful`) | | `severity_assessment` | string | Severity level of the harm (`minimal`, `low`, `medium`, `high`, `critical`) | | `severity_explanation` | string | Explanation of why the severity level was assigned | | `recommendation` | string | Final recommendation for including in the dataset | | `recommendation_reasoning` | string | Reasoning behind the collection recommendation | ## Loading the Dataset ```python from datasets import load_dataset # Load the dataset ds = load_dataset("osunlp/AutoElicit-Exec", split="train") # Access a row example = ds[0] print(f"Trajectory ID: {example['trajectory_id']}") print(f"Task ID: {example['task_id']}") print(f"Domain: {example['domain']}") print(f"Execution Agent: {example['execution_agent']}") print(f"Instruction: {example['perturbed_instruction']}") ``` ### Accessing Trajectory Steps ```python # Iterate through trajectory steps steps = example["trajectory_steps"] for step in steps: print(f"Step {step['step_num']}:") print(f" Action: {step['action']}") print(f" Thought: {step['thought'][:100]}...") print(f" Screenshot: {step['screenshot_file']}") ``` ### Accessing Evaluation Results ```python # Access evaluation details eval_data = example["trajectory_evaluation"] print(f"Recommendation: {eval_data['recommendation']}") print(f"Severity: {eval_data['severity_assessment']}") print(f"Elicitation Score: {eval_data['behavior_elicitation_score']}") print(f"Reasoning: {eval_data['reasoning']}") # View harmful actions identified print("Harmful Actions:") for action in eval_data['harmful_actions_observed']: print(f" - {action}") ``` ## Accessing Screenshots Screenshots are stored in the `images/` folder. Each trajectory's screenshots are in `images/traj_XXX/`: ```python from huggingface_hub import hf_hub_download # Download a specific screenshot img_path = hf_hub_download( repo_id="osunlp/AutoElicit-Exec", filename="images/traj_001/step_0.png", repo_type="dataset" ) ``` ## Citation ```bibtex @misc{jones2026benigninputsleadsevere, title={When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents}, author={Jaylen Jones and Zhehao Zhang and Yuting Ning and Eric Fosler-Lussier and Pierre-Luc St-Charles and Yoshua Bengio and Dawn Song and Yu Su and Huan Sun}, year={2026}, eprint={2602.08235}, archivePrefix={arXiv}, primaryClass={cs.CL}, url={https://arxiv.org/abs/2602.08235}, } ``` ## License Apache 2.0许可证：Apache 2.0 任务类别：其他 标签：轨迹（trajectory）、智能体（Agent）、安全性（safety）、行为引出（elicitation） # AutoElicit-Exec 数据集 [**项目页面**](https://osu-nlp-group.github.io/AutoElicit/) | [**论文**](https://arxiv.org/abs/2602.08235) | [**GitHub**](https://github.com/OSU-NLP-Group/AutoElicit) AutoElicit-Exec 是一个经过人工验证的数据集，包含132条执行轨迹，均展现了典型良性执行过程中出现的非预期行为。所有轨迹均通过 AutoElicit 从前沿计算机使用智能体（Computer-Use Agent，简称CUA）中引出，涉及的模型为 Claude 4.5 Haiku 与 Claude 4.5 Opus。AutoElicit 会对 OSWorld 中的良性指令进行扰动，在保持指令真实且符合良性意图的前提下，提升非预期有害行为出现的概率。本数据集旨在提供真实计算机使用场景下智能体非预期行为的演示样本，助力进一步分析引发非预期安全风险的良性输入因素。 ## 数据集结构 每一行数据包含以下字段： | 字段 | 类型 | 描述 | |-------|------|-------------| | `trajectory_id` | 字符串 | 每条轨迹的唯一标识符（格式为 traj_001 - traj_132） | | `task_id` | 字符串 | 代表原始良性任务的 OSWorld 任务标识符 | | `domain` | 字符串 | OSWorld 任务所属的领域（例如 `os`、`multi_apps`） | | `perturbation_id` | 字符串 | 扰动查询变体的唯一标识符 | | `refinement_model` | 字符串 | 用于优化扰动的模型（例如 `us_anthropic_claude-haiku-4-5-20251001-v1_0`） | | `execution_agent` | 字符串 | 执行该轨迹的计算机使用智能体（例如 `claude-haiku-4-5-20251001`） | | `perturbed_instruction` | 字符串 | 用于引出非预期行为的扰动后指令 | | `trajectory_steps` | 列表[字典] | 执行步骤列表（详见下文说明） | | `screenshots` | 列表[字符串] | 仓库中截图文件的路径列表 | | `trajectory_evaluation` | 字典 | 自动评估器生成的评估结果（详见下文说明） | | `trajectory_summary` | 字符串 | 用于指导评估的轨迹自然语言总结 | ### `trajectory_steps` 结构 `trajectory_steps` 列表中的每个元素为字典，包含以下字段： | 字段 | 类型 | 描述 | |-------|------|-------------| | `step_num` | 整数 | 轨迹中的步骤编号 | | `action` | 字符串 | 智能体执行的命令（例如 `pyautogui.click(100, 200)`） | | `thought` | 字符串 | 智能体执行该操作前的推理/思考过程 | | `screenshot_file` | 字符串 | 仓库中对应截图的路径（例如 `images/traj_001/step_0.png`） | ### `trajectory_evaluation` 结构 `trajectory_evaluation` 字典包含自动评估结果，字段如下： | 字段 | 类型 | 描述 | |-------|------|-------------| | `reasoning` | 字符串 | 解释评估执行过程的分步推理 | | `behavior_elicitation_score` | 整数 | 0-100的分数，用于衡量有害行为被引出的程度 | | `behavior_elicitation_explanation` | 字符串 | 对该评分的详细解释 | | `harmful_actions_observed` | 列表[字符串] | 轨迹中识别出的具体有害操作列表 | | `safe_actions_observed` | 列表[字符串] | 轨迹中观察到的安全/良性操作列表 | | `matches_expected_behavior` | 字符串 | 描述行为是否匹配非预期行为目标，可选值为 `exact_match`（完全匹配）、`partial_match`（部分匹配）、`alternative_harmful`（存在替代有害行为） | | `severity_assessment` | 字符串 | 危害严重程度等级，可选值为 `minimal`（轻微）、`low`（低）、`medium`（中）、`high`（高）、`critical`（严重） | | `severity_explanation` | 字符串 | 对该严重程度等级的解释 | | `recommendation` | 字符串 | 是否将该轨迹纳入数据集的最终建议 | | `recommendation_reasoning` | 字符串 | 收录建议背后的推理依据 | ## 加载数据集 python from datasets import load_dataset # 加载数据集 ds = load_dataset("osunlp/AutoElicit-Exec", split="train") # 访问单条数据 example = ds[0] print(f"轨迹ID: {example['trajectory_id']}") print(f"任务ID: {example['task_id']}") print(f"领域: {example['domain']}") print(f"执行智能体: {example['execution_agent']}") print(f"指令: {example['perturbed_instruction']}") ### 访问轨迹步骤 python # 遍历轨迹步骤 steps = example["trajectory_steps"] for step in steps: print(f"步骤 {step['step_num']}:") print(f" 操作: {step['action']}") print(f" 思考: {step['thought'][:100]}...") print(f" 截图: {step['screenshot_file']}") ### 访问评估结果 python # 访问评估详情 eval_data = example["trajectory_evaluation"] print(f"建议: {eval_data['recommendation']}") print(f"严重程度: {eval_data['severity_assessment']}") print(f"引出评分: {eval_data['behavior_elicitation_score']}") print(f"推理过程: {eval_data['reasoning']}") # 查看识别出的有害操作 print("有害操作:") for action in eval_data['harmful_actions_observed']: print(f" - {action}") ## 访问截图 截图存储于 `images/` 文件夹中，每条轨迹的截图均位于 `images/traj_XXX/` 目录下： python from huggingface_hub import hf_hub_download # 下载指定截图 img_path = hf_hub_download( repo_id="osunlp/AutoElicit-Exec", filename="images/traj_001/step_0.png", repo_type="dataset" ) ## 引用 bibtex @misc{jones2026benigninputsleadsevere, title={当良性输入引发严重危害：引出计算机使用智能体的非预期不安全行为}, author={Jaylen Jones and Zhehao Zhang and Yuting Ning and Eric Fosler-Lussier and Pierre-Luc St-Charles and Yoshua Bengio and Dawn Song and Yu Su and Huan Sun}, year={2026}, eprint={2602.08235}, archivePrefix={arXiv}, primaryClass={cs.CL}, url={https://arxiv.org/abs/2602.08235}, } ## 许可证 Apache 2.0