inclusionAI/A3S-Bench

Agent3Sigma-Stage (A3S-Bench) 数据集是一个用于自主代理安全评估的框架数据集，旨在系统测量代理在多轮交互中抵抗攻击的能力以及完成合法任务的效用。数据集包含424个良性对话（种子）和726个对抗性注入。良性对话作为评估代理任务完成能力的基线；对抗性注入将攻击载荷嵌入良性对话中以评估安全防御能力。数据集覆盖10个安全风险类别，包括恶意技能安装、危险命令执行、内存篡改、信息泄漏、配置篡改、越狱攻击、数据外泄、权限提升、沙箱逃逸和资源耗尽，涉及6个真实世界使用场景。攻击方法包括直接注入、间接注入（工具返回投毒）和多轮渐进注入，并采用跨轮碎片化、检测范围规避和良性上下文隐藏等高级攻击策略。数据格式以JSON表示，种子包含ID、场景、风险类别、设置和对话轮次；注入变体包含种子ID、攻击技术、风险类别和注入标记。数据集用于在Docker容器隔离环境中进行端到端安全评估，结合多维度LLM-as-Judge自动评估（风险触发分类、一般安全评估、细粒度评分和输出可靠性评估），最终生成综合安全和效用的定量分数和可视化报告。The Agent3Sigma-Stage (A3S-Bench) dataset is a framework dataset designed for autonomous agent security evaluation, which aims to systematically measure agents’ resistance to adversarial attacks during multi-turn interactions and their utility in completing legitimate tasks. The dataset consists of 424 benign dialogues (seeds) and 726 adversarial injections. Benign dialogues act as the baseline for evaluating agents’ task completion performance, while adversarial injections embed attack payloads into benign dialogues to assess the effectiveness of security defense mechanisms. The dataset covers 10 security risk categories, including malicious skill installation, dangerous command execution, memory tampering, information leakage, configuration tampering, jailbreak attacks, data exfiltration, privilege escalation, sandbox escape, and resource exhaustion, involving 6 real-world application scenarios. Attack methods include direct injection, indirect injection (tool return poisoning), and multi-turn progressive injection, paired with advanced attack strategies such as cross-turn fragmentation, detection evasion, and benign context hiding. The data is formatted in JSON structure: seed entries contain ID, scenario, risk category, setup, and dialogue turns, while injection variants include seed ID, attack technique, risk category, and injection marker. The dataset is intended for end-to-end security evaluation in an isolated Docker container environment, combined with multi-dimensional LLM-as-Judge automatic evaluations covering risk trigger classification, general security assessment, fine-grained scoring, and output reliability assessment, ultimately generating quantitative scores and visual reports for comprehensive security and utility evaluation.