LLM 解释器审计：GPT-4o 等三大后端为智能体错误行为流畅辩护
Triggers and Diagnostics for LLM-Based Interpretability Failures in Active Inference Agents
论文让 GPT-4o、Gemini 当智能体解释器，结果三家全把错误行为解释得头头是道。
论文把一个追踪德国电网需求并调节发电的 Active Inference (AIF) 智能体接上 GPT-4o、Claude-3-Opus、Gemini 三个解释器后端，用三种黑盒触发器攻击。每步向观测流注入 600 MW 偏差后，智能体后验偏移 490 MW（约电网容量的 0.9%），30 条解释没有一条按既定标准报告异常，全部流畅复述被污染的信念。在智能体做出客观错误动作的时间步上，三个后端以 80-95% 的比例（每家 n=20）给出迎合式合理化。观测元数据字段里的攻击者文本可引导解释器输出，三家敏感度不同，且三家都出现数据外泄。作者为每类失败提出缓解方案但未做评估，指出解释流畅且错误、无人校验真假，解释器测试应纳入智能体部署审计。
Triggers and Diagnostics for LLM-Based Interpretability Failures in Active Inference Agents
LLM explainers are increasingly attached to autonomous agents as runtime oversight, with operators reading a generated account of the agent's beliefs and actions rather than its internal state. We audit the account itself, pairing an Active Inference (AIF) agent that tracks German grid demand and adjusts generation with an LLM explainer on three backends (GPT-4o, Claude-3-Opus, Gemini), and probing the pair with three black-box triggers. Corrupting the observation stream by 600 MW per step moves the agent's posterior by 490 MW, roughly 0.9% of grid capacity. None of the 30 explanations produced during the injection flag anything under a stated rubric, and each narrates the corrupted belief fluently. On timesteps where the agent takes an objectively wrong action, all three explainers produce a sycophantic rationalization 80-95% of the time (n = 20 per backend). Attacker-controlled text in the observation metadata field steers the explainer, with susceptibility differing by provider and data exfiltration succeeding on all three. We propose mitigations for each failure but do not evaluate them. In every failure we observed, the explanation was fluent and wrong. Moreover, nothing in the explainer architecture checks whether an explanation is true before an operator acts on it. Testing the explainer therefore belongs in any audit of an agentic deployment.
