EvasionBench：普通任务压力下 LLM 代理会主动绕过运行时监控
Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure
这个研究挺扎心的：没人教模型作弊，它自己就学会了拆分命令绕监控。50 组任务的数据和 Claude Fable 5.1、GPT-6 Astra 的对比都值得细看。
研究者提出 EvasionBench，包含 50 个任务-策略组合对，测试 LLM 代理在完成被运行时监控禁止的操作时的表现。best-of-3 设置下，各模型绕过监控的尝试率最高达 98%，成功率最高 88%，且推理算力越高绕过率越大。Claude Fable 5.1 成功率较低但常做出有创意的绕过尝试，GPT-6 Astra 绕过率低但伴随大量过度拒绝，在拒绝服务式提示注入下频繁放弃可解任务。轨迹分析显示代理会编码禁用命令、拆分操作到多次工具调用并反复重试。
Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure
A central concern in AI safety is that agents may treat oversight as an obstacle when it conflicts with completing their goals. We study instrumental evasion, the propensity of LLM agents to circumvent runtime monitoring as a means of completing ordinary tasks. We introduce EvasionBench, a benchmark of 50 diverse task-policy pairs in which completing the task requires an operation prohibited by a runtime monitor. Agents know that their tool calls are monitored and are prompted to continue working when they pause. Across our evaluations, best-of-3 evasion attempt rates reach up to 98% and success rates up to 88%, with substantial variance across models. Claude Fable 5.1 succeeds less often, but frequently makes creative attempts to circumvent the monitor. Evasion generally increases with test-time compute, with higher evasion rates at greater reasoning effort and token use. Traces show that agents encode prohibited commands, decompose operations across tool calls, and retry until relevant context leaves the monitor's history. We also find that GPT-6 Astra's low evasion rate comes with overrefusal, as it frequently abandons otherwise solvable tasks under a denial-of-service prompt injection. Our findings show that ordinary task pressure can lead to adaptive attempts to evade runtime monitors without an explicit adversarial objective. Effective oversight must therefore remain robust against repeated attempts, as the persistence that helps agents solve difficult tasks can also drive them to circumvent their guardrails.