{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/agent-security-bench-asb-formalizing-and","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","arxiv_id":"2410.02644","date":"2024-10-03","proceeding":null,"authors":["Hanrong Zhang","Jingyuan Huang","Kai Mei","Yifei Yao","Zhenting Wang","Chenlu Zhan","Hongwei Wang","Yongfeng Zhang"],"abstract":"Although LLM-based agents, powered by Large Language Models (LLMs), can use external tools and memory mechanisms to solve complex real-world tasks, they may also introduce critical security vulnerabilities. However, the existing literature does not comprehensively evaluate attacks and defenses against LLM-based agents. To address this, we introduce Agent Security Bench (ASB), a comprehensive framework designed to formalize, benchmark, and evaluate the attacks and defenses of LLM-based agents, including 10 scenarios (e.g., e-commerce, autonomous driving, finance), 10 agents targeting the scenarios, over 400 tools, 27 different types of attack/defense methods, and 7 evaluation metrics. Based on ASB, we benchmark 10 prompt injection attacks, a memory poisoning attack, a novel Plan-of-Thought backdoor attack, 4 mixed attacks, and 11 corresponding defenses across 13 LLM backbones. Our benchmark results reveal critical vulnerabilities in different stages of agent operation, including system prompt, user prompt handling, tool usage, and memory retrieval, with the highest average attack success rate of 84.30\\%, but limited effectiveness shown in current defenses, unveiling important works to be done in terms of agent security for the community. We also introduce a new metric to evaluate the agents' capability to balance utility and security. Our code can be found at https://github.com/agiresearch/ASB.","url_abs":"https://arxiv.org/abs/2410.02644v4","url_pdf":"https://arxiv.org/pdf/2410.02644v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"agent-security-bench-asb-formalizing-and","repo_url":"https://github.com/agiresearch/asb","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"autonomous-driving","task_name":"Autonomous Driving"},{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"benchmarking","task_name":"Benchmarking"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2410.02644","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2410.02644"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/agiresearch/ASB","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/agiresearch/asb","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":4,"unverified":9},"by_repo_kind":{"official":{"samples":13,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"760fb2e1fce9b7b1","entry":"calculate_perplexities","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/threshold.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/threshold.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"760fb2e1fce9b7b1"}},{"code_sha256_prefix":"5dad87aa78c56e1b","entry":"check_attack_success","repo":"agiresearch/ASB","repo_kind":"official","path":"main_attacker.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/main_attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5dad87aa78c56e1b"}},{"code_sha256_prefix":"c3e3e3bfd5b68ace","entry":"check_original_success","repo":"agiresearch/ASB","repo_kind":"official","path":"main_attacker.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/main_attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c3e3e3bfd5b68ace"}},{"code_sha256_prefix":"becaa275502d6a0e","entry":"parse_plans","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/threshold.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/threshold.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"becaa275502d6a0e"}},{"code_sha256_prefix":"85a853d1af0b8444","entry":"evaluate_plans","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/llm_dection.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/llm_dection.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"85a853d1af0b8444"}},{"code_sha256_prefix":"708307030e0e3198","entry":"evaluate_plans","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/llm_utils.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/llm_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"708307030e0e3198"}},{"code_sha256_prefix":"0c3b4891805a8262","entry":"judge_response","repo":"agiresearch/ASB","repo_kind":"official","path":"main_attacker.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/main_attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0c3b4891805a8262"}},{"code_sha256_prefix":"faabedfe90d4f114","entry":"load_model_and_tokenizer","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/ppl_utils.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/ppl_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"faabedfe90d4f114"}},{"code_sha256_prefix":"64a56135a35ae0d4","entry":"ppl_evaluate_workflow","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/ppl_utils.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/ppl_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"64a56135a35ae0d4"}},{"code_sha256_prefix":"441fac1bb4bb4dab","entry":"process_log_clean","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/llm_dection.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/llm_dection.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"441fac1bb4bb4dab"}},{"code_sha256_prefix":"d1d83916b0534aaf","entry":"process_log_clean","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/ppl_dection.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/ppl_dection.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d1d83916b0534aaf"}},{"code_sha256_prefix":"44b5653b885b98ee","entry":"process_log_clean","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/threshold.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/threshold.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"44b5653b885b98ee"}},{"code_sha256_prefix":"33f024008fa1f944","entry":"process_log_memory","repo":"agiresearch/ASB","repo_kind":"official","path":"memory_defense/llm_dection.py","file_url":"https://github.com/agiresearch/ASB/blob/HEAD/memory_defense/llm_dection.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"33f024008fa1f944"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}