Benchmarking Jailbreak Guardrails for Embodied Agents
作者: Xunguang Wang, Qingyue Wang, Yuguang Zhou, Zongjie Li, Wenxuan Wang, Shuai Wang
分类: cs.AI
发布日期: 2026-10-05
💡 一句话要点
提出系统评估框架以优化具身智能体的安全防护
🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)
关键词: 具身智能体 越狱攻击 安全防护 评估框架 防御有效性 可用性 效率
📋 核心要点
- 现有的安全基准主要集中在评估具身智能体本身，未能有效验证防护措施的实际效果，导致安全性评估不足。
- 本文提出了一种可插拔的评估框架，将具身智能体视为固定后端，各防护措施作为可干预模块，比较其在不同阶段的表现。
- 实验结果显示，六种防护措施在防御有效性、可用性和效率之间存在明显权衡，未有单一防护措施在所有设置中表现最佳。
📝 摘要（中文）
具身智能体在物理环境中的应用日益增多，但其易受到越狱攻击，导致执行有害行为。现有的安全基准主要评估智能体本身，未能有效验证防护措施的实际效果。本文首次系统评估了具身智能体的越狱防护措施，构建了可插拔的评估框架，比较了六种代表性防护措施在防御有效性、可用性和效率等方面的表现，揭示了三者之间的权衡，并提供了设计防护措施的实用指导。
🔬 方法详解
问题定义：本文旨在解决具身智能体在物理环境中遭受越狱攻击的问题，现有方法未能有效评估防护措施的实际防御能力。
核心思路：通过构建一个可插拔的评估框架，比较不同防护措施在感知、规划和控制阶段的干预效果，以系统化评估其安全性。
技术框架：评估框架将具身智能体作为固定后端，各防护措施作为模块，进行模板化和自动化的越狱攻击测试，评估维度包括防御有效性、可用性和效率。
关键创新：首次系统性地评估了具身智能体的越狱防护措施，揭示了防护措施在不同干预阶段、决策机制和输入模态下的表现差异。
关键设计：实验中采用了六种代表性防护措施，评估指标包括绕过率、危险成功率、误报率和任务完成率等，确保评估的全面性和准确性。
🖼️ 关键图片
📊 实验亮点
实验结果显示，六种防护措施在防御有效性方面的绕过率和危险成功率存在显著差异，且在可用性和效率方面也表现出不同的特征，未有单一防护措施在所有设置中表现最佳，提供了设计防护措施的实用指导。
🎯 应用场景
该研究为具身智能体的安全防护提供了系统化的评估方法，具有广泛的应用潜力，尤其在机器人、自动驾驶和智能家居等领域，能够有效提升智能体的安全性和可靠性，减少潜在的物理伤害风险。
📄 摘要（原文）
Embodied agents powered by large language models and vision-language models are increasingly deployed in physical environments, but jailbreak attacks can induce these agents to perform physically harmful actions. A growing number of guardrail methods have been proposed to intercept dangerous behavior before it is executed, yet existing safety benchmarks evaluate the embodied models themselves, leaving it unclear how well these guardrails actually defend an embodied agent in practice. We present the first systematic evaluation of jailbreak guardrails for embodied agents. To compare guardrails under identical conditions, we build a pluggable evaluation framework that treats the embodied agent as a fixed backend and each guardrail as a module that can intervene at the perception, planning, or control stage. We subject six representative guardrails to template-based and automated jailbreak attacks as well as safe instructions, and assess them at the system level along three dimensions: defense effectiveness, measured by the bypass rate and the hazard success rate in the simulator; usability, measured by the false-positive rate and the task completion rate on safe instructions; and efficiency, measured by the latency overhead added at runtime. Experiments on guardrails that span different intervention stages, decision mechanisms, and input modalities reveal a clear trade-off among the three dimensions, and show that no single guardrail dominates in all settings. We further analyze how intervention stage, decision mechanism, and input modality shape safety outcomes, and we offer practical guidance for selecting and designing guardrails for embodied agents.