FraudBench: Stress-Testing Policy-Grounded Banking Agents Against Adaptive Fraud FraudBench：针对自适应欺诈的政策驱动银行智能体压力测试

TL;DR

• FraudBench is an executable benchmark designed to stress-test policy-grounded banking agents against adaptive fraud scenarios that manipulate identity, authorization, and trust over multi-turn conversations
• Built on the τ²-bench dual-control framework and τ-Knowledge banking environment, it features 150 adversarial scenarios with a frozen public set of 107 tasks (90 across ten fraud mechanisms plus 17 chained adaptive attacks) and 43 held-out chained attacks
• The benchmark introduces history-dependent safety evaluation, where adaptive attacks exploit earlier probes, admissions, or failed attempts to make later locally-valid requests unsafe
• Preliminary evaluation of four agents achieved attack-security rates between 49% and 65%, with money-mule and first-party fraud identified as the most common cross-model weaknesses
• The benchmark exposes a 698-document internal policy corpus that agents must retrieve from, testing both tool-use capabilities and policy compliance simultaneously

Why It Matters

This benchmark addresses a critical gap in AI safety evaluation: existing financial-fraud benchmarks only classify static transactions, while general agent-safety benchmarks target prompt injection, leaving conversational banking agents untested against realistic adaptive fraud. As AI agents gain tool access to sensitive financial operations, FraudBench provides the first executable framework for evaluating whether agents can safely act when callers manipulate identity and authorization over extended dialogues.

Technical Details

• Framework: Built on the τ²-bench dual-control framework and τ-Knowledge banking environment, where both the agent and simulated caller act through tools over shared, mutable account state
• Dataset: 150 authored adversarial scenarios; 107 graded tasks (90 across ten fraud mechanisms + 17 chained adaptive attacks) used for reported runs, with 43 chained attacks held out
• Policy Corpus: 698 internal banking policy documents that agents must retrieve and reference, testing policy-grounded decision-making under adversarial conditions
• Safety Design: History-dependent safety evaluation where single-control tasks satisfy every precondition but one, and chained adaptive attacks exploit conversational context from earlier interactions
• Annotations: Each scenario includes observable evidence, prohibited actions, safe dispositions, and intervention points for structured evaluation

Industry Insight

• Financial institutions deploying conversational AI agents must prioritize testing against adaptive, multi-turn fraud scenarios rather than relying on static transaction classification benchmarks
• The 35-51% attack failure rate across current agents indicates a significant safety gap; money-mule and first-party fraud vectors should be primary focus areas for agent hardening
• The dual-control framework and history-dependent safety approach should inform the development of evaluation standards for any AI system with tool access to sensitive user data

TL;DR

• 提出FraudBench基准测试，用于评估政策驱动的银行Agent在面对适应性欺诈时的安全性
• 基于τ²-bench双控制框架和τ-Knowledge银行环境构建，支持Agent与模拟调用者通过工具在共享可变账户状态上交互
• 包含150个对抗性场景（107个公开测试集），涵盖10种欺诈机制和链式适应性攻击，安全性具有历史依赖性
• 初步评估显示当前Agent的攻击防御率仅49%-65%，资金洗钱和第一方欺诈是最普遍的跨模型弱点

为什么值得看

现有金融欺诈基准仅分类静态交易或消息，通用Agent安全基准仅针对提示注入，而FraudBench首次测试了银行Agent在对话中面对身份、授权和信任操纵时的实际安全性。这对AI从业者和金融机构部署具备工具调用能力的对话Agent具有重要参考价值。

技术解析

FraudBench基于τ²-bench双控制框架和τ-Knowledge银行环境构建，Agent和模拟调用者均通过工具在共享可变账户状态上交互，Agent可授予调用者对选定工具的部分访问权限。环境暴露698份内部政策文档供Agent检索，测试集包含150个对抗性场景，其中107个公开（90个跨10种欺诈机制加17个链式适应性攻击），43个链式攻击作为保留集。安全性具有历史依赖性：单控制任务满足所有前提条件但存在漏洞，适应性攻击使后续局部有效的请求因之前的探测、承认或失败尝试而变得不安全。每个场景均标注可观察证据、禁止操作、安全处置和干预点。初步评估在107个分级任务上测试4个Agent，攻击防御率在49%-65%之间。

行业启示

金融机构在部署对话式Agent处理敏感操作前，必须采用类似FraudBench的对抗性测试框架验证安全性，而非仅依赖静态交易分类或通用安全基准。Agent安全需要历史感知的上下文理解能力，因为适应性攻击会利用对话历史中的漏洞。当前Agent在资金洗钱和第一方欺诈场景中的普遍弱点表明，需要针对这些高风险场景进行专门的防御训练和策略优化。