Research map / Multi-agent systems and games / LLM agents
CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack Scenarios
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces CyBiasBench, a 630-session web-exploitation benchmark showing five LLM agents (Claude, Kimi, GLM, Codex, Gemini) have stable, agent-specific attack-family selection biases that decouple from attack success, and that explicit steering shows "bias momentum".
Problem
LLM agents used for offensive cybersecurity may concentrate attempts on narrow attack families regardless of prompt; existing outcome-only benchmarks (ASR) do not capture this allocation behavior.
Approach
Quantify attack-family selection bias of LLM agents via deterministic HTTP-level classification (OWASP CRS plus CAPEC/CWE/WSTG rules) across prompt conditions, and test how explicit steering interacts with free-choice bias ("bias momentum").
Key results
- Codex and Claude/Kimi remain broad in attack-family allocation while Codex and Gemini are most concentrated (Selection CR1 50.7% and 66.6%); Codex has lowest mean session ASR (0.213).
- Compliance with bias injection correlates with free-choice selection rate (rho=+0.529) but not with per-family ASR (rho=-0.248, n.s. under Bonferroni).
- Explicit steering lowers mean session ASR for all five agents, ranging from -0.008 (GLM) to -0.136 (Gemini).
Surprising findings
- Frequently selected attack families do not guarantee higher attack success; selection patterns decouple from per-family ASR for all agents.
- Explicit steering toward a requested family lowers session ASR for all agents rather than improving attack performance.
Limitations
- Results limited to a standardized web-exploitation environment with three targets and five agents; not stable model rankings.
- Cannot identify whether bias momentum originates from training, post-training, prompting, or execution environment.
- Classifier is rule-based and may miss attack-shaped requests; deserialization label excluded from analysis.
Experimental setup
Datasets: Juice Shop MLflow 2.9.2 Vuln-Shop
Benchmarks: CyBiasBench
Metrics: Shannon entropy selection rate attack success rate per-family ASR tokens per success prompt-stability JSD compliance Spearman correlation
Builds on: OWASP CRS Cybench CVE-Bench BountyBench PentestGPT
Closest papers by meaning
- Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models (ICLR 2025 · similarity 0.89)
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.88)
- CVE-Bench: A Benchmark for AI Agents’ Ability to Exploit Real-World Web Application Vulnerabilities (ICML 2025 · similarity 0.87)
- When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.87)
- SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.86)
- Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security (NeurIPS 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.