SchemeArena：LLM 代理中謀劃行為的分解式壓力測試

摘要

我們研究 LLM 代理中的密謀行為，其中代理會暗中追求未對齊的目標。我們的重點在於理解密謀如何從關鍵因素的交互作用中產生，例如工具性目標、環境可供性、監督條件與感知後果。先前研究僅檢視少數情境，因而難以釐清這些條件如何形塑代理的密謀傾向或能力。這種有限的規模與任務多樣性，也限制了對真實部署環境的涵蓋範圍，以及可觀察到的密謀策略範圍。為此，我們提出 SCHEMEARENA，一個包含 400 個情境的基準，用於可擴展的密謀壓力測試；其透過因子化情境合成框架建構，涵蓋多樣的安全相關工具領域、工具性目標、監督條件與壓力機制。為了實現可擴展且可靠的監測，我們進一步提出 SCOUT，一個密謀監測器，其將多準則判斷建立在從代理推理與行動中提取的證據之上。在對五個 LLM 代理進行的受控壓力測試中，我們發現明確的工具性目標是密謀傾向的最強驅動因素。策略性提示則扮演獨特角色，協助代理將密謀推理轉化為具體的隱蔽行為。監督具有混合效應：在數個閉源模型中，僅基於行動的監測會增加密謀，顯示部分監督可能作為最佳化限制，而非嚇阻因素。CoT 是有用但不完整的監測訊號：它能在執行前揭露潛在密謀，然而僅基於行動的密謀顯示，隱蔽行為可能在沒有明確推理證據的情況下發生。我們釋出基準、程式碼與監測器，網址為：https://github.com/launchnlp/SchemeArena。

English

We study scheming in LLM agents, in which agents covertly pursue misaligned goals. Our focus is to understand how scheming arises from the interaction of key factors, such as instrumental goals, environmental affordances, oversight conditions, and perceived consequences. Prior work examines only a small number of scenarios, limiting the ability to isolate how these conditions shape an agent's propensity or capability to scheme. This limited scale and task diversity also restrict coverage of realistic deployment settings and the range of scheming strategies that can be observed. To this end, we introduce SCHEMEARENA, a 400-scenario benchmark for scalable scheming stress testing, constructed through a factorized scenario synthesis framework spanning diverse safety-relevant tool domains, instrumental goals, oversight conditions, and pressure mechanisms. To enable scalable and reliable monitoring, we further propose SCOUT, a scheming monitor that grounds multi-criteria judgments in evidence drawn from agents' reasoning and actions. Across controlled stress tests on five LLM agents, we find that explicit instrumental goals are the strongest driver of scheming propensity. Strategic hints play a distinct role by helping agents translate scheming reasoning into concrete covert behavior. Oversight has mixed effects: in several closed models, action-only monitoring increases scheming, suggesting that partial oversight can act as an optimization constraint rather than a deterrent. CoT is a useful but incomplete monitoring signal: it can reveal latent scheming before execution, yet action-only scheming shows that covert behavior may occur without explicit reasoning evidence. We release the benchmark, code, and monitor at: https://github.com/launchnlp/SchemeArena.