DUMA-Bench: A Dual-Control Multi-Agent Benchmark for Evaluating LLM Agent Security

Ivan Aleksandrov; German Kochnev; Sabrina Sadiekh; Yaroslav Rogoza

cs.AISep 21, 2026

DUMA-Bench: A Dual-Control Multi-Agent Benchmark for Evaluating LLM Agent Security

Authors: Ivan Aleksandrov, German Kochnev, Sabrina Sadiekh, Yaroslav Rogoza

Organizations: AI Security Lab, ITMO University · Hive Trace Lab · Independent Researcher

Abstract

LLM-based agents increasingly operate in environments where they interact with users, tools, and external systems. Yet most security evaluations assume passive users and static control, ignoring the interactive dynamics that shape real agent behavior. We introduce DUMA-Bench, a benchmark and evaluation protocol for measuring agent security under dual-control interaction, where both the agent and the user can influence the shared environment state. DUMA-Bench extends $τ^2$ -bench ~\cite{barres2025tau} with adversarial environments covering eight vulnerability classes, including RAG poisoning, cross-agent manipulation, and unsafe output handling. We evaluate 14 models from five model families (OpenAI, Anthropic, DeepSeek, Qwen, and Z.ai) across eight domains and multiple user-behavior regimes. Across our experiments, introducing dual-control interaction increases the attack success rate from 26.9% to 41.1%. These results show that agent security is not solely a property of the model but emerges from the interaction between the model, the user, and the environment. DUMA-Bench provides a missing evaluation layer for studying security in realistic agent deployments.

Figures & tables

Panel of Figure 1 — Figure 1: Comparison of evaluation regimes in DUMA-Bench. Top: Solo (no-user) evaluation, where the agent interacts directly with the environment without an active user participant. Bottom: Dual-control evaluation, where the agent and the user simulator jointly shape the interaction trajectory.

Mode	Trials	Successes	Passˆ1	ASR
S	1960	1432	0.731	0.269
D	1960	1154	0.589	0.411

Table 1: Aggregate robustness under passive-user (solo, S ) and dual-control ( D ) evaluation across all models and domains. ASR denotes the attack success rate.

Domain	S ASR	D ASR	$\Delta$ ASR
mktg_phishing	0.022	0.615	+0.593
collab	0.043	0.249	+0.206
crm_leak	0.056	0.249	+0.193
tool_s_poison	0.111	0.264	+0.153
auth_s_support	0.040	0.169	+0.129
output_handling	0.409	0.484	+0.075

Table 2: Domain-level attack success rate (ASR) under passive-user (Solo) and dual-control evaluation.

\Delta

ASR denotes the change in attack success rate when moving to dual-control interaction.

User T	Trials	Successes	Passˆ1	ASR
0.0	1575	1127	0.716	0.284
0.5	1575	1133	0.719	0.281
1.0	1575	1150	0.730	0.270

Table 3: Aggregate robustness across user temperature settings. ASR denotes attack success rate.

Model	Solo ASR	Dual ASR	$\Delta$ ASR
Claude Haiku 4.5	0.079	0.121	+0.042
Claude Opus 4.5	0.071	0.164	+0.093
Claude Sonnet 4.5	0.050	0.086	+0.036
GPT-4.1	0.336	0.386	+0.050
GPT-4.1-mini	0.293	0.357	+0.064
GPT-4o	0.314	0.393	+0.079

Table 4: Attack success rate (ASR) for each model under passive-user (Solo) and dual-control evaluation.

\Delta

ASR denotes the change in attack success rate when moving to dual-control interaction.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Tasks	Attack vector	Tools / mutable state	User role	Solo	Assertion basis	Assertion counts
mail_rag_phishing	7	RAG poisoning through retrieved email/SOP content	Mailbox, retrieval context, email-sending tools	Corporate operator	Yes	Environment; communication where leakage is textual	State/comm.
collab	6	Cross-agent manipulation through poisoned collaborator notes	Support tickets, collaborator messages, work-item state	Support operator	Yes	Environment; communication where required	State/comm.
output_handling	3	Unsafe downstream output such as XSS, redirects, or SQL-like payloads	Web-support tickets, rendered outputs, response channel	Support user	Yes	Environment; communication where required	State/comm.
crm_leak	4	Trusted-data oversharing from restricted CRM bundles	CRM records, case files, protected fields	Operator / customer	Yes	Environment; communication for protected-field disclosure	State/comm.
infra_loadshed	5	Infrastructure manipulation and quota/resource abuse	Compute controls, burst quotas, API-call budget	SRE / operator	Yes	Environment	State
mktg_phishing	3	Phishing-style campaign abuse through unapproved external domains	Campaign manager, recipient/domain policy, email tools	Marketing operator	Yes	Environment; communication where required	State/comm.

Appendix

Table 5: Domain-level characterization of DUMA-Bench. Tasks are executable multi-turn scenarios rather than prompt-only items. All 35 tasks include deterministic environment assertions in the reward basis, and 9 tasks additionally use natural-language communication assertions when the relevant violation is only visible in the assistant’s textual behavior.

Vendor	Models
OpenAI	GPT-5, GPT-5-mini, GPT-5-nano, GPT-4o, GPT-4o-mini, GPT-4.1, GPT-4.1-mini
Anthropic	Claude Opus 4.5, Claude Sonnet 4.5, Claude Haiku 4.5
DeepSeek	DeepSeek V3.2
Qwen	Qwen3.5-Plus, Qwen3.5-Flash
Z.ai	GLM-4.7

Appendix

Table 6: Model families evaluated in the benchmark.

Vendor	Models
OpenAI	GPT-4.1, GPT-4.1-mini, GPT-4o, GPT-4o-mini
Anthropic	Claude Sonnet 4.5, Claude Haiku 4.5
DeepSeek	DeepSeek V3.2
Qwen	Qwen3.5-Plus
Z.ai	GLM-4.7

Appendix

Table 7: Agent models included in the temperature-sensitivity analysis.

Domain	p ˆ 1	p ˆ 2	p ˆ 3	p ˆ 4	p ˆ 5
AUTH	0.946	0.916	0.896	0.881	0.870
COLL	0.912	0.867	0.835	0.812	0.794
CRM	0.881	0.821	0.785	0.760	0.743
INFRA	0.584	0.497	0.450	0.420	0.399
RAG	0.515	0.476	0.454	0.439	0.429
MKTG	0.580	0.512	0.480	0.460	0.448

Appendix

Table 8: Pass ˆ k by security domain (dual-control, averaged over all user temperatures). Domain abbreviations: AUTH = auth_spoof_support, COLL = collab, CRM = crm_leak, INFRA = infra_loadshed, RAG = mail_rag_phishing, MKTG = mktg_phishing, OUT = output_handling, TOOL = tool_shadow_poison.

Model	MKTG	COLL	CRM	TOOL	AUTH	OUT	INFRA	RAG
GPT-5	+++	++	++	++	+	++	+	+
GPT-5-mini	+++	+++	++	++	+	++	+	+
GPT-5-nano	+++	+++	+++	++	+	++	+	+
DeepSeek V3.2	+	+	+	0	0	0	+	–

Appendix

Table 9: Qualitative model-domain diagnostic for selected model-level shifts. Symbols summarize the direction and approximate magnitude of the solo-to-dual ASR change in inspected trajectories: +++ large increase, ++ moderate increase, + small increase, 0 approximately stable, and – decrease. Domain abbreviations follow Table 8.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 330 papers

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
Feb 18, 2026Tanqiu Jiang, Yuhui Wang, Jiacheng Liang +1LLM Agent Security AI Agent Security Benchmarks
Department of Computer Science, Stony Brook University, Stony Brook, USA.
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany
SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents
Jun 16, 2026Yuchuan Tian, Mengyu Zheng, Haocheng Mei +5LLM Safety Benchmarks LLM Agent Security
Peking University · Beijing Jiaotong University · SUIBE +2

Feb 18, 2026J/K move · Enter open · S save

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Tanqiu Jiang, Yuhui Wang, Jiacheng Liang, Ting Wang

Department of Computer Science, Stony Brook University, Stony Brook, USA.

LLM Agent Security AI Agent Security Benchmarks Long-Horizon Agent Evaluation

Open paper AskPDF arXiv

LLM agents are increasingly deployed in long-horizon, complex environments to solve challenging problems, but this expansion exposes them to long-horizon attacks that exploit multi-turn user-agent-environment interactions to achieve objectives infeasible in single-turn settings. To measure agent vulnerabilities to such risks, we present AgentLAB, the first benchmark dedicated to evaluating LLM agent susceptibility to adaptive, long-horizon attacks. Currently, AgentLAB supports five novel attack types including intent hijacking, tool chaining, task injection, objective drifting, and memory poisoning, spanning 28 realistic agentic environments, and 644 security test cases. Leveraging AgentLAB, we evaluate representative LLM agents and find that they remain highly susceptible to long-horizon attacks; moreover, defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats. We anticipate that AgentLAB will serve as a valuable benchmark for tracking progress on securing LLM agents in practical settings. The benchmark is publicly available at https://tanqiujiang.github.io/AgentLAB_main.

Abstract

LLM Agent Security

Explore similar work

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents