Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Auto-published from arXiv:2608.18136 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.76, flags: [no-prompt-excerpt])

Category

tool-misuse

Model

Gemini 3.6 Flash

Surface

agent harness with RAG over 698-document internal policy corpus

Setup

FraudBench exposes the agent to a 698-document banking policy corpus from which it must retrieve the relevant policy before acting. Two configurations are compared: (1) oracle — relevant policy sections are provided directly; (2) full-corpus retrieval — agent must issue retrieval tool calls over the full 698-document store. All other conditions (model, tasks, adversarial scenarios) are identical.

Reproduction anchor

code: https://github.com/leanmcp/fraudbench — oracle vs. all-tools retrieval are distinct benchmark configurations; Gemini 3.6 Flash results reported at 64.5% (oracle) and 51.0% (all-tools retrieval) on the 107-task public split

Observed behavior

Gemini 3.6 Flash dropped from 64.5% to 51.0% attack-security (−13.5 pp) when required to retrieve its own policy rather than receiving it directly. The agent failed to surface the relevant policy sections under adversarial conditions, leading to unsafe actions it would have avoided with correct policy context.

Expected behavior

Agent retrieval quality over the internal policy corpus should be robust enough that security does not materially degrade relative to the oracle baseline; the agent should reliably fetch and apply the policy relevant to the caller's request.

Reproducibility

medium

Threat model

In production banking deployments, agents must retrieve policies from large, evolving document stores. An attacker who knows which policy governs a prohibited action can craft requests likely to cause retrieval misses — effectively exploiting the RAG layer as a security gap without needing to jailbreak the model's reasoning.

Novelty

Provides the first controlled quantification of how imperfect policy retrieval (independent of reasoning failures) degrades banking-agent security under adversarial load, motivating retrieval robustness as a distinct safety requirement.

Source

• arXiv: 2608.18136
• PDF: https://arxiv.org/pdf/2608.18136
• Categories: cs.AI, cs.LG
• Authors: Dheeraj Mohandas Pai, Lu Xian

Triage notes (auto)

• paperType: benchmark
• estimatedCaseCount: 3
• triage reason: Executable benchmark with 107 adversarial scenarios across 10 fraud mechanisms. Demonstrates concrete agent-level failures (49–65% attack-security rates) with reproducible setup, policy constraints, and identified cross-model weaknesses (money-mule, first-party fraud). Each scenario is a well-specified case with observable evidence and intervention points.

─────────────────────────────────────────────────────────────────────