Language model agents defend enterprise boards against deception attempts
DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards
Artificial IntelligenceCryptography and Security
Summary
Sometimes groups using AI agents to check projects get tricked by false information hidden inside project files. The researchers created a test called DGF-Bench where AI agents act like a company's review board and try to spot lying or fake data planted by attackers. They measured how well different AI systems could avoid being fooled by these tricks and found that some attacks were very effective when they copied the company’s own rules falsely. The work helps understand how trustworthy these AI reviewers are in spotting deception in complex decision processes.
What this means in practice
- •For enterprise risk managers: Assess how AI governance boards resist sophisticated attempts to inject false information in project reviews.
- •For compliance software developers: Create tools that automatically verify enterprise projects against detailed rules while identifying deceptive evidence.$Commercial implications: This benchmark enables products that audit and secure AI-driven governance processes from manipulation, offering enhanced compliance guarantees.
Authors
Jeremy Canale
Abstract
Tool-using language-model agents can review enterprise projects as governance boards do: they read the evidence, apply written rules and decide whether the project may proceed. Part of that evidence comes from suppliers and project members with a stake in the decision. DGF-Bench is a benchmark in which a board of agents (specialist gates and a General gate that consolidates their decisions) reviews synthetic dossiers while an attacker plants deceptive content in evidence the organization does not vouch for. Dossiers are generated from canonical facts under 61 executable rules, with 42 authoritative records and 32 narrative documents; every gate is certified decidable from those records. Attacks never change an authoritative value, so an attacked dossier keeps the reference decisions of its clean copy. A success is attributable only when the agent receives the injection and takes the exact injected action, which it does not take on the paired clean dossier; the DGF score is the share of applicable fixed attacks a model blocks. Reading documents and records themselves, five of six models were outcome-strict (disposition, findings, actions and authorization all correct) on 82 to 85 of 85 gates. Over 2,622 attacked gate runs, seven direct-order, false-data and false-authority attacks obtained one attributable success against these five, whereas task-aligned attacks imitating the organization's own process passed against four of them: a record note citing a fake review procedure lowered GPT-6 Luna Pro from 34 to 6 outcome-strict gates and DeepSeek V4 Pro from 33 to 7. DGF scores ranged from 96.2 to 26.9, and a policy-aware adaptive attacker writing in records succeeded against five of six models. The approval tool executed no forged approval, yet deceived agents submitted approvals that the rules forbid. The open-source package dgf-bench computes the DGF score with one command.