Source-linked AI summary
Auditing Self-Evolution in Financial Agents: Capability Gains, Security Drift, and Execution-Interface Mismatch
Jialong Li, Jialing Zhu
TL;DR
Self-evolving financial agents may improve task performance while altering security-relevant behavior, so accuracy alone is insufficient. This paper audits evolved artifacts through execution-grounded evaluation and state replay, finding capability gains accompanied by broader exposure and unauthorized state changes, with execution-interface mismatch creating a separate evaluation hazard.
Problem
The paper asks whether benign learning improves weak behaviors while preserving already-correct behavior and security in financial agents.
Method
The study audits three self-evolution methods using matched acquisition trajectories, sealed endpoints, execution-grounded checks, independent lineages, and paired regression metrics.
Results
Across three lineages, exposure and unauthorized state changes increase in all cases, while attack success increases in only two; ReasoningBank improves utility without increasing aggregate attack success.
Takeaways & Limitations
Financial-agent evolution should be audited for task regressions, attack-surface contact, unauthorized financial-state change, and execution-interface compatibility rather than accuracy alone.
Takeaways & Limitations
The study uses one primary executor in one simulated banking environment and three lineages, so its effect sizes should not be generalized to other models or production systems.
Abstract
from arXiv · showhide
Self-evolving agents turn experience into reusable skills, workflows, or memories, but post-evolution accuracy alone does not show whether learned behavior preserves previously correct behavior or security. We audit SkillOpt, Agent Workflow Memory (AWM), and ReasoningBank in simulated e-banking using matched benign acquisition trajectories, sealed evaluation endpoints, execution-grounded checks, and independent state replay. On Qwen 3.7 Flash, SkillOpt raises benign utility from 0.741 to 0.837 while exposure to injected content rises from 0.820 to 0.943. Conditional attack success after exposure falls from 0.605 to 0.562, yet overall attack success rate (ASR) rises from 0.496 to 0.530 and unauthorized financial state changes rise to 0.685. Across three independently evolved lineages, capability, exposure, and unauthorized-state changes increase in all three, whereas ASR increases in only two. ReasoningBank raises utility to 0.859 without increasing aggregate ASR, although unauthorized state changes remain slightly above Static. AWM reveals a separate evaluation hazard: a literal WebArena text-action envelope disrupts tool execution in our native function-calling executor. In a post-hoc sensitivity test, removing only that envelope restores utility from 0.319 to 0.756, while exposure rises from 0.299 to 0.909 and ASR from 0.195 to 0.575. Auditing self-evolving financial agents therefore requires tracking regressions, attack-surface contact, unauthorized financial-state change, and artifact-executor compatibility, not accuracy alone.
1 Introduction
Self-evolving financial agents can improve task completion while changing information exposure, tool invocation, and security outcomes. This section introduces an execution-grounded audit that evaluates capability gains and regressions, attack-surface contact, unauthorized financial-state changes, and executor-interface compatibility.
- Motivation: Reusable external state lets SkillOpt, AWM, and ReasoningBank retain skills, workflows, or reasoning memories from prior trajectories.SkillOpt edits a natural-language skill document; AWM induces workflows; ReasoningBank distils and retrieves reasoning memories.
- Motivation: Post-evolution accuracy alone misses changes in external information read and consequential tools invoked when useful and attacker-controlled instructions share an interaction surface.The concern is specific to financial agents, where task completion can improve while consequential behavior changes.
- Audit protocol: The audit measures W→C gains, C→W regressions, prompt-injection exposure, conditional attack success after exposure, total attack success, and unauthorized financial state changes.It evaluates the closed loop from learning rule and evolved artifact through executor behavior, interaction surface, and financial state.
- Study design: Three independently evolved lineages use byte-identical benign acquisition trajectories to compare SkillOpt, AWM, and ReasoningBank end to end under one primary executor.The systems differ in write eligibility, admission, update mechanism, state representation, and retrieval, so observed differences cannot be attributed to representation alone.
- Key findings: 9.6 percentage points of utility improvement for SkillOpt coincides with 12.3 points higher exposure and 10.2 points more unauthorized state changes.ReasoningBank improves utility by 11.9 points without increasing aggregate attack success; these effects are method-dependent and persist on families with unmodified official checkers.
- Evaluation hazard: A controlled AWM adaptation changes only an incompatible textual-action envelope while holding learned workflow content fixed, isolating executor-facing interface mismatch as a source of degradation.This post-hoc test distinguishes workflow-content effects from executor-interface effects.
2 Related Work
Prior work spans reusable-skill learning, misevolution risk, tool-using-agent security, and financial-language-model evaluation. This work complements those lines with a controlled, execution-grounded audit in a mutable banking environment.
- Learning from agent experience: SkillOS learns policies for curating reusable skills, while Shao et al. frame misevolution as risk across model, memory, tool, and workflow pathways.The paper complements this broader perspective with a controlled financial audit matching benign evidence across three external-state evolution systems.
- Security of tool-using agents: Agent Security Bench and Agent-SafetyBench evaluate security and safety risks in tool-using or interactive LLM agents, while Task Shield enforces task alignment during execution.These benchmarks primarily evaluate security under a fixed agent context.
- Financial LLMs and agents: FinanceBench, FinBen, PIXIU, and FinCon cover financial question answering, broad financial-language-model evaluation, domain-specific resources, and memory in financial multi-agent systems.The paper instead uses an execution-grounded setting with mutable account state and consequential tools through AgentDojo Banking.
3 Audit Protocol
The audit uses corrected task verification, matched intent-preserving variants, shared acquisition records, and independent evolved lineages to distinguish capability, security, and artifact effects. It reports benign regressions, exposure-conditioned attack success, and replay-based unauthorized state changes under a frozen evaluation protocol.
- Protocol validation: Four of sixteen official utility predicates failed adversarial-state validation before model calls.Each predicate was probed against ground truth, no-op, and applicable wrong-recipient, wrong-amount, wrong-output, and spurious-action states.
- Matched evaluation design: Six authored variants per task family preserve intent while separating acquisition, validation, and evaluation roles.Eleven families are seen, four unseen, and near-duplicate clusters are held out atomically.
- Lineage design: Three independently evolved lineages receive byte-identical 22-trajectory acquisition records across SkillOpt, AWM, and ReasoningBank within each lineage.Across lineages, acquisition records differ, so endpoint results include acquisition, evolution, and hosted-inference variability.
- Outcome definitions: Benign utility is reported through W→C, C→W, C→C, and W→W transitions against matched Static runs rather than as a net score alone.The design pairs each evolved instance with Static on the identical lineage, family, and variant.
- Security measures: Exposure and conditional ASR are reported separately from ASR, with empirical factorization exact because unexposed episodes had 0/579 attack successes.Exposure measures attacker-content contact, while conditional ASR measures compliance after exposure.
- Security measures: Unauthorized state change is determined by replaying benign ground truth from the same pre-state and comparing the authorized post-state with the observed terminal state.The comparison covers unauthorized transfers, recipient substitutions, amount manipulation, payment modifications, and account/password changes.
4 Results
Self-evolution improves benign utility but can expand exposure and unauthorized financial-state changes, with security effects varying by method and lineage. Evaluation also shows that execution-interface mismatch can make apparent capability and security outcomes misleading.
- Capability: 0.837 utility for SkillOpt and 0.859 for ReasoningBank exceed Static’s 0.741, but transition tables show both gains and regressions.SkillOpt changes 23 previously wrong instances to correct and 10 previously correct instances to wrong; ReasoningBank changes 25 and 9, respectively.
- SkillOpt security drift: 0.943 exposure and 0.685 unauthorized state change accompany SkillOpt’s evolution from Static, while total ASR rises to 0.530 despite conditional ASR falling to 0.562.Exposure increases from 0.820, unauthorized state change from 0.583, total ASR from 0.496, and conditional ASR decreases from 0.605.
- Method dependence: 0.802 exposure and 0.474 aggregate ASR make ReasoningBank a contrast to SkillOpt, although unauthorized state change remains slightly above Static at 0.595 versus 0.583.ReasoningBank’s utility gain is larger at +11.9 points, while aggregate ASR changes by −2.2 points.
- Lineage variability: SkillOpt’s capability, exposure, and unauthorized-state increases hold across all three lineages, but its ASR increase does not, spanning −7.4 to +10.4 percentage points.The pooled ASR shift is +3.4 points, while one lineage decreases by 7.4 points; ReasoningBank is directionally consistent on both reported quantities in 3/3 lineages.
- Execution-interface compatibility: 0.319 utility and 0.195 ASR for AWM-LiteralPort reflect interface-induced inactivity: removing tags restores utility to 0.756 and raises ASR to 0.575.The same change raises exposure from 0.299 to 0.909 and unauthorized state change from 0.217 to 0.714; textual-action emission falls to zero.
5 Discussion
The audit identifies exposure drift, failure persistence, and execution-interface mismatch—phenomena that post-evolution accuracy alone cannot diagnose. Together, they support evaluating self-evolving agents as closed loops rather than accuracy endpoints, while remaining observations from one audit rather than a universal taxonomy.
- Audit perspective: These three phenomena complement evidence that self-evolving agents can acquire unintended risks and are not diagnosed by post-evolution accuracy alone.The paper presents them as observations from one audit, not a universal taxonomy.
- Exposure drift: Exposure drift pairs higher benign utility and attacker-controlled-content contact with lower aggregate conditional susceptibility, while pooled ASR can obscure exposure and unauthorized-state shifts.For SkillOpt, reporting only accuracy or aggregate ASR misses distinct changes in exposure and unauthorized state.
- Failure persistence: Every observed ReasoningBank persistent-failure case followed retrieval of a failure-derived memory, although this association is confounded with task difficulty.The finding makes memory provenance and write eligibility explicit audit targets without establishing causation.
- Execution-interface mismatch: An artifact learned under one action representation can be incompatible with the deployment executor, making inactivity appear simultaneously as capability failure and improved security.This mismatch is especially salient in evolve-then-deploy because the artifact itself is part of the interface.
6 Limitations
The study’s limitations constrain generalization, causal interpretation, and claims about evolution over time. Comparisons among evolution systems also reflect multiple jointly varying design choices rather than representation alone.
- Scope and generalizability: The study uses one primary executor in one simulated banking environment, three lineages, and no statistical-significance claims, limiting generalization to other models or production systems.Evolution consists of one offline benign pass, so the study does not address multi-round dynamics or progressive degradation.
- Scope and generalizability: Post-hoc selection of AWM-InterfaceAdapted and the DeepSeek transfer check limits the interpretability of those sensitivity analyses.The passage also notes that the DeepSeek transfer check is additionally limited by an incomplete stated qualification.
- Measurement and causal limits: Exposure depends on executor behavior and model-visible reads, while imperfect placebo length matching makes placebo contrasts sensitivity checks rather than causal estimates.ReasoningBank also uses an adapted embedding substrate, and v3 couples sampling noise across benign and attacked endpoints.
- System comparison: End-to-end differences among the three evolution systems cannot be attributed to representation alone because write eligibility, admission, updates, state representation, and retrieval all differ jointly.The limitation concerns the systems’ combined design differences rather than any single component.
7 Conclusion
The conclusion finds that benign self-evolution can improve utility while worsening attack exposure and unauthorized financial-state change, so accuracy gains alone do not establish safe improvement. It also identifies heterogeneous attack-success effects across lineages and execution incompatibility as additional audit concerns.
- Conclusion: 9.6 points of utility gain coincided with 12.3 points more attack exposure and 10.2 points more unauthorized financial state change.These increases were positive in all three independently evolved lineages.
- Conclusion: Attack-success delta was positive in only two of three independently evolved lineages despite consistent increases in utility, exposure, and unauthorized state change.The conclusion therefore distinguishes attack-success outcomes from broader security regressions.
- Conclusion: An artifact incompatible with the execution environment exposed a separate evaluation concern beyond capability and security outcomes.The passage presents this as a distinct finding from the evolved systems’ utility and attack metrics.