Technology Category
Machine Learning: Large Multimodal Models (LMMs)Natural Language Processing: Safety and RobustnessComputer Vision: Large Vision Models
Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security
🤖 AI Summary
Native code interpreters integrated into large language models (LLMs) introduce critical system-level security risks—particularly resource exhaustion attacks (e.g., CPU, memory, disk). Method: We propose CIRCLE, the first interpreter-layer security benchmark, comprising 1,260 test cases covering diverse resource exhaustion scenarios. It innovatively categorizes prompts into explicit malicious and indirect social-engineering variants, and employs automated, execution-based detection of resource exhaustion, code simplification, response refusal, and timeout behaviors. Contribution/Results: Evaluating seven leading commercial LLMs (OpenAI and Google), we find substantial disparities in defense efficacy—e.g., o4-mini rejects 7.1% of malicious prompts versus only 0.5% for GPT-4.1—and demonstrate that indirect prompts drastically undermine existing safeguards. Our findings expose severe deficiencies in current production LLM interpreter security mechanisms, underscoring an urgent need for dedicated security standards and robust mitigation tools.
Technology Category
Application Category
📝 Abstract
As large language models (LLMs) increasingly integrate native code interpreters, they enable powerful real-time execution capabilities, substantially expanding their utility. However, such integrations introduce potential system-level cybersecurity threats, fundamentally different from prompt-based vulnerabilities. To systematically evaluate these interpreter-specific risks, we propose CIRCLE (Code-Interpreter Resilience Check for LLM Exploits), a simple benchmark comprising 1,260 prompts targeting CPU, memory, and disk resource exhaustion. Each risk category includes explicitly malicious ("direct") and plausibly benign ("indirect") prompt variants. Our automated evaluation framework assesses not only whether LLMs refuse or generates risky code, but also executes the generated code within the interpreter environment to evaluate code correctness, simplifications made by the LLM to make the code safe, or execution timeouts. Evaluating 7 commercially available models from OpenAI and Google, we uncover significant and inconsistent vulnerabilities. For instance, evaluations show substantial disparities even within providers - OpenAI's o4-mini correctly refuses risky requests at 7.1%, notably higher rates compared to GPT-4.1 at 0.5%. Results particularly underscore that indirect, socially-engineered prompts substantially weaken model defenses. This highlights an urgent need for interpreter-specific cybersecurity benchmarks, dedicated mitigation tools (e.g., guardrails), and clear industry standards to guide safe and responsible deployment of LLM interpreter integrations. The benchmark dataset and evaluation code are publicly released to foster further research.
Problem
Research questions and friction points this paper is trying to address.
Evaluating LLM code interpreter cybersecurity risks systematically
Assessing resource exhaustion vulnerabilities in CPU, memory, disk
Identifying inconsistent model defenses against malicious indirect prompts
Innovation
Methods, ideas, or system contributions that make the work stand out.
CIRCLE benchmark for LLM interpreter security
Automated code execution risk evaluation framework
Public release of dataset and evaluation code
🔎 Similar Papers
No similar papers found.
