Can action-level metrics alone expose contained attacks?

The abstract lists the Judgment Bypass Rate as one of the paper's three contributions, defined as a measure of "compromise at the attacked agent rather than at the final action." The reason for adding it shows up in the results: "Because UAR is 0% for most defended conditions, we focus on FPR, LTC, F1, and JBR." Once a defense sits at the Executor, the Unsafe Action Rate is at its floor for nearly every defended condition and stops separating them. JBR reads a different location, the agent the attack was aimed at, so it can still vary when UAR cannot.

The pair gives four cells, and the paper's headline sits in one of them: JBR at 100 percent with UAR at 0 percent (Can memory poisoning compromise decision-making even with authorization layers?). My reading, following from the definitions and not stated in the excerpt: UAR at 0 with JBR at 0 would mean the attack never took hold, while UAR at 0 with JBR at 100 means it took hold completely and was contained. The action-level number is identical in the two, and the situations differ in what they demand of an operator. In the second, the pipeline's safety rests entirely on the boundary, so a hole in it leaves nothing behind it, since the reviewer has already been shown to give way.

This belongs to the same family as Where do safety wins come from in multi-agent systems?: an outcome number that does not say which layer acted. That note attributes blocks to a layer after the fact, and JBR adds a reading taken at the agent inside the pipeline. It is also an instance of what What blocks rigorous security evaluation of multi-agent systems? calls for under diagnostic metrics: a number that says where a failure happened and not only whether one did.

Two notes from other papers state the same coarseness from the boundary-crossing and the exploitation side, and each already cites this one. What behaviors hide behind a zero crossing rate? finds that a crossing rate of zero fits four different behaviors once the route is closed, so the one rate cannot say what the agent did. Does arbitrary code execution alone capture exploit progress? is the attacker-side counterpart: a score read only at code execution treats a stalled attempt and one that stopped a rung short as the same, and on the vault's mapping a reading at an intermediate primitive would play the part the Judgment Bypass Rate plays here. Neither of those excerpts measures such a second reading, and both pairings are the vault's.

What the excerpt does not give: how compromise at the agent is scored (whether an emitted forged approval is the criterion, or something else), whether JBR is defined for the injection attack as well as memory poisoning, and how it should be compared across pipelines with different agents. LTC is used alongside it and not defined either.