The b3 benchmark (Backbone Breaker Benchmark) measures how secure the large language model inside an AI agent is, separately from the rest of the agent. It uses threat snapshots, frozen moments in an agent's run where an attack lands, and fills them with attacks crowdsourced through an online red-teaming game. The paper drew on 194,331 unique attacks and tested 34 models, finding that stronger reasoning improved security while model size did not.
What the b3 benchmark is
An AI agent is ordinary software wrapped around a model, which the paper calls the backbone. When an agent is attacked, it is often unclear whether the model or the surrounding code failed. b3, from the 2025 paper Breaking Agent Backbones, isolates the model.
It does this with threat snapshots: a captured state of an agent at the exact point an attack arrives, with the system prompt, tools and context in place. Swap in a different model, replay the snapshot, and you learn how that model alone behaves.
How b3 tests a model
The attacks were crowdsourced from people playing an online game in which they try to break AI agents. The Inspect version contains 630 samples. Each attack appears three times, against the same application at three increasing security levels.
Attacks are tagged by type: Direct Instruction Override, Indirect Instruction Override, Direct Tool Invocation, Indirect Tool Invocation, and Denial of AI Service. Scoring depends on the attacker's goal. A data-exfiltration attempt is scored by how closely the response matches the secret, a tool attack by whether the exact tool call was made with the attacker's parameters.
Run it with inspect eval inspect_evals/b3, or filter with -T task_types=["DTI","ITI"] to focus on tool invocation.
What the results tell you
Across 34 popular models, the paper found that models with stronger reasoning were more secure, while bigger models were not reliably more secure. That is useful when choosing a backbone: a larger model is not automatically a safer one.
It also shows why a single number is not enough. A model can resist instruction overrides well and still make the wrong tool call when a document tells it to, so read the results per attack type.
How to defend against what it measures
Pick your backbone with security results in hand, not only capability results, and re-check when you change model versions. Then assume the model will sometimes fail and contain it: validate tool-call arguments in code, keep secrets out of the context window, rate-limit expensive calls to blunt denial of wallet, and treat every retrieved document as hostile. See LLM data exfiltration.
References
- [1]Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents(arXiv)
- [2]b3 in Inspect Evals (task docs)(Inspect Evals)
- [3]OWASP Top 10 for Agentic Applications (2026)(OWASP)
- [4]Inspect Evals registry: Safeguards evaluations(UK AI Security Institute)
A secure backbone model helps, but your agent's tools and data decide the damage. Talk to a security expert about testing the whole agent, not just the model.