RiskChainBench evaluates AI on disguised links and website risk calls

Platform abuse campaigns hide their redirect instructions inside ordinary-looking messages, using emojis, homophones, character decomposition, and redundant symbols, then route users through disguised links to sites tied to pornography, fraud, gambling, or other illicit transactions. Researchers introduce RiskChainBench to test AI systems on both halves of that problem at once, since existing benchmarks score obfuscated-text recovery and risky-webpage judgment separately and so cannot show how errors in the first step propagate into the second. The benchmark pairs 3,600 synthetic token-text restoration inputs, drawn from 600 source sessions, with 600 corresponding human-labeled local web environments. In Task 1, a model reads a disguised message and must restore its content, the operational intent behind it, and its actual destination. In Task 2, the same model then acts as a VLM-driven web agent: it investigates the website tied to the correctly restored destination and produces a frozen, evidence-cited risk report, working only from what it observes on the page, with no access to the original message's wording or to any domain-reputation signal. The two tasks are scored independently and then composed offline, using the model's own frozen prediction of the primary entry point as a gate on its Task 2 result, so a wrong initial read carries through to the investigation score. Human annotators determine whether each task's output is correct, and a separate fixed multimodal judge model rates the web-investigation reports for faithfulness, sufficiency, completeness, and consistency. Across ten evaluated models, Entry Top-1 accuracy, the rate of correctly identifying the true destination, ranges from 35.2% to 95.2%, while web decision accuracy ranges from 26.3% to 62.8%. No single model leads on every sub-task: the authors report that the strongest systems differ across entry recovery, full message reconstruction, website risk decisions, and fine-grained risk typing. Breaking down the web-investigation failures, execution failures, cases where the agent fails to carry out its exploration properly, account for 31.9% of web runs, while post-decision type errors, misclassifying the kind of risk after reaching a decision, account for only 0.9%. The authors read this gap as showing that stable exploration and risk judgment, not fine-grained classification, are the real bottleneck for AI web agents on this task. The team releases the benchmark, its evaluation protocol, and a resettable local sandbox for running the web-investigation task repeatably.

Key facts

RiskChainBench pairs 3,600 synthetic obfuscated-message restoration inputs, from 600 source sessions, with 600 human-labeled local web environments.
A model must first restore a disguised redirect message, its intent, and its destination, then act as a VLM-driven web agent to investigate the correctly linked site and produce an evidence-cited risk report.
Across ten evaluated models, Entry Top-1 accuracy ranges from 35.2% to 95.2%, and web decision accuracy ranges from 26.3% to 62.8%.
Execution failures account for 31.9% of web-investigation runs, versus only 0.9% for post-decision type errors, pointing to exploration and judgment, not classification, as the main weak point.
The benchmark, its scoring protocol, and a resettable local sandbox are released alongside the paper.

Why it matters

Platform abuse operators already route users past automated filters by disguising redirect instructions with emojis, homophone substitutions, character decomposition, and filler symbols, then pointing the disguised link at pornography, fraud, gambling, or other illicit services. Most existing benchmarks test whether a model can decode the obfuscated text or whether it can judge a risky webpage, but not both together, so nobody could previously measure how a wrong read of the message carries through to a wrong read of the destination site. RiskChainBench chains the two steps so that a model's restoration errors show up directly in its investigation score.

Who it affects

Trust and safety teams and researchers building or evaluating AI systems for content moderation and anti-abuse detection are the direct audience: RiskChainBench gives them a shared, human-labeled way to compare how different models handle disguised-message decoding and the follow-on web investigation, rather than judging each skill in isolation.

How to use it

The benchmark, its evaluation protocol, and a resettable local sandbox are released together, so a model can be run through the full pipeline (message restoration, then web investigation as a VLM-driven agent) and scored on both stages, plus the composed, gated score that applies the model's own entry-point prediction as a filter on its investigation result.

How solid is it

Correctness on both tasks is set by human annotators rather than automated string matching, and web-investigation reports are additionally scored by a fixed multimodal judge model on faithfulness, sufficiency, completeness, and consistency. The evaluation covers ten models and shows a wide spread on both measured tasks (35.2% to 95.2% Entry Top-1, 26.3% to 62.8% web decision accuracy), with no model leading across every sub-task. The abstract text does not name the ten evaluated models, give the paper's authors or affiliations, or state a release date or venue.

Risks and caveats

The error breakdown shows execution failures, the agent not managing to complete its web exploration properly, driving 31.9% of failed web runs, against only 0.9% from misclassifying risk type once a decision is reached; the authors take this as evidence that stable exploration and judgment, not fine-grained typing, are the harder problem to solve. Because the obfuscation patterns and web environments are synthetic and human-constructed rather than captured live from abuse campaigns, how closely they track real-world obfuscation as it keeps evolving is not established by the abstract alone.

“Execution failures account for 31.9% of web runs, whereas post-decision type errors account for only 0.9%, identifying stable exploration and risk judgment as the principal bottlenecks.”

— RiskChainBench paper