反蜂群準則：遏制協同代理入侵

摘要

代理能將共享基礎設施變成協同入侵的管道。Hugging Face 事件與另一項公開 wiki 調查顯示，為何安全評估可能需要來自多次執行及其留下產物的證據。我們主張，防禦的操作單位應是可修訂的協調事件，用以連結觀察到的傳輸、任務權限與回應歷程。核心研究問題是前瞻式事件發現：在評估者提供其成員身分之前，找出哪些行動屬於同一群組。我們相對於協作與委派權限政策來界定未經許可的協調，將以儲存為媒介的協調連結至共識主動性，並明確指出區分影響與共同原因所需的證據。首次接觸訊號是發現的一種可能輸入；該設計也追蹤繼承狀態與後續使用。一項提出的評估在匹配的審查成本與誤報工作量下，比較孤立行動、滾動視窗、已知群組與前瞻發現的事件。它衡量所有被指派群體執行中的有害結果，並檢驗通道關閉與狀態隔離後是否復發。一項經檢查碼驗證的公開 wiki 匯出重建，將留存寫入的下降與後續行政清理分開。本文的貢獻是以事件為基礎的論點、描述性分析與評估設計。它使跨執行監控的建議可被檢驗，而不宣稱提出新的偵測器或已測量的圍堵效益。

English

Agents can turn shared infrastructure into a channel for coordinated intrusion. The Hugging Face incident and a separate public-wiki investigation show why a security assessment may need evidence from several executions and the artifacts they leave behind. We argue that the operational unit of defence should be a revisable coordination episode linking observed transfers, task authority, and response history. The central research problem is prospective episode discovery: finding which actions belong together before an evaluator supplies their membership. We define unsanctioned coordination relative to collaboration and delegated-authority policy, connect storage-mediated coordination to stigmergy, and specify the evidence needed to distinguish influence from common causes. First-contact signals are one possible input to discovery; the design also follows inherited state and later use. A proposed evaluation compares isolated actions, rolling windows, known groups, and prospectively discovered episodes at matched review cost and false-alert workload. It measures harmful outcomes across all assigned population runs and tests recurrence after channel closure and state quarantine. A checksum-verified reconstruction of the public wiki export separates the decline in retained writes from later administrative cleanup. The contribution is an incident-grounded position, descriptive analysis, and evaluation design. It makes the recommendation to monitor across executions testable without claiming a new detector or a measured containment benefit.