有界智能體：多智能體AI系統的委派安全

摘要

基於大型語言模型的代理（LLM-based agents）可代表使用者存取雲端服務、呼叫工具或呼叫其他代理。在會話開始時，代理的權限即被設定完成，但此後保持靜態；每個請求皆被獨立評估，不考慮先前的動作。在權限範圍內，代理可能做出與所委派任務相悖的行為、將個別允許的動作組合成被禁止的結果，或在未加限制的情況下將權限委派給子代理。提示注入（prompt injection）只有在代理具備執行此類動作的權限時才會構成風險；因此，這本質上是授權架構的問題，而不僅是模型的問題。代理主體鏈（Agentic Principal Chain, APC）追蹤從一個主體到下一主體的委派權限。APC 使用六項授權檢查，針對累積的會話狀態評估每個請求。APC 會延續並限制委派範圍與預算。透過組合閉包（composition closure），APC 將請求與先前的動作進行比對，以防止被禁止的組合，並在模型之外強制執行此決策。我們證明了 APC 實作的爆炸半徑單調性（Blast Radius Monotonicity）與組合健全性（Composition Soundness）；其中，組合健全性僅限於在完整限制集合與序列化准入下的被禁止組合。我們評估了 3,154 個實例，包括 InjecAgent、AgentDojo 與 ASB。我們的受損模型評估透過在第一個合法工具呼叫後插入真實攻擊呼叫，獨立於模型行為測試 APC。AgentDojo 的資料外洩在所有四個領域中從 75-100% 降至 0%；APC 阻擋了 InjecAgent 全部 544 個資料竊取案例。意圖綁定（intent binding）將破壞行為從 38.6% 降至 4.0%，將操縱行為從 90.5% 降至 12.1%。授權延遲在閒置主機上的第 99 百分位為 0.24 毫秒；在 949 組 AgentDojo 任務-注入配對中，效用分別在兩種設定下低了 8.6 和 13.9 個百分點。實作、評估工具與資料均已公開提供。

English

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.