用信息流控制保护自主AI代理，防提示注入攻击
Securing AI Agents with Information-Flow Control
- 通过动态污点追踪追踪信息流动，实现安全策略的确定性执行
- 在AgentDojo中完成多种任务，同时提供可证明的安全保障
- 适合关注AI代理安全与隐私保护的研究者和开发者
随着AI代理日益自主和强大，防范提示注入等漏洞变得至关重要。本文探讨了使用信息流控制（IFC）为AI代理提供安全保证的可能性。我们提出一个形式化模型，用于分析代理规划器的安全性与表达能力。基于该模型，我们刻画了动态污点追踪可强制的属性类别，并构建了评估规划器设计安全与效用权衡的任务分类体系。在此基础上，我们提出了Fides规划器，它跟踪机密性和完整性标签，确定性地执行安全策略，并引入新原语实现信息的选择性隐藏。在AgentDojo中的评估表明，该方法可在保证安全的前提下完成广泛任务。相关概念教程详见https://github.com/microsoft/fides。
原文摘要 · Abstract (English)
As AI agents become increasingly autonomous and capable, ensuring their security against vulnerabilities such as prompt injection becomes critical. This paper explores the use of information-flow control (IFC) to provide security guarantees for AI agents. We present a formal model to reason about the security and expressiveness of agent planners. Using this model, we characterize the class of properties enforceable by dynamic taint-tracking and construct a taxonomy of tasks to evaluate security and utility trade-offs of planner designs. Informed by this exploration, we present Fides, a planner that tracks confidentiality and integrity labels, deterministically enforces security policies, and introduces novel primitives for selectively hiding information. Its evaluation in AgentDojo demonstrates that this approach enables us to complete a broad range of tasks with security guarantees. A tutorial to walk readers through the the concepts introduced in the paper can be found at https://github.com/microsoft/fides
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。