将智能体运行轨迹转为可分析程序，防御提示注入攻击
AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection
- 把智能体运行过程转为带控制/数据流的图结构
- 在AgentDojo上将攻击成功率降至3%，性能损失仅1%
- 适合关注LLM智能体安全的开发者和研究者
大型语言模型（LLM）智能体通过结合自然语言推理与外部工具执行，为解决各类问题提供了新范式。然而其动态且不透明的行为引入了重大安全风险，尤其在提示注入攻击下。本文提出新思路：将智能体运行轨迹视为具有可分析语义的结构化程序。为此，我们设计AgentArmor——一个程序分析框架，将智能体轨迹转换为基于图中间表示的结构化程序依赖关系（如CFG、DFG、PDG），并通过类型系统强制执行安全策略。AgentArmor包含三个核心组件：(1) 图构造器，将运行轨迹重构为带控制流与数据流信息的图表示；(2) 属性注册表，附加交互工具与数据的安全元信息；(3) 类型系统，在中间表示上进行静态推断与检查。通过将智能体行为建模为结构化程序，AgentArmor实现对敏感数据流、信任边界及策略违规的程序分析。我们在AgentDojo基准上评估，结果表明，AgentArmor可将攻击成功率（ASR）降低至3%，同时仅带来1%的性能下降。
原文摘要 · Abstract (English)
Large Language Model (LLM) agents offer a powerful new paradigm for solving various problems by combining natural language reasoning with the execution of external tools. However, their dynamic and non-transparent behavior introduces critical security risks, particularly in the presence of prompt injection attacks. In this work, we propose a novel insight that treats the agent runtime traces as structured programs with analyzable semantics. Thus, we present AgentArmor, a program analysis framework that converts agent traces into graph intermediate representation-based structured program dependency representations (e.g., CFG, DFG, and PDG) and enforces security policies via a type system. AgentArmor consists of three key components: (1) a graph constructor that reconstructs the agent's runtime traces as graph-based intermediate representations with control and data flow described within; (2) a property registry that attaches security-relevant metadata of interacted tools \& data, and (3) a type system that performs static inference and checking over the intermediate representation. By representing agent behavior as structured programs, AgentArmor enables program analysis for sensitive data flow, trust boundaries, and policy violations. We evaluate AgentArmor on the AgentDojo benchmark, the results show that AgentArmor can reduce the ASR to 3\%, with the utility drop only 1\%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。