构建安全可靠的LLM代理，分离计划与执行以抵御攻击。
Architecting Resilient LLM Agents: A Guide to Secure Plan-then-Execute Implementations
- 将计划与执行分离，提升系统可预测性与安全性。
- 通过控制流完整性防御间接提示注入攻击，降低风险。
- 提供LangChain、CrewAI、AutoGen三框架落地指南，适合生产级开发。
随着大型语言模型（LLM）代理在自动化复杂多步骤任务中能力增强，构建稳健、安全且可预测的架构模式变得至关重要。本文全面阐述了‘计划-执行’（Plan-then-Execute, P-t-E）设计模式，该模式将战略规划与战术执行解耦。文中详细分析了其核心组件——规划器（Planner）与执行器（Executor）——以及相比反应式模式（如ReAct）在可预测性、成本效率和推理质量上的优势。重点探讨了该设计的安全部署机制，尤其强调其通过保障控制流完整性对间接提示注入攻击的天然抵抗力。尽管如此，仍需采用纵深防御策略，文中提出最小权限原则、任务范围工具访问及沙箱代码执行等关键补充控制措施。为使理论可操作，本文提供了基于LangChain（通过LangGraph）、CrewAI和AutoGen三大主流框架的实现蓝图与可运行代码参考。分别解析各框架特性：LangGraph支持状态图下的重规划，CrewAI提供声明式工具作用域提升安全性，AutoGen内置Docker沙箱。最后讨论动态重规划循环、基于有向无环图（DAG）的并行执行及人类在环（HITL）验证等高级模式，为架构师、开发者与安全工程师提供完整生产级可信代理建设蓝图。
原文摘要 · Abstract (English)
As Large Language Model (LLM) agents become increasingly capable of automating complex, multi-step tasks, the need for robust, secure, and predictable architectural patterns is paramount. This paper provides a comprehensive guide to the ``Plan-then-Execute'' (P-t-E) pattern, an agentic design that separates strategic planning from tactical execution. We explore the foundational principles of P-t-E, detailing its core components - the Planner and the Executor - and its architectural advantages in predictability, cost-efficiency, and reasoning quality over reactive patterns like ReAct (Reason + Act). A central focus is placed on the security implications of this design, particularly its inherent resilience to indirect prompt injection attacks by establishing control-flow integrity. We argue that while P-t-E provides a strong foundation, a defense-in-depth strategy is necessary, and we detail essential complementary controls such as the Principle of Least Privilege, task-scoped tool access, and sandboxed code execution. To make these principles actionable, this guide provides detailed implementation blueprints and working code references for three leading agentic frameworks: LangChain (via LangGraph), CrewAI, and AutoGen. Each framework's approach to implementing the P-t-E pattern is analyzed, highlighting unique features like LangGraph's stateful graphs for re-planning, CrewAI's declarative tool scoping for security, and AutoGen's built-in Docker sandboxing. Finally, we discuss advanced patterns, including dynamic re-planning loops, parallel execution with Directed Acyclic Graphs (DAGs), and the critical role of Human-in-the-Loop (HITL) verification, to offer a complete strategic blueprint for architects, developers, and security engineers aiming to build production-grade, resilient, and trustworthy LLM agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。