LLM代理存在信任与权限不匹配问题，导致安全漏洞。
SoK: Trust-Authorization Mismatch in LLM Agent Interactions
- 提出信念-意图-权限框架，拆解代理执行三阶段
- 发现200+论文中攻击共性源于信任与权限脱节
- 建议从静态权限转向动态风险自适应授权
大型语言模型（LLMs）正演变为可通过标准化协议（如MCP）执行复杂流程的自主代理。然而，这一范式将控制权从确定性代码转移至概率推断，造成根本性的信任-授权错配：静态权限与代理运行时动态变化的信任度在结构上分离。本文通过系统知识梳理（SoK），调研超过200篇代表性论文，对代理安全领域进行分类归纳。提出信念-意图-权限（B-I-P）统一形式化视角，将代理执行分解为信念形成、意图生成和权限授予三个阶段。我们证明，从提示注入到工具污染等多种威胁，其根源均在于动态信任状态与静态授权边界之间的不同步。基于B-I-P框架，系统映射现有攻防手段，并识别当前机制未能弥合该错配的关键空白。最后，提出研究议程，推动从静态基于角色的访问控制（RBAC）向动态、风险自适应授权转变。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are evolving into autonomous agents capable of executing complex workflows via standardized protocols (e.g., MCP). However, this paradigm shifts control from deterministic code to probabilistic inference, creating a fundamental Trust-Authorization Mismatch: static permissions are structurally decoupled from the agent's fluctuating runtime trustworthiness. In this Systematization of Knowledge (SoK), we survey more than 200 representative papers to categorize the emerging landscape of agent security. We propose the Belief-Intention-Permission (B-I-P) framework as a unifying formal lens. By decomposing agent execution into three distinct stages-Belief Formation, Intent Generation, and Permission Grant-we demonstrate that diverse threats, from prompt injection to tool poisoning, share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries. Using the B-I-P lens, we systematically map existing attacks and defenses and identify critical gaps where current mechanisms fail to bridge this mismatch. Finally, we outline a research agenda for shifting from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。