为LLM工具链设计可验证的声明签名机制，提升安全性与可审计性。
Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines
- 将工具调用声明作为安全对象，强制签名验证与时效检查
- 在边缘设备上实现≤9.4毫秒的验证延迟，拒绝不合规请求超98.7%
- 适合医疗、金融等高安全要求的LLM工具流水线场景
大型语言模型（LLMs）越来越多地部署于医疗分析、金融系统、检索增强生成（RAG）及多智能体工作流等工具驱动环境。尽管模型上下文协议（MCP）标准化了LLM应用暴露和调用外部工具的方式，但其基础版本并不要求工具使用声明进行密码学认证、时效性检查、策略约束或独立审计。这导致MCP流水线可能面临声明篡改、未经授权的工具调用、过时请求重放及问责缺失等风险。本文提出一种面向MCP的声明级安全执行层，将每个工具使用声明视为首类安全对象，其标准形式必须经过策略验证、时效检查、数字签名、执行前验证，并关联防篡改审计证据。该框架将工具调用绑定到可验证的声明完整性与闭式授权，分离用户可见参数与执行元数据，拒绝非合规或过期的声明，并将成功调用记录至基于梅克尔树的透明日志。在GPT-5.3、LLaMA-3.5与DeepSeek-V3上，使用最多50,000个声明实例的评估显示，系统具备近线性可扩展性（R²=0.998），验证延迟控制在≤9.4毫秒（边缘设备），对过期、格式错误、重放及策略违规声明的拒绝对率超过98.7%。在医疗、金融、RAG及多智能体场景中的实验表明，该机制实现了低开销、可追溯、可审计的异构LLM-工具流水线控制。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly deployed in tool-driven environments such as healthcare analytics, financial systems, retrieval-augmented generation (RAG), and multi-agent workflows. Although the Model Context Protocol (MCP) standardizes how LLM applications expose and invoke external tools, its baseline model does not require tool-use manifests to be cryptographically authenticated, freshness-checked, policy-bound, or independently auditable before execution. As a result, MCP pipelines may remain vulnerable to manifest tampering, unauthorized tool invocation, replay of stale requests, and weak accountability. This paper presents a manifest-level enforcement layer for MCP-based LLM pipelines. It treats each MCP tool-use manifest as a first-class security object whose canonical form must be policy-validated, freshness-checked, digitally signed, verified before execution, and linked to tamper-evident audit evidence. The framework binds tool invocation to verifiable manifest integrity and fail-closed authorization, separates user-visible request parameters from execution metadata, rejects non-compliant or stale manifests before execution, and records accepted invocations in a Merkle-based transparency log. Evaluation across GPT-5.3, LLaMA-3.5, and DeepSeek-V3 using up to 50,000 manifest instances shows near-linear scalability (R^2 = 0.998), bounded verification latency (<= 9.4 ms on edge devices), and rejection of expired, malformed, replayed, and policy-violating manifests, with rejection rates above 98.7%. Experiments in healthcare, finance, RAG, and multi-agent settings show that manifest-level cryptographic enforcement enables low-overhead, traceable, and auditable execution control for heterogeneous LLM-tool pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。