为大模型智能体设计四层安全架构，系统防御提示注入等新型威胁。
Governance Architecture for Autonomous Agent Systems: Threats, Framework, and Engineering Practice
- 构建四层治理架构，分层防护执行、意图、授权与日志。
- 实测拦截率93%~98.5%，对恶意插件仍达75%~94%识别率。
- 适合关注智能体安全的开发者与系统架构师参考。
由大语言模型驱动的自主智能体引入了一类执行层漏洞——提示注入、检索污染和不受控工具调用——现有防护机制无法系统性应对。本文提出分层治理架构（LGA），包含四层：执行沙箱（L1）、意图验证（L2）、零信任跨代理授权（L3）和不可变审计日志（L4）。为评估LGA，我们构建了一个双语基准（中文原文，英文机器翻译）共1,081个工具调用样本，涵盖提示注入、RAG污染和恶意技能插件。在代表性的开源框架OpenClaw上测试，四类本地LLM裁判（Qwen3.5-4B、Llama-3.1-8B、Qwen3.5-9B、Qwen2.5-14B）与云端裁判（GPT-4o-mini）在L2层对TC1/TC2恶意调用的拦截率达93.0%-98.5%，轻量级NLI基线低于10%。TC3（恶意技能插件）更难，识别率75%-94%且具备良好精确率-召回率平衡，需依赖L1和L3协同防护。Qwen2.5-14B在本地表现最佳（98%识别率，约10%-20%误报率）；两阶段级联（Qwen3.5-9B→GPT-4o-mini）实现91.9%-92.6%识别率，误报率1.9%-6.7%；全本地级联（Qwen3.5-9B→Qwen2.5-14B）达94.7%-95.6%识别率，误报率6.0%-9.7%，适用于数据主权部署。端到端流水线评估（n=100）显示四层协同工作，96%识别率，总中位延迟约980毫秒，非裁判层仅贡献约18毫秒。在外部InjecAgent基准上通用性达99%-100%拦截，证明其鲁棒性超越合成数据。
原文摘要 · Abstract (English)
Autonomous agents powered by large language models introduce a class of execution-layer vulnerabilities -- prompt injection, retrieval poisoning, and uncontrolled tool invocation -- that existing guardrails fail to address systematically. In this work, we propose the Layered Governance Architecture (LGA), a four-layer framework comprising execution sandboxing (L1), intent verification (L2), zero-trust inter-agent authorization (L3), and immutable audit logging (L4). To evaluate LGA, we construct a bilingual benchmark (Chinese original, English via machine translation) of 1,081 tool-call samples -- covering prompt injection, RAG poisoning, and malicious skill plugins -- and apply it to OpenClaw, a representative open-source agent framework. Experimental results on Layer 2 intent verification with four local LLM judges (Qwen3.5-4B, Llama-3.1-8B, Qwen3.5-9B, Qwen2.5-14B) and one cloud judge (GPT-4o-mini) show that all five LLM judges intercept 93.0-98.5% of TC1/TC2 malicious tool calls, while lightweight NLI baselines remain below 10%. TC3 (malicious skill plugins) proves harder at 75-94% IR among judges with meaningful precision-recall balance, motivating complementary enforcement at Layers 1 and 3. Qwen2.5-14B achieves the best local balance (98% IR, approximately 10-20% FPR); a two-stage cascade (Qwen3.5-9B->GPT-4o-mini) achieves 91.9-92.6% IR with 1.9-6.7% FPR; a fully local cascade (Qwen3.5-9B->Qwen2.5-14B) achieves 94.7-95.6% IR with 6.0-9.7% FPR for data-sovereign deployments. An end-to-end pipeline evaluation (n=100) demonstrates that all four layers operate in concert with 96% IR and a total P50 latency of approximately 980 ms, of which the non-judge layers contribute only approximately 18 ms. Generalization to the external InjecAgent benchmark yields 99-100% interception, confirming robustness beyond our synthetic data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。