为智能交易代理设计执行层安全标准，防范不可逆损失。
Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors
- 在策略与交易所间加入安全中间件，强制执行执行契约和防护规则。
- 实测使最大回撤降93.1%，风险价值缩减97.5%，攻击成功率下降27.2%。
- 适合关注自动化交易安全的开发者与量化团队，尤其在技能化代理场景中。
OpenClaw式代理架构将语言指令转化为特权执行：大模型意图经工具拦截、策略门控和本地执行器流转。同时，skills.sh等技能市场使能力获取如安装工具般便捷，形成不断扩大的能力供应链。这两者共同导致安全失效模式从“错误回答”转向“执行引发损失”——不受信提示、被攻陷技能或叙事操纵可能触发真实交易与不可逆后果。本文提出生存性感知执行（SAE），作为OpenClaw类系统与技能化代理的执行层生存性标准。SAE位于策略引擎（大模型或非大模型）与交易所执行器之间，定义明确执行契约（ExecutionRequest, ExecutionContext, ExecutionDecision），并强制不可绕过的最后一公里不变量：基于投影的暴露预算、冷却与订单速率限制、滑点边界、分阶段执行及工具/场所白名单。为在供应链风险下可测试委托行为，通过日志记录的预期策略规范（Intended Policy Spec）实现确定性越界标注与可复现的委托差距（DG）度量。基于Binance USD-M BTCUSDT/ETHUSDT永续合约数据（15分钟；2025-09-01至2025-12-01，含资金费率）的离线回放显示，SAE显著提升系统生存性：最大回撤由0.4643降至0.0319（降幅93.1%），|CVaR_0.99|由4.025e-3降至约1.02e-4（降幅约97.5%），DG损失代理值由0.647降至0.019（降幅约97.0%）。攻击成功率从1.00降至0.728，且本次运行零误阻拦。块Bootstrap、配对威尔科克森检验与两比例检验均证实上述变化显著。
原文摘要 · Abstract (English)
OpenClaw-style agent stacks turn language into privileged execution: LLM intents flow through tool interception, policy gates, and a local executor. In parallel, skill marketplaces such as skills.sh make capability acquisition as easy as installing skills and CLIs, creating a growing capability supply chain. Together, these trends shift the dominant safety failure mode from "wrong answers" to execution-induced loss, where untrusted prompts, compromised skills, or narrative manipulation can trigger real trades and irreversible side effects. We propose Survivability-Aware Execution (SAE), an execution-layer survivability standard for OpenClaw-style systems and skill-enabled agents. SAE sits as middleware between a strategy engine (LLM or non-LLM) and the exchange executor. It defines an explicit execution contract (ExecutionRequest, ExecutionContext, ExecutionDecision) and enforces non-bypassable last-mile invariants: projection-based exposure budgets, cooldown and order-rate limits, slippage bounds, staged execution, and tool/venue allowlists. To make delegated execution testable under supply-chain risk, we operationalize the Delegation Gap (DG) via a logged Intended Policy Spec that enables deterministic out-of-scope labeling and reproducible DG metrics. On an offline replay using official Binance USD-M BTCUSDT/ETHUSDT perpetual data (15m; 2025-09-01--2025-12-01, incl. funding), SAE improves survivability: MDD drops from 0.4643 to 0.0319 (Full; 93.1%), |CVaR_0.99| shrinks from 4.025e-3 to ~1.02e-4 (~97.5%), and DG loss proxy falls from 0.647 to 0.019 (~97.0%). AttackSuccess decreases from 1.00 to 0.728 with zero FalseBlock in this run. Block bootstrap, paired Wilcoxon, and two-proportion tests confirm the shifts. SAE reframes agentic trading safety for the OpenClaw+skills era: treat upstream intent and skills as untrusted, and enforce survivability where actions become side effects.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。