为自主智能体设计可解释的执行安全门，防止越权操作。
ILION: Deterministic Pre-Execution Safety Gates for Agentic AI Systems
- 用五层逻辑架构判断动作是否合法，无需训练数据
- 在380个测试场景中准确率达91%，误报率仅7.9%
- 比现有方案快2000倍，适合高并发实时安全防护
具备执行真实世界操作能力的自主智能体（如文件系统操作、API调用、数据库修改、金融交易）带来了现有内容审核体系无法覆盖的安全风险。当前文本安全系统仅评估语言内容中的暴力、仇恨言论等危害类别，其架构不适用于判断某项操作是否在代理授权范围内。我们提出ILION（Intelligent Logic Identity Operations Network），一种面向智能体系统的确定性执行安全门。ILION采用五组件级联架构——瞬态身份印记（TII）、语义向量参考系（SVRF）、身份漂移控制（IDC）、身份共振评分（IRS）和共识否决层（CVL），在无统计训练、无API依赖的前提下，对代理动作进行允许或阻止分类。系统无需标注数据，运行延迟低于1毫秒，结果完全可解释。我们在自建的ILION-Bench v2基准上评估，该基准包含380个测试场景，涵盖8类攻击，其中39%为高难度对抗样本，并设有保留开发集。ILION取得F1=0.8515，精确率91.0%，平均延迟143微秒，假阳性率7.9%。与三种基线对比：Lakera Guard（F1=0.8087）、OpenAI Moderation API（F1=0.1188）、Llama Guard 3（F1=0.0105），表明现有文本安全框架因任务错配，在代理执行安全任务上系统性失效。ILION优于最佳商业基线4.3点F1，速度提升2000倍，假阳性率低4倍。
原文摘要 · Abstract (English)
The proliferation of autonomous AI agents capable of executing real-world actions - filesystem operations, API calls, database modifications, financial transactions - introduces a class of safety risk not addressed by existing content-moderation infrastructure. Current text-safety systems evaluate linguistic content for harm categories such as violence, hate speech, and sexual content; they are architecturally unsuitable for evaluating whether a proposed action falls within an agent's authorized operational scope. We present ILION (Intelligent Logic Identity Operations Network), a deterministic execution gate for agentic AI systems. ILION employs a five-component cascade architecture - Transient Identity Imprint (TII), Semantic Vector Reference Frame (SVRF), Identity Drift Control (IDC), Identity Resonance Score (IRS) and Consensus Veto Layer (CVL) - to classify proposed agent actions as BLOCK or ALLOW without statistical training or API dependencies. The system requires zero labeled data, operates in sub-millisecond latency, and produces fully interpretable verdicts. We evaluate ILION on ILION-Bench v2, a purpose-built benchmark of 380 test scenarios across eight attack categories with 39% hard-difficulty adversarial cases and a held-out development split. ILION achieves F1 = 0.8515, precision = 91.0%, and a false positive rate of 7.9% at a mean latency of 143 microseconds. Comparative evaluation against three baselines - Lakera Guard (F1 = 0.8087), OpenAI Moderation API (F1 = 0.1188), and Llama Guard 3 (F1 = 0.0105) - demonstrates that existing text-safety infrastructure systematically fails on agent execution safety tasks due to a fundamental task mismatch. ILION outperforms the best commercial baseline by 4.3 F1 points while operating 2,000 times faster with a false positive rate four times lower.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。