通过分析执行过程，实时拦截大模型代理的异常行为。
Agent-Sentry: Bounding LLM Agents via Execution Provenance
- 基于历史正常执行记录构建行为边界，动态检测异常动作。
- 在测试中拦截94.3%的攻击注入，同时放行95.1%的正常任务。
- 无需修改代理、工具或模型，适合安全敏感场景使用。
智能代理系统虽功能强大，但存在严重的安全、隐私与安全风险。其功能集合和概率性执行流程事先未知，难以判断系统是否完成用户意图任务，或因被攻陷而执行无关操作。本文提出 extit{Agent Sentry}，一种运行时防御机制，通过学习历史合法执行行为，界定代理的正常行为范围，并标记超出边界的动作。该机制包含三层互补检查：基于动作序列及函数参数来源的结构化分类器；对敏感参数值的确定性白名单检查；以及仅在前两层无法判断时启用的 LLM 判定器，用于区分新合法请求与精心构造的注入攻击。在 AgentDojo 与 AgentDyn 上验证表明，Agent Sentry 可在不修改代理、工具或大模型的前提下，成功拦截 94.3\\\\
原文摘要 · Abstract (English)
Agentic computing systems, while immensely capable, raise serious security, privacy, and safety concerns. A key issue is that the full set of functionalities offered by these systems, combined with their probabilistic execution flows, is not known beforehand. Given this lack of characterization, it is challenging to validate whether a system has successfully carried out the user's intended task or instead executed irrelevant actions, potentially as a consequence of compromise. We present \emph{Agent Sentry}, a runtime defense that learns a bound on an agent's benign execution from prior legitimate executions and flags any action that falls outside this bound. Agent Sentry layers three complementary checks: a structural classifier over the sequence of actions and the provenance of each function's arguments; a deterministic allowlist check over sensitive argument values; and an LLM judge, invoked only on the residual of actions where the first two checks cannot safely decide between a legitimate new request and a carefully crafted injection. We demonstrate the effectiveness of Agent Sentry in AgentDojo and AgentDyn by blocking 94.3\% of successful injections while allowing 95.1\% of benign executions, without modifying the agent, its tools, or the LLM.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。