为联邦多智能体系统设计可验证的委托链，确保每步操作可追溯、合规且防攻击。
SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems
- 提出七项形式化属性与运行时协议，实现委托行为全程可验证。
- 在516个场景中达成100%查全率零误报，对抗攻击下全拦截无误判。
- 适合政府、金融等高安全需求的多智能体系统部署与审计。
当代理A委托代理B代用户X调用工具C时，现有框架无法回答：此操作的授权链源自何处，何处违反了策略？本文提出SentinelAgent，一种面向联邦多智能体AI系统的可验证委托链形式框架。委托链演算（DCC）定义了七项属性——六项确定性（权限收缩、策略保持、溯源可重建、级联可控、作用范围与动作匹配、输出模式匹配）和一项概率性（意图保持），并建立四项元定理与一个命题，证明确定性意图验证在实践中不可行。意图保持委托协议（IPDP）通过非大模型的委托权威服务在运行时强制执行所有七项属性。三阶段验证生命周期在DelegationBench v4（516个场景，10类攻击，13个联邦领域）上实现100%联合查全率、0%误报率。黑盒对抗条件下，委托权威服务成功阻断30/30次攻击，无误报。确定性属性在对抗压力测试下不可被突破；意图验证在复杂改写攻击下降至13%。对190个政府委托样本微调自然语言推理模型后，P2查全率从1.7%提升至88.3%（五折交叉验证，F1=82.1%）。属性P1、P3-P7通过TLA+模型检查在270万状态中机械验证，零违规。即使意图验证被绕过，其余六项属性仍能约束攻击者仅限于合法API调用、合规输出、可追溯行为、有限级联与符合策略的行为。
原文摘要 · Abstract (English)
When Agent A delegates to Agent B, which invokes Tool C on behalf of User X, no existing framework can answer: whose authorization chain led to this action, and where did it violate policy? This paper introduces SentinelAgent, a formal framework for verifiable delegation chains in federal multi-agent AI systems. The Delegation Chain Calculus (DCC) defines seven properties - six deterministic (authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, output schema conformance) and one probabilistic (intent preservation) - with four meta-theorems and one proposition establishing the practical infeasibility of deterministic intent verification. The Intent-Preserving Delegation Protocol (IPDP) enforces all seven properties at runtime through a non-LLM Delegation Authority Service. A three-point verification lifecycle achieves 100% combined TPR at 0% FPR on DelegationBench v4 (516 scenarios, 10 attack categories, 13 federal domains). Under black-box adversarial conditions, the DAS blocks 30/30 attacks with 0 false positives. Deterministic properties are unbreakable under adversarial stress testing; intent verification degrades to 13% against sophisticated paraphrasing. Fine-tuning the NLI model on 190 government delegation examples improves P2 from 1.7% to 88.3% TPR (5-fold cross-validated, F1=82.1%). Properties P1, P3-P7 are mechanically verified via TLA+ model checking across 2.7 million states with zero violations. Even when intent verification is evaded, the remaining six properties constrain the adversary to permitted API calls, conformant outputs, traceable actions, bounded cascades, and compliant behavior.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。