为智能体系统设计实时防护架构，有效抵御链式攻击。
SafeAgent: A Runtime Protection Architecture for Agentic Systems
- 将安全决策分为运行时控制器与上下文感知核心，分层治理
- 在ASB和InjecAgent上显著提升防御能力，且正常任务表现不降
- 支持动态调整安全与效率平衡，适合高风险应用部署
大型语言模型（LLM）智能体易受提示注入攻击影响，此类攻击可通过多步骤流程、工具调用及持久化上下文传播，仅靠输入输出过滤无法保障可靠安全。本文提出SafeAgent，一种运行时安全架构，将智能体安全视为随交互轨迹演变的状态决策问题。设计包含两个协同组件：运行时控制器在智能体循环中协调动作，上下文感知决策核心则基于持久会话状态进行风险判断。核心被形式化为上下文感知的先进机器智能，通过风险编码、效用-成本评估、后果建模、策略仲裁和状态同步等算子实现。在Agent Security Bench（ASB）和InjecAgent上的实验表明，SafeAgent在鲁棒性上持续优于基线与文本级防护方法，同时保持良好的良性任务性能。消融实验进一步揭示恢复置信度与策略权重决定了不同的安全-效用权衡点。
原文摘要 · Abstract (English)
Large language model (LLM) agents are vulnerable to prompt-injection attacks that propagate through multi-step workflows, tool interactions, and persistent context, making input-output filtering alone insufficient for reliable protection. This paper presents SafeAgent, a runtime security architecture that treats agent safety as a stateful decision problem over evolving interaction trajectories. The proposed design separates execution governance from semantic risk reasoning through two coordinated components: a runtime controller that mediates actions around the agent loop and a context-aware decision core that operates over persistent session state. The core is formalized as a context-aware advanced machine intelligence and instantiated through operators for risk encoding, utility-cost evaluation, consequence modeling, policy arbitration, and state synchronization. Experiments on Agent Security Bench (ASB) and InjecAgent show that SafeAgent consistently improves robustness over baseline and text-level guardrail methods while maintaining competitive benign-task performance. Ablation studies further show that recovery confidence and policy weighting determine distinct safety-utility operating points.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。