将AI推理与执行分离，提升真实系统中AI操作的安全性
Sovereign Agentic Loops: Decoupling AI Reasoning from Execution in Real-World Systems
- 模型输出结构化意图并附理由，由控制层验证后才执行
- 在云基础设施测试中拦截93%不安全意图，总拒绝不安全操作
- 支持审计追溯和确定性重放，适合高安全要求的系统
大型语言模型代理越来越多地调用API以修改真实系统，但现有架构常直接将模型的随机输出传递给执行层。我们指出这种耦合带来安全隐患，因模型正确性、上下文感知和对齐性无法在执行时保证。为此提出主权代理循环（SAL），一种控制平面架构：模型生成带理由的结构化意图，控制平面在执行前基于真实系统状态和策略验证意图。SAL结合混淆膜（限制模型对身份敏感状态的访问）与密码学关联的证据链，实现可审计和可重放。我们形式化SAL，并证明其在假设条件下能实现策略约束执行、身份隔离和确定性重放。在针对云基础设施的OpenKedge原型中，SAL在策略层拦截93%不安全意图，剩余7%通过一致性检查拒绝，基准测试中完全防止了不安全执行，仅增加12.4毫秒中位延迟。
原文摘要 · Abstract (English)
Large language model (LLM) agents increasingly issue API calls that mutate real systems, yet many current architectures pass stochastic model outputs directly to execution layers. We argue that this coupling creates a safety risk because model correctness, context awareness, and alignment cannot be assumed at execution time. We introduce Sovereign Agentic Loops (SAL), a control-plane architecture in which models emit structured intents with justifications, and the control plane validates those intents against true system state and policy before execution. SAL combines an obfuscation membrane, which limits model access to identity-sensitive state, with a cryptographically linked Evidence Chain for auditability and replay. We formalize SAL and show that, under the stated assumptions, it provides policy-bounded execution, identity isolation, and deterministic replay. In an OpenKedge prototype for cloud infrastructure, SAL blocks 93% of unsafe intents at the policy layer, rejects the remaining 7% via consistency checks, prevents unsafe executions in our benchmark, and adds 12.4 ms median latency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。