提出分布式安全框架，防止多智能体因信息隔离导致的隐性违规。
Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems
- 用语义污染令牌协议跨部门传递安全状态，不暴露原始数据。
- 在基准测试中实现0.95的F1分数，验证延迟仅106毫秒。
- 适合需要跨系统协作的安全敏感场景，如金融、医疗智能体系统。
我们识别并形式化了一种新型安全风险：上下文碎片化违规（CFVs）——即单个智能体行为看似合理，但集体违反组织政策，因关键政策信息被分隔在不同部门的私有上下文中。现有基于提示的对齐机制和单一拦截器难以应对跨越上下文孤岛的违规。我们提出 Distributed Sentinel 分布式零信任执行架构，引入语义污染令牌（STT）协议。通过轻量级边车代理，系统在不暴露跨域原始数据的前提下传播安全状态，支持反事实图模拟以实现跨域策略验证。我们构建了 PhantomEcosystem 基准，包含9类真实跨智能体违规场景及对抗平衡的安全对照组。在该基准上，Distributed Sentinel 达到 F1 = 0.95，端到端延迟为106毫秒（16毫秒验证 + 90毫秒实体提取，A100），优于基于提示过滤的0.85和基于规则的DLP的0.65。为验证外部强制的必要性，我们在执行导向的多智能体工作流中评估八款前沿大模型，各模型均出现显著违规率（14%-98%），跨域数据流违规率显著高于同域流。结果表明自我规避不可靠，多智能体安全需依赖独立于个体的集中式执行层。
原文摘要 · Abstract (English)
We identify and formalize a novel security risk: Context-Fragmented Violations (CFVs) - a class of policy breaches where individual agent actions appear locally safe and reasonable, yet collectively violate organizational policies because critical policy facts are siloed in different departments private contexts. Existing prompt-based alignment mechanisms and monolithic interceptors are poorly matched to violations that span contextual islands. We propose Distributed Sentinel, a distributed zero-trust enforcement architecture that introduces the Semantic Taint Token (STT) Protocol. Through lightweight sidecar proxies, our system propagates security state across organizational boundaries without exposing raw cross-domain data, enabling Counterfactual Graph Simulation for cross-domain policy verification. We construct PhantomEcosystem, a comprehensive benchmark comprising 9 categories of realistic cross-agent violation scenarios with adversarially balanced safe controls. On this benchmark, Distributed Sentinel achieves F1 = 0.95 with 106ms end-to-end latency (16ms verification + 90ms entity extraction on A100), compared to 0.85 F1 for prompt-based filtering and 0.65 for rule-based DLP. To empirically validate the need for external enforcement, we evaluate eight frontier LLMs in execution-oriented multi-agent workflows with per-agent domain world models. All models exhibit substantial violation rates (14-98%), with cross-domain data flows showing systematically higher violation rates than same-domain flows. These results indicate that self-avoidance is unreliable and that multi-agent security benefits from a centralized enforcement layer operating above individual agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。