为自主AI代理设计全生命周期安全架构，防止漏洞跨阶段传播
AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents
- 按初始化、输入、记忆、决策、执行五阶段构建分层防御体系
- 通过跨层协同控制，在攻击传播路径上实现拦截与资产保护
- 适用于需要高可靠性与安全性的自主AI系统开发团队
自主AI代理将大语言模型扩展为完整的运行时系统，具备加载技能、接收外部内容、维持记忆、规划多步动作及调用特权工具的能力。此类系统中，安全缺陷极少局限于单一接口，而可能在初始化、输入处理、记忆、决策和执行等阶段间传播，通常仅在环境产生有害影响时才被察觉。本文提出AgentWard，一种面向生命周期的纵深防御架构，系统性地在上述五个阶段组织防护措施。AgentWard融合各阶段特有的异构控制与跨层协调机制，可在威胁传播路径上实现拦截，同时保护关键资产。我们详述了五层协同防护的设计理念与架构，并基于OpenClaw实现可插件化的原型系统，验证其可行性。该视角为构建运行时安全控制、管理信任传播与强制执行隔离提供了具体蓝图。代码已开源：https://github.com/FIND-Lab/AgentWard。
原文摘要 · Abstract (English)
Autonomous AI agents extend large language models into full runtime systems that load skills, ingest external content, maintain memory, plan multi-step actions, and invoke privileged tools. In such systems, security failures rarely remain confined to a single interface; instead, they can propagate across initialization, input processing, memory, decision-making, and execution, often becoming apparent only when harmful effects materialize in the environment. This paper presents AgentWard, a lifecycle-oriented, defense-in-depth architecture that systematically organizes protection across these five stages. AgentWard integrates stage-specific, heterogeneous controls with cross-layer coordination, enabling threats to be intercepted along their propagation paths while safeguarding critical assets. We detail the design rationale and architecture of five coordinated protection layers, and implement a plugin-native prototype on OpenClaw to demonstrate practical feasibility. This perspective provides a concrete blueprint for structuring runtime security controls, managing trust propagation, and enforcing execution containment in autonomous AI agents. Our code is available at https://github.com/FIND-Lab/AgentWard .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。