用行为轨迹防火墙拦截大模型代理的恶意工具调用。
Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents
- 构建参数化确定性有限自动机，固化合法工具调用序列与上下文。
- 在五种场景下攻击成功率降至5.6%，结构化工作流中仅2.2%。
- 每调用一次仅增加2.2毫秒延迟，适合高实时性系统部署。
由大语言模型驱动的结构化工作流代理需调用敏感外部工具。本文提出\codename，一种基于遥测的行为异常检测防火墙。借鉴序列入侵检测思想，\codename将经过验证的良性工具调用遥测数据转化为参数化确定性有限自动机（pDFA），定义允许的工具序列、上下文关系及参数范围。运行时，轻量级网关通过O(1)状态转移查找强制执行边界，将计算密集型分析全部移至离线阶段。在Agent Security Bench（ASB）上评估，\codename在五个场景下实现5.6%的宏平均攻击成功率（ASR）；在三个结构化工作流中，该值降至2.2%，优于当前最优无状态扫描器Aegis的12.8%。对多步和上下文序列攻击，其在结构化环境下达到0%的ASR。面对1,000个算法拼接的泄露载荷，仅有1.4%匹配有效结构路径，且所有存活路径均因字符串参数校验失败而未成功（0/14成功，95%置信区间[0%, 23.2%]）。\codename引入仅2.2毫秒/调用的延迟（比Aegis快3.7倍），同时在良性负载上保持2.0%的良性任务失败率（BTFR）。建模行为轨迹有效压缩攻击面，但持续的参数边界仍易受同义替换攻击（18%绕过率）。因此，敏感参数的精确匹配白名单仍是最终防御屏障。
原文摘要 · Abstract (English)
Structured-workflow agents driven by large language models execute tool calls against sensitive external environments. We propose \codename, a telemetry-driven behavioral anomaly detection firewall. Drawing on sequence-based intrusion detection, \codename\ compiles verified benign tool-call telemetry into a parameterized deterministic finite automaton (pDFA). The model defines permitted tool sequences, sequential contexts, and parameter bounds. At runtime, a lightweight gateway enforces these boundaries via an $O(1)$ state-transition structural lookup, shifting computationally expensive analysis entirely offline. Evaluated on the Agent Security Bench (ASB), \codename\ achieves a 5.6\% macro-averaged attack success rate (ASR) across five scenarios. Within three structured workflows, ASR drops to 2.2\%, outperforming Aegis, a state-of-the-art stateless scanner, at 12.8\%. \codename\ achieves 0\% ASR on multi-step and context-sequential attacks in structured settings. Furthermore, against 1,000 algorithmically spliced exfiltration payloads, only 1.4\% matched valid structural paths, all of which failed end-to-end string parameter guards (0 successes out of 14 surviving paths, 95\% CI [0\%, 23.2\%]). \codename\ introduces just 2.2~ms of per-call latency (a 3.7$\times$ speedup over \textsc{Aegis}) while maintaining a 2.0\% benign task failure rate (BTFR) on benign workloads. Modeling the behavioral trajectory effectively collapses the available attack surface, but unmaintained continuous parameter bounds remain vulnerable to synonym-substitution attacks (18\% evasion rate). Thus, exact-match whitelisting of sensitive parameters ultimately bears the final defensive load against execution.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。