为微型设备设计轻量安全的LLM控制协议，防止幻觉和注入攻击。
Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices
- 采用50字节内帧结构与能力范围验证等协议原语，确保安全调用。
- 实测可拦截100%越权请求和78%注入攻击，远超现有方案。
- 适合嵌入式设备、物联网安全控制等资源受限场景使用。
大型语言模型正通过模型上下文协议（MCP）协调外部工具，但传统MCP面向拥有兆字节内存的软件服务，无法适配主流的微控制器。近期工作（IoT-MCP）将MCP移植至边缘网关，峰值内存达74 KB，仍无法覆盖最小商用MCU，且未解决不可靠调用者（如可能幻觉或被提示注入的LLM）直接控制物理硬件的安全问题。本文提出设备上下文协议（DCP）：典型帧小于50字节（6字节头 + CBOR载荷 + 可选16字节HMAC），在协议层原生支持能力作用域、取值范围与类型检查、预演评估及单位即类型机制，并通过主机端桥接器在指令抵达设备前拦截畸形或幻觉调用。参考固件在ESP32上仅需27.6 KB闪存/0.6 KB RAM；Python桥接器、ESP32固件及语言无关一致性测试套件均已开源。一项实证研究显示，五家厂商（DeepSeek、阿里、智谱、MiniMax）的5个LLM在六类对抗性提示下生成675次工具调用，其中基于AgentDojo攻击模板的注入攻击测试表明，DCP成功拦截100%越权尝试与78%提示注入，而原始MCP与IoT-MCP的拦截率仅为0-1%，在仅占其千分之一固件体积的前提下，表达能力媲美完整OpenAPI 3规范。我们定位DCP为连接日益企业化的MCP与实际物理设备之间的缺失环节。
原文摘要 · Abstract (English)
Large language models are increasingly used as orchestrators of external tools via the Model Context Protocol (MCP), but MCP is built for software services with megabytes of memory and does not descend to the microcontrollers that dominate the long tail of physical devices. Recent work (IoT-MCP) ports MCP to edge gateways at 74 KB peak memory; this still excludes the smallest commodity MCUs and, critically, does not address the safety problem of giving an unreliable caller (an LLM that may hallucinate or be prompt-injected) direct control of physical hardware. We present the Device Context Protocol (DCP): a sub-50-byte typical frame (6-byte header + CBOR payload + optional 16-byte HMAC), a manifest schema in which capability scoping, range and type checks, dry-run evaluation, and units-as-types are protocol-layer primitives, and a host-side Bridge that rejects malformed or hallucinated calls before any byte reaches the device. Reference firmware measures 27.6 KB flash / 0.6 KB RAM on ESP32; the Python Bridge, ESP32 firmware, and a language-neutral conformance suite are MIT-licensed and public. An empirical study -- 675 tool calls produced by five LLMs across four vendors (DeepSeek, Alibaba, Zhipu, MiniMax) against six categories of adversarial prompts, with the injection category instantiating AgentDojo's attack templates -- shows DCP rejects 100% of capability-escalation attempts and 78% of prompt-injection attempts, versus 0--1% for Raw MCP and IoT-MCP, matching the expressiveness of a well-formed OpenAPI 3 schema at three orders of magnitude less firmware footprint. We position DCP as the missing layer between MCP (which is moving toward enterprise SaaS connectivity) and the physical devices it does not reach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。