金融大模型代理的实时安全防护系统，提前拦截高风险操作。
FinHarness: An Inline Lifecycle Safety Harness for Finance LLM Agents
- 三组件嵌入式安全框架：意图监测、工具调用评估与分层验证
- 风险识别准确率提升至15.0%（原38.3%），误杀率仅下降1.8%
- 动态调度轻量/高级模型判断，节省4.7倍高级推理资源
金融领域大模型代理需同时阻止恶意指令引发的越权操作，并批准合法的多步骤业务流程。现有边界过滤常遗漏不可逆的中段工具调用，而事后大模型判别则在流程结束才介入，干预过晚且计算开销随轨迹长度线性增长。我们提出FinHarness，一种端到端嵌入式安全防护系统，包含三个模块：查询监控器融合单轮意图与跨轮次行为漂移，工具监控器评估每个潜在工具调用，级联模块根据每步风险自适应选择轻量或高级大模型判别。高风险信号被作为事前证据回注至代理输入，使代理可自主拒绝、重规划或批准。在FinVault数据集上，动态路由的FinHarness将误触发率（ASR）从38.3%降至15.0%，良性审批率维持在39.3%（原41.1%），且相比始终使用高级判别的基线，高级判别调用减少4.7倍。
原文摘要 · Abstract (English)
Finance LLM agents must simultaneously block prompt-induced unauthorized actions and approve legitimate multi-step business workflows. However, boundary filters often miss irreversible mid-trajectory tool calls, while post-hoc LLM judges perform auditing only after termination -- too late for intervention and at a computational cost that scales linearly with trace length. We present FinHarness, an inline safety harness that wraps a finance agent end-to-end with three components: a Query Monitor that fuses single-turn intent with cross-turn drift, a Tool Monitor that evaluates each prospective tool call, and a Cascade module that integrates per-step risk and adaptively routes verification between a lightweight and an advanced-tier LLM judge. Fired risk factors are re-injected into the agent input as ex-ante evidence, enabling the agent to refuse, re-plan, or approve on its own. On FinVault, routed FinHarness cuts ASR from 38.3% to 15.0% while largely preserving benign approval ($41.1\% \to 39.3\%$), and uses $4.7\times$ fewer advanced-judge calls than an always-advanced ablation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。