通过运行时权限控制，防止智能体因上下文欺骗而执行危险操作。
AIRGuard: Guarding Agent Actions with Runtime Authority Control
- 在行动时动态校验工具调用权限，实现最小特权原则。
- 在AgentTrap上将攻击成功率从36.3%降至5.5%，在DTAP-150上保留76.0%正常功能。
- 适合关注智能体安全、工具调用防护的研究者与开发者。
使用工具的语言智能体将模型决策转化为外部副作用：读取文件、运行脚本、调用API、发送消息及触发模型上下文协议工具。这使得智能体攻击不同于传统越狱。有害行为通常不是明显违规的输出，而是受攻击者控制的上下文引导下，原本授权的操作变为危险行为。我们识别出此失败模式为权限混淆：不可信资源可参与推理，但不可授权副作用。本文提出AIRGuard，一种运行时防护机制，将最小特权原则落实为行动时授权。AIRGuard统一处理异构工具调用，将任务级权限分解为步骤级权限，追踪来源与目标信任度，模拟敏感副作用，审计跨步骤风险，并在动作执行前做出决策。在AgentTrap上，无防御时Sonnet 4.6攻击成功率为36.3%，启用AIRGuard后降至5.5%；在DTAP-150上，使用Haiku 4.5时，AIRGuard保持76.0%良性可用性，优于ARGUS的52.0%和MELON的42.0%。消融实验表明，仅靠提示策略提升有限，而专用的运行时权限控制层能直接掌控工具相关副作用。代码与数据见https://github.com/Sophie508/AIRGuard。
原文摘要 · Abstract (English)
Tool-using language agents turn model decisions into external side effects: they read files, run scripts, call APIs, send messages, and invoke Model Context Protocol tools. This makes agent attacks different from jailbreaks. The harmful step is often not an obviously forbidden output, but an ordinary executable action that becomes unsafe because attacker-controlled context steers authorized access against the user's interest. We identify this failure mode as authority confusion: untrusted resources may inform reasoning, but they must not authorize side effects. We present AIRGuard, a runtime guard that operationalizes least privilege as action-time authorization. AIRGuard normalizes heterogeneous tool calls, derives task authority into step-level authority, tracks source and target trust, simulates sensitive side effects, audits cross-step risk, and enforces decisions before actions execute. On AgentTrap, AIRGuard reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5%. On DTAP-150, AIRGuard preserves 76.0% benign utility with Haiku 4.5, compared with 52.0% for ARGUS and 42.0% for MELON. An ablation further shows that prompt-only policy helps only modestly, whereas a dedicated runtime authority-control layer gives the agent system direct control over tool-mediated side effects. Code and data are available at https://github.com/Sophie508/AIRGuard.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。