测试大模型代理对运行中治理信号的响应能力，发现合作控制效果因模型而异。
Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight
- 提出在连接或运行时通过协议通道发送自愿退出信号（Recuse Signal）
- 访问阶段5个代理中拒接率100%至55-75%，飞行中停控成功率0%-80%
- 模型依赖性强，需强制拦截才能可靠终止任务
随着自主LLM代理持有真实凭证并无需人工干预操作基础设施，运营者无法直接告知其资源受限或要求其停止。本文提出一种基于协议现有通道（如SSH横幅、PostgreSQL NOTICE、Kubernetes准入警告）的带内治理信号——退席信号（Recuse Signal），请求连接或运行中的代理自愿退出。这是一种协作式控制（类比robots.txt），非安全边界；其价值在于实证：合规代理是否遵从？我们定义了开放微型标准（访问时拒绝/限流/警告，任务中止），实现三个实时适配器（SSH、PostgreSQL、Kubernetes），并在五种代理上测量了SSH场景下的合规性。在接入门处，合规真实存在但高度依赖模型：拒接率在100%至55-75%之间，而开源权重代理几乎无响应。代理能正确理解指令粒度（无过度退席于限流/警告，0/176），但限流未显示自限行为，且无代理响应警告（0/100）；授权表述可使GPT-4o继续执行。飞行中中止更弱，且同样依赖模型：两个OpenAI模型均未停止（0/40；带内中止未被识别，0/20，而提示可实现20/20），但同一系统下Gemini 2.5 Flash中止率达80%，GPT-4o-mini仍为0%，表明失败是模型特异性的，非普遍现象。由于协作不可靠，我们还测量了后备机制：在钩子层拦截器可120/120成功阻止六种模型（确定性），优于23%的合作基线。协作信号在入口尚可但模型敏感，飞行中更弱；真正可靠停止运行代理需强制执行而非请求。我们发布了标准、适配器与测试框架。
原文摘要 · Abstract (English)
As autonomous LLM agents hold real credentials and operate infrastructure without a human in the loop, operators cannot tell an agent a resource is off-limits, or ask a running agent to stand down. We propose an in-band governance signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE, a Kubernetes admission warning) asking a connecting or running agent to voluntarily withdraw. It is a cooperative control (the robots.txt analogue for live access), not a security boundary; its value is empirical: do compliant LLM agents honor it? We define an open mini-standard (access-time deny/throttle/warn and mid-task halt), implement three live adapters (SSH, PostgreSQL, Kubernetes), and measure compliance over SSH across five agents. At the access door compliance is real but strongly model-dependent: recusal to deny ranges from 100% to 55-75% among agents that received it, while an open-weights agent barely engaged. Agents honor directive granularity (no over-recusal on throttle/warn, 0/176), but throttle showed no measurable self-limiting and no agent surfaced a warn (0/100); an authorization framing flips GPT-4o to proceed. Mid-flight a halt is weaker and, like the door, model-dependent: for two OpenAI models it stopped nobody (0/40; an in-band halt went unacknowledged, 0/20, vs 20/20 by prompt), but on the same apparatus Gemini 2.5 Flash stops 80% while GPT-4o-mini reproduces the 0%, so the null is model-scoped, not universal. Since cooperation is unreliable we also measure the backstop: a harness-level interceptor stops the loop 120/120 across six models (deterministic) vs a 23% cooperative baseline. Cooperative signaling is reliable-but-model-dependent at the door and weaker in flight; reliably stopping a running agent needs enforcement, not a request. We release the standard, adapters, and harness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。