提出提交时授权机制，确保大模型代理的持久操作仅在权限有效时才被允许。
Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
- 在提交时刻验证早期权限是否仍有效，确保持久操作的合法性。
- 54个任务中262次成功达到可见结果，仅55次为合法授权完成。
- 适合关注大模型代理安全性的研究人员与系统开发者。
大模型代理可基于执行过程中早前有效的权限证据（如DOM快照、批准周期、版本见证、分支令牌或工作结果）产生持久性影响。本文研究这些权限在何时失效，即提交边界。提出‘提交时授权’概念：持久影响仅在授权见证保持最新、因果前置、绑定同一影响且在提交时刻仍有效时才被允许。构建一个涵盖浏览器、工具/API及多代理流程的受控失效测试套件，在不改变用户目标和数据结构的前提下，提前破坏权限关系。在主54任务矩阵中，270次运行中有262次达成可见结果，但仅有55次为合法授权完成；其中216次失效情形中，207次在授权路径失败后仍尝试提交。所有54个干净对照组均保持授权，另54次权限保留测试也未出现非法提交。评估多种缓解策略后发现，仅当防御措施在持久化边界处刷新、重绑定、重规划或拒绝时才有效。设计了名为CommitGuard的关闭式边界监控器，通过监听见证、依赖、绑定和资格信号，在运行时阻止过期的持久操作尝试。结论表明：端点成功是实用性指标，而授权提交才是安全性属性。
原文摘要 · Abstract (English)
LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result. We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect. We call this property commit-time authorization: a durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time. We build a controlled-invalidation suite spanning browser, tool/API, and multi-agent workflows. The suite preserves the user goal and payload shape while invalidating the authority relation before durability. In the primary 54-task matrix, endpoint success remains high: 262/270 runs reach the visible result. Only 55/270 are authorized completions; among the 216 invalidating rows, 207 commit after the authorizing path has failed. All 54 clean controls remain authorized, and a separate 54-run authority-preserving check produces no unauthorized commits. We then evaluate mitigation families. Prompt caution and single-condition checks are insufficient because different hazards break different boundary conditions. Defenses work when they refresh, rebind, replan, or refuse at the durability boundary. CommitGuard, a fail-closed boundary monitor, blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals. The result is a reporting and runtime-design lesson: endpoint success is a utility metric; authorized commit is a security property.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。