让大模型代理在使用外部工具时能安全恢复，避免信息泄露。
APPA: Recoverable Information-Flow Control for Real-World LLM Agents
- 用双阶段监控机制，提前评估工具调用，事后验证输出
- 在6600次测试中保持64.2%-91%功能可用性，零攻击成功
- 适合部署在企业级工具链中的大模型代理系统
实际应用中，大模型代理常混合私密上下文、不可信工具与网络输出、外部副作用。传统信息流控制依赖单调污染追踪，要么过度阻断正常操作，要么一旦引入未审核数据就永久中断执行。本文提出APPA（代理权限策略代数），将代理信息流控制从仅终止的屏障转变为可策略驱动的恢复系统。APPA在工具调用和协议网关（如模型上下文协议）处实施双阶段参考监视：调用前前瞻性评估复合标签限制与工作流历史；完成后验证实际输出再决定是否纳入上下文。为支持无标注工具的渐进部署，引入有界类型转换的渐进安全类型系统。为在不污染主上下文前提下检查不可信数据，提出按需轨迹隔离：临时子分支局部吸收污染，通过形状限定通道（attest-schema）退出，精确保留父标签与转录记录，避免永久分割的多代理架构。我们证明核心安全不变量：无清洗的渐进解析、分支边界隔离、对提示注入模型的恢复容错。在涵盖OWASP AgentThreatBench与企业工作流（Bench-Corp）的6,600个受控基准实验中，APPA在1,320个受保护实验中实现64.2%-91%功能利用率且零攻击发生，建立可部署的工具型代理实用防御方案。
原文摘要 · Abstract (English)
LLM agents deployed in practical workflows routinely mix private context, untrusted tool and web outputs, and external side effects. While information-flow control (IFC) provides structural defenses against prompt injection, data exfiltration, and confused-deputy attacks, conventional IFC relies on monotone taint tracking that either over-blocks benign operations or permanently strands downstream execution once an agent ingests unvetted data. We present APPA (Agentic Permissions Policy Algebra), which turns agent IFC from an abort-only barrier into a policy-governed recovery system. APPA enforces a dual-phase reference monitor at tool dispatch and protocol gateways (e.g., Model Context Protocol): before tool execution, it prospectively evaluates composite label restrictions and workflow history; upon completion, it validates realized outputs before context admission. For incremental rollout across unannotated tools, APPA incorporates gradual security typing with bounded cast resolution. To inspect untrusted data without poisoning primary agent context, APPA introduces on-demand trajectory confinement: disposable child branches absorb taint locally and exit through shape-bounded channels (attest-schema) with exact parent-label and transcript preservation, avoiding permanently partitioned multi-agent infrastructure. We prove core safety invariants: no-laundering gradual resolution, branch boundary isolation, and recovery containment against prompt-injected models. Across 6,600 controlled benchmark episodes spanning OWASP AgentThreatBench and enterprise workflows (Bench-Corp), APPA sustains 64.2-91% utility with zero observed attacks across 1,320 guarded episodes, establishing a practical defense for deployed tool-using agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。