攻击分布熵决定LLM安全监控器覆盖率，高熵时监控几乎失效。
Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety
- 用攻击模式的分布熵解释监控覆盖率差异，熵越低覆盖越好
- 实测8个模型中，熵高者覆盖率仅6-13%，熵低者达68-75%
- 提出部署前熵测试，可提前预测监控有效性，适合安全设计者
基于线性时序逻辑（LTL）和有限状态自动机（FSA）的运行时安全监控器被广泛用于拦截大语言模型（LLM）代理的危险工具调用序列。然而，同一监控器在不同模型架构上的攻击覆盖率从68-75%到接近零不等，且无法通过模型能力、训练数据或提示设计解释。本文提出理论解释：任何固定不变量的FSA监控器召回率上限由攻击分布的集中度决定——即前k个最频繁的触发-完成模式所占比例。当攻击高度集中（熵低，如H ~ 0.24比特，一种模式覆盖96%），小规模不变量集可实现高召回；当攻击分散于大量结构不同的模式中（熵高，如H ~ 2.81比特，7个聚类各≤7%），即使最优构造也无法获得良好覆盖率。我们在8个前沿LLM架构上验证了该熵-覆盖率边界，熵解释了76%的覆盖率方差（皮尔逊相关系数r = -0.87，p = 0.005，95%置信区间[-0.98, -0.78]），且在留一法下保持稳定（r ∈ [-0.91, -0.82]）。我们引入一种预部署熵测试，仅需少量攻击样本即可预测监控覆盖率，实现架构感知的监控选型。该边界与测试方法具有架构无关性，适用于任何基于FSA的离散动作序列运行时监控。
原文摘要 · Abstract (English)
Runtime safety monitors based on Linear Temporal Logic (LTL) and finite automata (FSA) are increasingly deployed to intercept unsafe tool-call sequences in LLM agents. Yet the same monitor achieves 68-75% attack coverage on some model architectures and near-zero on others, with no explanation from capability scores, training data, or prompt design. We provide the missing theory. We prove that the recall of any fixed-invariant FSA monitor is bounded above by the concentration of the attack distribution: the fraction of attacks covered by the k most frequent trigger-completion patterns. When attacks concentrate (low Shannon entropy), a small fixed invariant set achieves high recall; when they disperse across many structurally distinct patterns (high entropy), no fixed invariant set of tractable size can, regardless of how the invariants were derived. We validate this entropy-coverage bound across eight frontier LLM architectures. GPT-class and DeepSeek backends yield highly concentrated attacks (H ~ 0.24 bits; one pattern covers 96%), explaining 68-75% recall; Gemini variants yield high-entropy distributions (H ~ 2.81 bits; 7 clusters each <= 7%), explaining near-zero recall (6-13%), invariant to architecture-matched retraining. Entropy accounts for 76% of variance in coverage (Pearson r = -0.87, p = 0.005, 95% CI [-0.98, -0.78]), holding under leave-one-out (r in [-0.91, -0.82]). We introduce a pre-deployment entropy test that predicts monitor coverage from a small attack sample, enabling architecture-aware monitor selection before deployment. The bound and test are architecture-agnostic and apply to any FSA-based runtime monitor over discrete action sequences.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。