解决大模型代理重复执行授权问题，确保一次授权不被滥用。
Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions
- 引入CapLease机制，绑定用户确认与操作，实现事务式授权流程。
- 实验表明，仅依赖单次令牌无法防重放，必须持久化授权状态。
- 适合需高安全性的代理系统、自动化任务平台等场景。
使用工具的大模型代理常需重新规划、重试失败操作、任务委派及崩溃后恢复。这些行为可能导致同一用户授权在不同新令牌标识下多次请求和执行，即使每个令牌本身为单次使用。我们称此为语义重放：超出令牌独立授权实例的执行预算，而非简单重复使用旧令牌。研究表明，仅靠标识符局部的令牌消耗无法防止新令牌的重复发放，除非颁发方维持关于授权动作、确认事件和剩余执行预算的持续性持久状态。本文提出CapLease授权消耗层，采用提案与权限层级防御策略，将已认证的用户确认绑定至标准操作，并强制执行事务式“发放-准备-提交”流程。在大模型代理的重规划、重试、委派、并发、确认重放及崩溃恢复等场景中，标识符局部令牌允许新的语义重放，而CapLease与同等状态的服务器账本则可阻止重复准入，并在幂等接收端避免重复外部效应。结果表明，防止重放的关键在于持久授权状态，而非令牌表示本身。
原文摘要 · Abstract (English)
Tool-using large language model agents frequently replan, retry failed operations, delegate tasks, and resume after crashes. These behaviors can cause one user authorization to be requested and executed multiple times under freshly issued token identifiers, even when each individual token is single-use. We call this failure semantic replay: exceeding the execution budget of a token-independent authorization instance rather than merely reusing an old token identifier. We show that identifier-local token consumption cannot prevent fresh reissuance unless the issuer retains monotonic durable state over the authorized action, confirmation event, and remaining execution budget. We introduce CapLease, an authorization-consumption layer that follows proposal- and authority-level defenses, binds an authenticated user confirmation to a canonical action, and enforces transactional Issue-Prepare-Commit transitions. Across LLM-agent replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios, identifier-local tokens permit fresh semantic reissuance, whereas CapLease and an equally stateful Server Ledger prevent duplicate admission and, with an idempotent sink, duplicate external effects. Our results identify durable authorization state, rather than token representation alone, as the systems requirement for replay-resistant agent execution.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。