为多智能体系统设计安全授权机制，防止权限滥用和恶意组合。
Bounded Agents: Delegation Security for Multi-Agent AI Systems
- 通过追踪代理权限传递链，动态限制委托范围和预算。
- 在3154次测试中，数据泄露率从75%-100%降至0%，攻击成功率归零。
- 适合关注AI代理安全、权限控制的开发者与研究人员。
基于大模型的智能体可代表用户访问云服务、调用工具或调用其他智能体。会话开始时权限被设定但保持静态，每次请求独立评估，不考虑先前行为。在权限范围内，智能体可能违背委托任务，将多个允许操作组合成禁止结果，或无限制地委派子代理。提示注入风险仅当智能体有执行权限时才存在，问题本质是授权架构而非模型本身。代理主事链（APC）追踪从一个主体到下一个的委托权限，使用六项授权检查对每个请求进行评估，并基于会话状态累积结果。APC持续传递并限制委托范围与预算。通过组合闭包机制，检查请求是否导致禁止组合，并在模型外部强制执行决策。我们证明了APC实现的爆炸半径单调性与组合正确性；组合正确性在完整限制集和串行准入条件下成立。评估涵盖3,154个实例，包括InjecAgent、AgentDojo和ASB。通过在首次合法工具调用后插入真实攻击调用，独立于模型行为测试了APC。AgentDojo的数据外泄率从75%-100%降至0%；所有544个InjecAgent数据窃取案例均被阻止。意图绑定使破坏率从38.6%降至4.0%，操纵率从90.5%降至12.1%。授权延迟在空闲主机上为0.24毫秒（第99百分位），在949对任务注入场景中，效用分别下降8.6和13.9个百分点。实现代码、评估工具与数据均已公开。
原文摘要 · Abstract (English)
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。