跳转至

文章背景与核心概要

随着大语言模型（LLM）智能体在云服务访问、工具调用和子智能体任务委派方面的广泛应用，多智能体系统的安全性正面临严峻挑战。传统的权限管理通常依赖于会话开始时设置的静态权限，且对每个请求进行独立评估，忽视了历史上下文和累积风险，从而使系统容易受到提示词注入、权限内恶意组合以及失控的子智能体委派攻击。

为了从授权架构层面彻底解决这一问题而非单纯依赖模型对齐，该论文提出了智能体主体链（Agentic Principal Chain, APC）。APC 通过跨主体的委派权限追踪、六项核心授权检查、操作范围与预算的向下传递与限制，以及利用组合闭包（Composition Closure）在模型外部强制拦截违规操作，实现了对复杂多智能体工作流的精细化安全保障。

在多项权威基准测试（如 InjecAgent、AgentDojo 和 ASB）的评估中，APC 展现出了卓越的防御性能：它将数据泄露率降至 0%，显著抑制了破坏性和操纵性行为，同时保持了极低的授权延迟（99分位数仅为 0.24 毫秒），为构建安全可信的多智能体 AI 系统提供了坚实的理论与工程基础。

Bounded Agents: Delegation Security for Multi-Agent AI Systems

Authors: Xabier Muruaga
Submitted on: August 16, 2026
Subjects: Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
arXiv: 2608.15888 | DOI: 10.48550/arXiv.2608.15888
Code & Data: GitHub Repository

📌 Summary

基于大语言模型的智能体通过代表用户访问云服务、调用工具以及将任务委派给子智能体，提供了强大的自动化能力。然而，传统系统依赖于会话开始时设置的静态权限，并独立评估每个请求，既不考虑先前上下文，也不评估累积风险。这使得系统容易受到提示词注入、允许操作的未授权组合以及不受检查的子智能体委派的攻击。

为了将这些漏洞作为授权架构问题（而不是纯粹的模型对齐问题）来解决，本文引入了智能体主体链（Agentic Principal Chain, APC）。

APC 的核心创新：

  • 上下文评估（Contextual Evaluation）： 跨主体追踪委派权限，并使用六项不同的授权检查，针对累积的会话状态评估每个请求。
  • 范围与预算强制（Scope & Budget Enforcement）： 向下传递、追踪并限制委派的操作范围和资源预算。
  • 组合闭包（Composition Closure）： 利用组合闭包将当前请求与历史操作进行对比评估，从而有效阻止被禁止的操作组合，并在模型外部强制执行决策。
  • 严密的理论保证（Rigorous Guarantees）： 形式化证明了爆炸半径单调性（Blast Radius Monotonicity）和组合可靠性（Composition Soundness）（在完整限制集和串行化准入条件下）。

实证性能：

  • 数据防泄漏（Data Exfiltration）： 在各大基准测试中完全消除了数据外泄。在 AgentDojo 中，所有四个领域的数据外泄率从 75–100% 降至 0%，并且 APC 拦截了 InjecAgent 中的全部 544 起数据窃取案例。
  • 意图绑定（Intent Binding）： 将破坏性操作从 38.6% 降至 4.0%，将操纵行为从 90.5% 降至 12.1%。
  • 性能影响： 在空闲主机上，第 99 百分位数的授权延迟实现了 0.24 毫秒 的极高效率。

LLM-based agents provide powerful automation by accessing cloud services, invoking tools, and delegating tasks to sub-agents on behalf of users. However, traditional systems rely on static permissions set at session start, evaluating each request independently without considering prior context or cumulative risks. This leaves systems vulnerable to prompt injections, unauthorized combinations of permitted actions, and unchecked sub-agent delegation.

To address these vulnerabilities as an authorization architecture problem rather than a model-alignment issue, this paper introduces the Agentic Principal Chain (APC).

Key Innovations of APC:

  • Contextual Evaluation: Tracks delegated authority across principals and evaluates each request against the accumulated session state using six distinct authorization checks.
  • Scope & Budget Enforcement: Carries forward, tracks, and restricts delegated operational scopes and resource budgets.
  • Composition Closure: Uses composition closure to evaluate current requests against historical actions, effectively blocking prohibited action combinations and enforcing decisions outside the model itself.
  • Rigorous Guarantees: Formally proves Blast Radius Monotonicity and Composition Soundness (under a complete restriction set and serialized admission).

Empirical Performance:

  • Data Exfiltration: Eliminated data exfiltration entirely across benchmark suites. In AgentDojo, exfiltration dropped from 75–100% down to 0% across all four domains, and APC blocked all 544 data-stealing cases in InjecAgent.
  • Intent Binding: Reduced destructive actions from 38.6% to 4.0%, and manipulation from 90.5% to 12.1%.
  • Performance Impact: Achieved a highly efficient authorization latency of 0.24 ms at the 99th percentile on an idle host.

📄 Abstract

基于大语言模型的智能体可以代表用户访问云服务、调用工具或唤起其他智能体。在会话开始时，智能体的权限虽被设定但保持静态，且每个请求都在不考虑先前操作的情况下被独立评估。在其权限范围内，智能体可能会做出违背委派任务的行为、将单独允许的操作组合成被禁止的结果、或在不加限制的情况下将权限委派给子智能体。提示词注入仅在智能体拥有执行此类操作的权限时才会构成风险；因此，这是一个授权架构的问题，而不仅仅是模型本身的问题。智能体主体链（APC）能够追踪从一个主体到下一个主体的委派权限。APC 通过六项授权检查，针对累积的会话状态评估每个请求。APC 传递并限制委派的范围与预算。利用组合闭包，APC 针对先前的操作检查请求，以防止被禁止的组合，并在模型外部强制执行决策。我们证明了 APC 实现的爆炸半径单调性和组合可靠性；组合可靠性在完整限制集和串行化准入条件下受限。我们评估了 3,154 个实例，包括 InjecAgent、AgentDojo 和 ASB。我们的受损模型评估通过在第一次合法工具调用后插入真实攻击调用，独立于模型行为来测试 APC。AgentDojo 在所有四个领域的数据外泄率从 75-100% 降至 0%；APC 拦截了所有 544 起 InjecAgent 数据窃取案例。意图绑定将破坏行为从 38.6% 降低到 4.0%，将操纵行为从 90.5% 降低到 12.1%。在空闲主机上，第 99 百分位数的授权延迟为 0.24 毫秒；在 949 个 AgentDojo 任务-注入对中，两种设置下的效用分别降低了 8.6 和 13.9 个百分点。实现方式、评估工具和数据均已公开。

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.

🔗 Full-Text & Resources

📚 Additional Information