跳转至

自由派生，审慎行动：递归大模型智能体树的渐进风险归属机制

文章背景与核心概要

递归式大模型（LLM）智能体通过动态派生专家子智能体，能够显著增强其搜索能力。然而，随着这些分支不断深入，它们经常会请求具备发送外部数据或部署代码能力的“高风险”工具。这种无节制的扩展可能带来安全隐患和不可控的资源消耗。

本文引入了渐进风险归属（Progressive Risk Vesting, PRV）这一理论框架。该框架通过将风险预算进行托管（Escrow），并在特定智能体分支跨越不可逆操作边界时进行扣除，从而实现对轨迹级风险的管理。通过严格的形式化证明、程式化分支模型以及占用模型，该研究确立了平衡安全沙盒内的广泛探索性搜索与递归权限的谨慎、显式风险计费的基本设计规则。

执行摘要 (Executive Summary)

递归大模型（LLM）智能体通过动态派生专家子智能体，可以极大地增强其搜索能力。然而，随着这些分支不断深入，它们往往会请求能够发送外部数据或部署代码的高风险工具。

本文引入了渐进风险归属（PRV）这一理论框架，通过将风险预算进行托管，并在特定智能体分支跨越不可逆操作边界时才对其进行扣除，从而管理轨迹级别的风险。通过形式化证明、程式化分支模型和占用模型，该研究建立了基本的设计规则，用于平衡安全沙盒中的广泛探索性搜索与递归权限的谨慎、显式风险计费。

Executive Summary

Recursive Large Language Model (LLM) agents can dramatically enhance their search capabilities by dynamically spawning specialist sub-agents. However, as these branches grow deeper, they often request high-stakes tools capable of sending external data or deploying code.

This paper introduces Progressive Risk Vesting (PRV), a theoretical framework that manages trajectory-level risk by holding risk budgets in escrow and debiting them only when specific agent branches cross irreversible-action boundaries. Through formal proofs, stylized branching models, and occupancy models, the research establishes fundamental design rules for balancing broad exploratory search in safe sandboxes with the cautious, explicit risk-charging of recursive authority.

核心概念与机制 (Key Concepts & Mechanisms)

  • 沙盒派生与能力激活：
    • 沙盒派生： 在智能体探索分支时，实施外部控制以防止发生指定的危害。
    • 能力激活： 选定的分支跨越不可逆操作边界，获得执行高风险操作的主动权限。
  • 渐进风险归属（PRV）： 一种将轨迹级风险预算进行托管的方法，随着各个智能体分支的激活安全地扣除风险。
  • 设计规则： “在沙盒中广泛搜索，审慎授予递归权限，并进行显式风险计费。”

Key Concepts & Mechanisms

  • Sandbox Spawning vs. Capability Activation:
    • Sandbox Spawning: External controls are implemented to prevent specified harms while the agent explores branches.
    • Capability Activation: A selected branch crosses an irreversible-action boundary, receiving active authority to execute high-stakes operations.
  • Progressive Risk Vesting (PRV): A methodology that holds a trajectory-level risk budget in escrow, safely debiting it as individual agent branches are activated.
  • Design Rule: "Search broadly in the sandbox and grant recursive authority sparingly, with an explicit risk charge."

理论发现 (Theoretical Findings)

  1. 任意时间危害界限（Anytime Harm Bounds）： 本文证明了自适应生成树的任意时间危害界限。即使分支结果是相关的，局部证书在条件化完整的预激活历史记录时仍然有效。
  2. 延迟归属（Delayed Vesting）： 当激活门槛、分支费用和计算约束保持固定时，延迟归属保留了不可撤销派生计费下的所有可用策略。
  3. 临界阈值 (\(\mathcal{R}_A\))： 在程式化分支模型中，当权限再生数跨越 \(1\) 时，轨迹危害会动态缩放：
  4. 低于临界值 (\(p \to 0\))： 轨迹危害与局部风险 \(p\) 成正比。
  5. 达到临界值： 轨迹危害与 \(\sqrt{p}\) 成正比.
  6. 高于临界值： 轨迹危害保持一个正向的下限底线。
  7. 影子价格（Shadow Prices）： 有限类型占用模型生成了风险和计算影子价格，为表现出单位风险边际价值递减的嵌套扇出模式建立了一个清晰的阈值规则。

Theoretical Findings

  1. Anytime Harm Bounds: The paper proves an anytime harm bound for adaptively generated trees. Even when branch outcomes are dependent, local certificates remain valid conditional on the full pre-activation history.
  2. Delayed Vesting: When activation gates, branch charges, and compute constraints are held fixed, delayed vesting preserves every policy available under irrevocable spawn charging.
  3. Criticality Thresholds (\(\mathcal{R}_A\)): In a stylized branching model, trajectory harm scales dynamically as the authority reproduction number crosses \(1\):
  4. Below criticality (\(p \to 0\)): Trajectory harm is directly proportional to local risk \(p\).
  5. At criticality: Trajectory harm is proportional to \(\sqrt{p}\).
  6. Above criticality: Trajectory harm retains a positive floor.
  7. Shadow Prices: A finite-type occupancy model generates risk and compute shadow prices, establishing a clear threshold rule for nested fanout modes that exhibit decreasing marginal value per unit risk.

获取与资源 (Access & Resources)

Access & Resources