arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.07398cs.CRcs.AI
收藏

AgentSys: 通过显式分层内存管理实现安全且动态的LLM代理

AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management

Washington University in St. Louis（圣路易斯华盛顿大学）；Johns Hopkins University（约翰霍普金斯大学）

Ruoyao Wen, Hao Li, Chaowei Xiao, Ning Zhang

备注：
21 pages, 4 figures
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

AgentSys通过显式分层内存管理有效防御间接提示注入攻击，显著降低攻击成功率并提升LLM代理的安全性和动态性。

摘要：

间接提示注入通过在外部内容中嵌入恶意指令来威胁LLM代理，使代理能够执行未经授权的操作和数据窃取。LLM代理通过其上下文窗口维护工作内存，该内存存储交互历史以供决策。传统代理不加区分地将所有工具输出和推理轨迹积累在该内存中，导致两个关键漏洞：（1）注入的指令在整个工作流程中持续存在，给攻击者提供多次操纵行为的机会；（2）冗长且不必要内容会降低决策能力。现有防御措施将臃肿的内存视为给定，并专注于保持韧性，而不是减少不必要的积累以防止攻击。我们提出了AgentSys，一个通过显式内存管理防御间接提示注入的框架。受操作系统进程内存隔离的启发，AgentSys将代理分层组织：主代理会派生出用于工具调用的工作者代理，每个都在隔离的上下文中运行，并能派生出嵌套工作者以处理子任务。外部数据和子任务轨迹从不进入主代理的内存；只有经过模式验证的返回值才能通过确定性的JSON解析跨边界。消融实验显示，仅隔离即可将攻击成功率降至2.19%，添加验证器/净化器进一步提高防御效果，其开销随操作数而非上下文长度而增长。在AgentDojo和ASB上，AgentSys实现0.78%和4.25%的攻击成功率，同时略微提高良性效用超过未防护的基线。它在对抗性攻击者和多种基础模型上保持稳健，表明显式内存管理能够实现安全且动态的LLM代理架构。我们的代码可在：https://github.com/ruoyaow/agentsys-memory获取。

英文摘要：

Indirect prompt injection threatens LLM agents by embedding malicious instructions in external content, enabling unauthorized actions and data theft. LLM agents maintain working memory through their context window, which stores interaction history for decision-making. Conventional agents indiscriminately accumulate all tool outputs and reasoning traces in this memory, creating two critical vulnerabilities: (1) injected instructions persist throughout the workflow, granting attackers multiple opportunities to manipulate behavior, and (2) verbose, non-essential content degrades decision-making capabilities. Existing defenses treat bloated memory as given and focus on remaining resilient, rather than reducing unnecessary accumulation to prevent the attack. We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management. Inspired by process memory isolation in operating systems, AgentSys organizes agents hierarchically: a main agent spawns worker agents for tool calls, each running in an isolated context and able to spawn nested workers for subtasks. External data and subtask traces never enter the main agent's memory; only schema-validated return values can cross boundaries through deterministic JSON parsing. Ablations show isolation alone cuts attack success to 2.19%, and adding a validator/sanitizer further improves defense with event-triggered checks whose overhead scales with operations rather than context length. On AgentDojo and ASB, AgentSys achieves 0.78% and 4.25% attack success while slightly improving benign utility over undefended baselines. It remains robust to adaptive attackers and across multiple foundation models, showing that explicit memory management enables secure, dynamic LLM agent architectures. Our code is available at: https://github.com/ruoyaow/agentsys-memory.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑