强制良性轨迹：一种用于结构化工作流AI代理的行为防火墙
Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents
AI总结：
本文提出了一种基于 telemetry 的行为异常检测防火墙，通过构建参数化确定性有限自动机来限制工具调用序列，从而降低攻击成功率，同时保持低延迟和低误报率。
摘要：
结构化工作流代理由大语言模型驱动，执行对敏感外部环境的工具调用。我们提出 \codename，一种基于 telemetry 的行为异常检测防火墙。借鉴基于序列的入侵检测，\codename 将已验证的良性工具调用 telemetry 编译成参数化确定性有限自动机 (pDFA)。该模型定义了允许的工具序列、顺序上下文和参数边界。在运行时，一个轻量级网关通过 O(1) 状态转移结构查找来强制这些边界，将计算密集型分析完全移至离线处理。在 Agent Security Bench (ASB) 上评估，\codename 在五个场景中实现了 5.6% 的宏平均攻击成功率 (ASR)。在三个结构化工作流中，ASR 降至 2.2%，优于 Aegis，一种最先进的无状态扫描器 (12.8%)。在结构化设置中，\codename 在多步骤和上下文顺序攻击中实现了 0% 的 ASR。此外，针对 1,000 个算法拼接的外泄负载，只有 1.4% 匹配有效的结构路径，所有这些路径均在端到端字符串参数守护中失败 (0 成功 out of 14 生存路径，95% CI [0%, 23.2%])。\codename 在保持 2.0% 的良性任务失败率 (BTFR) 上实现了 2.2 ms 的每调用延迟 (比 Aegis 快 3.7 倍)。建模行为轨迹有效地缩小了可用攻击面，但未维护的连续参数边界仍易受同义词替换攻击 (18% 逃避率)。因此，对敏感参数的精确匹配白名单最终承担了最终的防御责任。
英文摘要：
Structured-workflow agents driven by large language models execute tool calls against sensitive external environments. We propose \codename, a telemetry-driven behavioral anomaly detection firewall. Drawing on sequence-based intrusion detection, \codename\ compiles verified benign tool-call telemetry into a parameterized deterministic finite automaton (pDFA). The model defines permitted tool sequences, sequential contexts, and parameter bounds. At runtime, a lightweight gateway enforces these boundaries via an $O(1)$ state-transition structural lookup, shifting computationally expensive analysis entirely offline. Evaluated on the Agent Security Bench (ASB), \codename\ achieves a 5.6\% macro-averaged attack success rate (ASR) across five scenarios. Within three structured workflows, ASR drops to 2.2\%, outperforming Aegis, a state-of-the-art stateless scanner, at 12.8\%. \codename\ achieves 0\% ASR on multi-step and context-sequential attacks in structured settings. Furthermore, against 1,000 algorithmically spliced exfiltration payloads, only 1.4\% matched valid structural paths, all of which failed end-to-end string parameter guards (0 successes out of 14 surviving paths, 95\% CI [0\%, 23.2\%]). \codename\ introduces just 2.2~ms of per-call latency (a 3.7$\times$ speedup over \textsc{Aegis}) while maintaining a 2.0\% benign task failure rate (BTFR) on benign workloads. Modeling the behavioral trajectory effectively collapses the available attack surface, but unmaintained continuous parameter bounds remain vulnerable to synonym-substitution attacks (18\% evasion rate). Thus, exact-match whitelisting of sensitive parameters ultimately bears the final defensive load against execution.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
