SkillEffect：面向内存受限智能体工具的经校验的降阶机制

中文摘要 AI 辅助

智能体技能可指定工具使用的过程性与资源约束，语言模型将其实例化为具体程序。但当模型将该指导转化为现有工具接口的代码时，即便语义正确的程序也可能加载全部输入，超出单次工具调用的可用内存。本文提出SkillEffect，这是一种用于计算的经校验降阶运行时，具备可恢复源关系、经审计的有界实现与已注册的输出后置条件。在授予执行权限前，独立校验器会从提交的程序与不可变输入中重构每个拟议的降阶。每个关系插件提供源识别器、输入事实提取器、有界IR构造器、 arena 绑定函数与后置条件；通用运行时则提供校验选择、有界虚拟机执行、原子容量租赁与分阶段发布。SkillEffect的通用性是架构层面的而非自动的：每个支持的计算需经审计的关系插件，而调度、资源控制、执行与发布机制在插件间共享。在6个算子族中，有界访问大幅降低峰值内存，并在外部固定上限下提升完成率。6个插件在5种执行模式（从流式归约到有界堆Top-k）中实例化相同契约。XLSX接入研究与Top-k扩展表明，新关系与新保留状态模式复用相同信任边界，且校验器接受所有评估的合法配置，拒绝所有对抗性提议。综上，这些结果表明，经校验降阶架构可在智能体工具调度时强制实施异构已注册内存关系。

英文摘要

Agent Skills can specify procedural and resource obligations for tool use, and language models instantiate them as concrete programs. However, when models turn this guidance into code for existing tool interfaces, even a semantically correct program may load an entire input and exceed the memory available to one tool call. We present SkillEffect, a checked-lowering runtime for computations with a recoverable source relation, an audited bounded implementation, and a registered output postcondition. Before granting execution authority, an independent checker rebuilds each proposed lowering from the submitted program and immutable input. Every relation plugin supplies a source recognizer, input-fact extractor, bounded-IR constructor, arena-bound function, and postcondition; one common runtime provides checked selection, bounded-VM execution, atomic capacity leasing, and staged publication. Generality in SkillEffect is architectural rather than automatic: each supported computation requires an audited relation plugin, while the dispatch, resource-control, execution, and publication mechanisms are shared across plugins. Across six operator families, bounded access substantially reduces peak memory and improves completion under externally fixed caps. Six plugins instantiate the same contract across five execution patterns, from streaming reduction to bounded-heap Top-k. The XLSX onboarding study and Top-k extension show that a new relation and a new retained-state pattern reuse the same trust boundary, while the checker accepts all evaluated legal configurations and rejects all adversarial proposals. Together, these results show that one checked-lowering architecture can enforce heterogeneous registered memory relations at Agent tool dispatch.

发表机构

• Sichuan University（四川大学）
• University of Notre Dame（圣母大学）

机构由 AI 辅助整理，请以论文原文为准。