谁审计谁，在什么基座上，用什么证据？一种面向智能体AI的独立性分级审计协议
Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI
浏览论文内容
中文总结 AI 辅助
针对智能体AI审计独立性不足的问题，提出沿主体、基座、证据三轴分级并按最弱环节聚合的审计协议，移植β因子模型并验证其有效性。
中文摘要 AI 辅助
智能体AI系统能够规划、调用工具并在有限监督下行动；它们如今既是审计的对象，也日益成为审计者。独立性作为保证的基础，目前仍以二元方式应用于它们。我们认为，独立性必须沿三个正交轴进行分级：主体独立性（谁控制审计者）、基座独立性（与受审计方共享基础模型家族、工具链或护栏的审计者会与其一同失效）以及证据独立性（证据是可证明的而非自我报告的）。每个轴都有先例；贡献在于在单一审计中对三者进行分级，按最薄弱环节聚合，并在审计者本身是智能体时应用相同的评判标准。我们通过将可靠性工程中的共因失效β因子模型移植过来，为模型提供正式基础，并给出一个七步协议，其输出可由第三方验证，以及对一个采购控制智能体在三个等级下进行审计的结构性可检测性分析，还有该模型的蒙特卡洛研究，其中对智能体的传统内部审计——一个真实审计团队、第二个智能体、提供商日志——仅表面发现了其原则上可见的5.9%的故障，且在一半的故障类别中完全未发现。我们将这一三元组映射到修订后的欧盟AI法案、ISO/IEC 42006、英国公共部门风险管理指南以及审计监管实践。
英文摘要
Agentic AI systems plan, invoke tools and act with limited supervision; they are now both the subject of audits and, increasingly, the auditor. Independence, the foundation of assurance,is still applied to them as a binary. We argue that it must be graded along three orthogonal axes: principal independence (who controls the auditor), substrate independence (an auditor sharing the auditee's foundation-model family, toolchain or guardrails fails with it) and evidence independence (whether evidence is attestable rather than self-reported). Each axis has precedent; the contribution is to grade all three on a single audit, aggregate them by the weakest link, and apply the same rubric when the auditor is itself an agent. We give the model a formal basis by transplanting the beta-factor model of common-cause failure from reliability engineering, a seven-step protocol whose outputs a third party can verify, a structural detectability analysis of a procurement-controls agent audited at three grades, and a Monte Carlo study of the model in which a conventional internal audit of an agent-a real audit team, a second agent, provider logsp-surfaces 5.9% of the faults it could in principle see and none at all in half the fault classes. We map the triple to the EU AI Act as amended, ISO/IEC 42006, UK public-sector risk-management guidance and audit-regulator practice.
发表机构
- Keele University（基尔大学）
- University of Liverpool（利物浦大学）
机构由 AI 辅助整理，请以论文原文为准。
