发表机构
University of Chicago（芝加哥大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
LeaseGuard通过资源租约和健康检查实现特权LLM代理的准入控制，将未经授权的抢占从73.3%降至0%，同时保持任务成功率稳定。
AI 中文摘要
特权语言模型代理可以通过替换依赖同一文件、进程、套接字、锁或容量分配的健康的在位者来满足新的系统任务。这种失败之所以发生，是因为执行特权决定了一个操作能否运行，而不是请求者是否可以抢占当前资源所有者。我们提出了LeaseGuard，一个确定性的准入层，它通过规范资源租约、在位者健康检查、效果感知准入、共存限制、安全替代方案以及资源范围覆盖，在适配器执行之前表示抢占权限。我们在一个包含60个新编写的冲突场景的冻结基准上对其进行了评估，该基准包含两个本地模型系列的匹配对照。相对于保留提示，LeaseGuard将未经授权的抢占从73.3%降至0.0%，并将安全完成率提高了70.0个百分点（场景聚类95%置信区间[60.8, 79.2]）。请求任务成功率变化为-3.3个百分点（95%置信区间[-9.2, 2.5]）。完全评估的v0.2代理还在哈希链接的压力审计中拒绝了伪造的在位者任务身份。仅基于过期的回收在错过续租后仍可能暴露健康的在位者。证据支持在效果完全中介、任务所有权经过身份验证以及租约过期反映在位者活跃度的情况下，采用保留在位者的准入控制。
英文摘要
Privileged language-model agents can satisfy a new system task by displacing a healthy incumbent that depends on the same file, process, socket, lock, or capacity allocation. This failure arises because execution privilege determines whether an operation can run, not whether the requester may preempt the current resource owner. We present LeaseGuard, a deterministic admission layer that represents preemption authority through canonical resource leases, incumbent-health checks, effect-aware admission, coexistence limits, safe alternatives, and resource-scoped overrides before adapter execution. We evaluate it on a frozen benchmark of 60 newly authored conflict scenarios with matched controls across two local model families. Relative to a preservation prompt, LeaseGuard reduces unauthorized preemption from 73.3% to 0.0% and increases safe completion by 70.0 percentage points (scenario-clustered 95% CI [60.8, 79.2]). Requested-task success changes by -3.3 points (95% CI [-9.2, 2.5]). The fully evaluated v0.2 broker also rejects a forged incumbent task identity in a hash-linked stress audit. Expiry-only reclamation can still expose a healthy incumbent after missed renewal. The evidence supports incumbent-preserving admission when effects are completely mediated, task ownership is authenticated, and lease expiry reflects incumbent liveness.
Comments6 pages, 2 figures, 4 tables
