发表机构
Harbin Institute of Technology（哈尔滨工业大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对智能体执行产生未批准持久性结果的问题，提出EffectMatch运行时，通过边界内收集并比较持久性更改与批准内容，控制提交和依赖执行，实验验证其能阻止不一致结果的静默接受与传播。
AI 中文摘要
大型语言模型智能体越来越多地作用于软件系统，不再仅仅生成文本，还会更改数据库和在线服务。然而，一个已批准的数据库更新可能成功，却留下一个未获批准的通知，因为执行可能产生超出所请求更改的持久性影响。当前的安全措施可以批准某个操作或记录其后果，但在继续执行前不检查持久性结果，未获批准的结果可能被当作成功而接受，并传播到后续步骤。我们提出了 EffectMatch，一个运行时，它在受控执行边界内收集持久性更改，并将其与应用程序针对当前状态和执行所批准的内容进行比较。该比较控制提交和依赖执行。在对 206 个公共业务任务的比较评估中，EffectMatch 保留了所有干净执行，并阻止了所有测试的不正确提交。六次 20 次运行的消融实验暴露了每个被移除机制导致的失败，而 80 个任务拓扑案例保留了真实的交接并阻止了无效的继续。这些结果共同表明，EffectMatch 阻止了与应用程序批准不一致的持久性结果的静默接受和下游传播。
英文摘要
Large language model agents increasingly act on software systems, no longer merely generating text but also changing databases and online services. However, an approved database update may succeed yet leave an unapproved notification because execution can produce persistent effects beyond the requested change. Current safeguards can approve an action or record its aftermath, but without checking the persistent result before continuation, an unapproved outcome can be accepted as success and propagated to later steps. We present EffectMatch, a runtime that collects persistent changes within a controlled execution boundary and compares them with what the application approved for the current state and execution. The comparison governs commit and dependent execution. In comparative evaluation on 206 public business tasks, EffectMatch preserved all clean executions and prevented all tested incorrect commits. Six 20-run ablations exposed the failure caused by each removed mechanism, while 80 task-topology cases preserved truthful handoffs and blocked invalid continuation. Together, these results show that EffectMatch blocks the silent acceptance and downstream propagation of persistent outcomes inconsistent with application approval.
Comments22 pages including 7 pages of supplementary material. Submitted to IEEE Transactions on Software Engineering
