发表机构
Korea Advanced Institute of Science and Technology (KAIST)（韩国科学技术院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对工具调用在部署后可能改变安全效果的问题，提出形成一致性调度（FCD），通过来源绑定和原子接纳确保调用效果符合安全契约，实验验证其有效阻止风险调用。
AI 中文摘要
支持工具调用的智能体从模型可见的接口形成调用，而宿主随后选择其实现。标准调度忽略了描述符-处理器关系。因此，一个未改变且符合模式的调用可能在部署、重连或延迟批准期间获得不同的安全效果。我们将这种失败称为模式-时代漂移。我们提出形成一致性调度（FCD），它将实现分析与执行权限连接起来。审查后的配置文件从官方来源生成具有来源绑定的声明范围内效果的过度近似。在封闭目标批准策略下，验证器将每个形成的调用应用于摘要，并且仅当效果符合调用的安全契约时才捕获后继者。原子接纳和最终跳围栏将此决策保留到效果层面。确切来源保持优先，捕获的后继者仅在来源退役后才变得合格。库存发布和部署更改重现了该失败。四个配置文件覆盖了32个官方发布：29个无需特定发布更改，三个升级。一个冻结的16发布扩展匹配了独立的来源预言机。在预注册的库存比较中，FCD完成了所有三个效果保持私有的待处理调用，并阻止了所有三个遗漏变为公开的调用。精确固定和发布范围拒绝阻止了所有六个调用，而发布范围批准完成了所有六个但产生了三个公开效果。一个独立的生命周期实验在来源退役后携带了形成捕获的证书。稍后安装的相同安全证书管理了新的形成，而未扩展待处理调用的权限。
英文摘要
Tool-enabled agents form calls from model-visible interfaces, while hosts later select their implementation. Standard dispatch omits the descriptor-handler relation. An unchanged and schema-valid call can therefore acquire a different security effect during rollout, reconnect, or delayed approval. We call this failure schema-epoch drift. We present formation-consistent dispatch (FCD), which connects implementation analysis to execution authority. Reviewed profiles produce provenance-bound over-approximations of declared in-scope effects from official source. Under a closed-target approval policy, a verifier applies each formed call to a summary and captures a successor only when its effects fit the call's security contract. Atomic admission and a final-hop fence preserve this decision to the effect. The exact source retains priority, and the captured successor becomes eligible only after source retirement. Stock releases and deployment changes reproduced the failure. Four profiles covered 32 official releases: 29 required no release-specific change and three escalated. A frozen 16-release expansion matched a separate source oracle. In a preregistered stock comparison, FCD completed all three pending calls whose effect remained private and blocked all three whose omission became public. Exact pinning and release-wide denial stopped all six calls, while release-wide approval completed all six but produced three public effects. A separate lifecycle experiment carried a formation-captured certificate across source retirement. The same safe certificate installed later governed new formations without expanding the pending call's authority.
Comments17 pages, 5 figures, and 9 tables
