DelegateGuard：面向委托式大语言模型智能体工作流的用途绑定权限控制机制
DelegateGuard: Purpose-Bound Capabilities for Delegated LLM Agent Workflows
AI总结：
该研究针对委托式LLM智能体工作流的代理人混淆风险，提出DelegateGuard参考监控器，通过用途绑定的可衰减权限控制，可阻止多种攻击，大幅降低数据泄露，且开销极低。
摘要：
（背景）大语言模型（LLM）智能体在持有敏感数据权限的同时，越来越多地将子任务委托出去，这产生了“代理人混淆”风险：被注入的委托智能体可能会泄露数据、放大自身权限，或在权限被撤销后仍执行操作。现有的数据泄露基准测试虽能暴露这些缺陷，但并未约束委托智能体可行使的权限。（方法）我们提出了\textbf{\textit{DelegateGuard}}，一种参考监控器，它将发起用户的授权转换为针对用途、标签、操作、数据汇（sink）和委托深度的可衰减权限；所有数据移动操作均在LLM外部进行调解，且权限撤销会通过委托图级联生效。我们形式化了一个跟踪级安全不变量，并通过自适应内部权限敌手、四个基线、模型动作与多轮生态研究，以及对确定性跟踪和517401封Enron邮件的一致性与规模检查对其进行评估。（结果）\textbf{\textit{DelegateGuard}}可阻止未授权数据汇泄露、权限放大、撤销重放、用途博弈以及工具内标签违规，且在撤销和工具内案例中优于静态允许列表（10/10）。两个开放模型在42/45和44/45条注入跟踪上提出了攻击者目标动作，所有这些动作在执行时均被阻止；一项90轮多轮研究将数据泄露从0.844降至0.20，同时完成全部任务，每决策的开销为微秒级。命题1精确刻画了基于衰减的授权足够的场景边界，我们也在四个可观测数据汇工作流中通过实验复现了该边界。（结论与意义）用途绑定的运行时授权为委托式LLM工作流提供了与模型无关的执行边界，并给出了将其与去分类及外部可观测数据汇上的内容监控相结合的精确方案。
英文摘要：
\textbf{(Context)} LLM agents increasingly delegate subtasks while holding authority over sensitive data, creating confused-deputy risks: an injected delegate can exfiltrate data, amplify its authority, or act after revocation. Existing leakage benchmarks expose these failures but do not constrain the authority a delegated agent may exercise. \textbf{(Methods)} We present \system, a reference monitor that converts the initiating user's authorization into attenuable capabilities over purpose, labels, operations, sinks, and delegation depth; every data-moving action is mediated outside the LLM, and revocation cascades through the delegation graph. We formalize a trace-level safety invariant and evaluate it with an adaptive within-authority adversary and four baselines, model-action and multi-turn ecological studies, and conformance and scale checks over deterministic traces and 517{,}401 Enron emails. \textbf{(Results)} \system blocks ungranted-sink exfiltration, authority amplification, revocation replay, purpose gaming, and intra-tool label violations, and dominates static allowlists on the revocation and intra-tool cases (10/10). Two open models proposed attacker-goal actions on 42/45 and 44/45 injected traces, all blocked at execution; a 90-run multi-turn study cut leakage from 0.844 to 0.20 with full task completion, at microsecond per-decision overhead. Proposition~1 characterizes exactly where attenuation-based authorization suffices, a boundary we also reproduce empirically across four observable-sink workflows. \textbf{(Conclusion \& Significance)} Purpose-bound runtime authorization gives delegated LLM workflows a model-independent execution boundary and a precise recipe for composing it with declassification and content monitoring on externally observable sinks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
