论文

揭示使用工具的 LLM Agent 的一种部署失效模式——来源缺口，以及一类跨上下文多步越狱攻击，可在早期交互中保留看似无害的中间产物，并在很久以后（可能在不同 Agent 实例或工作流阶段）诱发有害行为。A deployment failure mode for tool-using LLM agents, the provenance gap, and a family of cross-context multi-step jailbreaks that preserve benign-looking intermediate artifacts from an early interaction and elicit harmful behavior much later, potentially in a different agent instance or workflow stage.

本文提出一种分层隔离架构，结合策略感知的 ingestion、retrieval-time gating 与共享推理，并通过服务端 agentic 编排加以执行，在为多租户隔离提供天然强制点的同时，允许客户端框架保留对 agent 组合与延迟敏感操作的控制权。A layered isolation architecture combining policy-aware ingestion, retrieval-time gating, and shared inference, enforced through server-side agentic orchestration is introduced, creating natural enforcement points for multitenant isolation while allowing client-side frameworks to retain control over agent composition and latency-sensitive operations.