DROS: A Four-Layer Deterministic Runtime Operation System Bridging the Agent-to-Execution Attribution Gap in Autonomous AI Workloads / DROS:彌合自主AI 負載中「代理人至執行歸因 鴻溝」之四層確定性執行期作業系統

The rapid deployment of autonomous AI agents capable of multi-step tool invocation introduces a fundamental security gap: existing semantic firewalls (e.g., NVIDIA NeMo Guardrails) operate probabilistically and are susceptible to indirect prompt injection (IPI), while OS-level sandboxes (eBPF, Seccomp) enforce deterministic binary rules but suffer from context-blindness, unable to attribute syscalls to the originating agent role within a shared process. We define this structural weakness as the Agent-to-Execution Attribution Gap.
We propose DROS (Deterministic Runtime Operation System), a four-layer defense-in-depth architecture comprising: (L1) a probabilistic semantic boundary filter; (L2) a threetier PKI identity layer binding agent roles to cryptographic execution tokens (DIT); (L3) an ABAC topology enforcer; and (L4) a deterministic C-ABI enforcement layer executing zeroheap O(1) capability bitmap comparisons at the FFI boundary. Empirical evaluation on a 24-hour soak test (N=160,611 requests, N_adv=137,751 adversarial attempts across four attack families) demonstrates the full DROS stack achieves 100% blocking rate on the evaluated corpus under the defined threat model, with median policy evaluation latency of 26.21 μs (p99=242.69 μs) and C-ABI enforcement latency <500 ns, introducing <1.8% CPU overhead. An ablation study confirms L4 provides deterministic enforcement for 6.5% of adversarially obfuscated IPI payloads that evade L1-L3.

在高風險企業環境中,能夠執行多步驟工具調用的自主AI 代理人迅速部署,引入了現有防禦無法應對的根本性安全鴻溝:語義防火牆(如NVIDIA NeMo Guardrails)以機率方式運作,易受間接提示注入(IPI)的對抗性混淆攻擊;而作業系統層沙箱(如eBPF、Seccomp)雖具確定性,卻存在情境盲視問題,無法在共享進程內將系統呼叫歸因至發起該呼叫的代理人角色。
我們將此結構性弱點定義為代理人-至-執行歸因鴻溝(Agent-to-Execution Attribution Gap)。為填補此鴻溝,我們提出DROS(確定性執行時操作系統,Deterministic Runtime Operation System)——一種四層縱深防禦架構,包含:(L1)機率語義邊界過濾層;(L2)透過密碼學執行令牌(DIT)將代理人角色綁定的三層PKI 身份層;(L3)以屬性為基礎的存取控制(ABAC)拓撲強制層;以及(L4)在FFI 邊界執行零堆積O(1) 能力點陣圖比對的確定性C-ABI 二進位強制層。針對24 小時浸泡測試(N=160,611 次請求,N_adv=137,751 次橫跨四大攻擊家族(包含五類測試子類別)的對抗性嘗試)進行的實證評估顯示:完整DROS 架構在已定義的威脅模型下,針對已評估語料庫達到100% 阻擋率;策略評估延遲中位數為26.21 μs(P99=242.69 μs),C-ABI 強制延遲低於500 ns,CPU 額外負載低於1.8%。消融實驗(Ablation Study)確認L4 為6.5% 逃過L1-L3之對抗性混淆IPI 酬載提供了確定性強制防線。