DROS: A Four-Layer Deterministic Runtime Operation System Bridging the Agent-to-Execution Attribution Gap in Autonomous AI Workloads / DROS:彌合自主AI 負載中「代理人至執行歸因 鴻溝」之四層確定性執行期作業系統

The rapid deployment of autonomous AI agents capable of multi-step tool invocation introduces a fundamental security gap: existing semantic firewalls (e.g., NVIDIA NeMo Guardrails) operate probabilistically and are susceptible to indirect prompt injection (IPI), while OS-level sandboxes (eBPF, Seccomp) enforce deterministic binary rules but suffer from context-blindness, unable to attribute syscalls to the originating agent role within a shared process. We define this structural weakness as the Agent-to-Execution Attribution Gap.

We propose DROS (Deterministic Runtime Operation System), a four-layer defense-in-depth architecture comprising: (L1) a probabilistic semantic boundary filter; (L2) a three-tier PKI identity layer binding agent roles to cryptographic execution tokens (DIT); (L3) an ABAC topology enforcer; and (L4) a deterministic C-ABI enforcement layer executing zero-heap O(1) capability bitmap comparisons at the FFI boundary.

Empirical evaluation on a 24-hour soak test (N=160,611 requests, N_adv=137,751 adversarial attempts across four attack families) demonstrates the full DROS stack achieves 100% blocking rate on the evaluated corpus under the defined threat model, with median policy evaluation latency of 26.21 $\mu \text{s}$ (p99=242.69 $\mu \text{s}$) and C-ABI enforcement latency <500 $\text{ns}$, introducing <1.8% CPU overhead. An ablation study confirms L4 provides deterministic enforcement for 6.5% of adversarially obfuscated IPI payloads that evade L1-L3. Furthermore, a multi-architecture comparative benchmark against state-of-the-art application middleware (Microsoft AGT) demonstrates that DROS provides complementary execution-boundary containment for unmanaged runtime paths with sub-microsecond P99 decision latencies ($1.20\mu \text{s}$).

在高風險企業環境中,能夠執行多步驟工具調用的自主 AI 代理人迅速部署,引入了現有防禦無法應對的根本性安全鴻溝:語義防火牆(如 NVIDIA NeMo Guardrails)以機率方式運作,易受間接提示注入(IPI)的對抗性混淆攻擊;而作業系統層沙箱(如 eBPF、Seccomp)雖具確定性,卻存在情境盲視問題,無法在共享進程內將系統呼叫歸因至發起該呼叫的代理人角色。我們將此結構性弱點定義為代理人-至-執行歸因鴻溝(Agent-to-Execution Attribution Gap)。

為填補此鴻溝,我們提出 DROS(確定性執行時操作系統,Deterministic Runtime Operation System)——一種四層縱深防禦架構,包含:(L1)機率語義邊界過濾層;(L2)透過密碼學執行令牌(DIT)將代理人角色綁定的三層 PKI 身份層;(L3)以屬性為基礎的存取控制(ABAC)拓撲強制層;以及(L4)在 FFI 邊界執行零堆積 O(1) 能力點陣圖比對的確定性 C-ABI 二進位強制層。

針對 24 小時浸泡測試(N=160,611 次請求,N_adv=137,751 次橫跨四大攻擊家族(包含五類測試子類別)的對抗性嘗試)進行的實證評估顯示:完整 DROS 架構在已定義的威脅模型下,針對已評估語料庫達到 100% 阻擋率;策略評估延遲中位數為 26.21 $\mu \text{s}$(P99=242.69 $\mu \text{s}$),C-ABI 強制延遲低於 500 ns,CPU 額外負載低於 1.8%。消融實驗(Ablation Study)確認 L4 為 6.5% 逃過 L1-L3 之對抗性混淆 IPI 酬載提供了確定性強制防線。此外,與業界最前沿應用層中介軟體(Microsoft AGT)的多架構橫向對照基準評測進一步證實,DROS 能以次微秒級的 P99 決策延遲($1.20\mu \text{s}$),為未經託管之直譯器執行路徑提供互補性的二進位執行邊界遏制能力。