Published August 30, 2026 | Version v2.0.0
Preprint Open

DROS-PGM (v2.0): A Deterministic Post-Compromise Execution Containment Substrate for Autonomous AI Workloads (後受陷確定性執行約束基板)

Authors/Creators

  • 1. Top-Celestial Company Ltd.

Description

In modern autonomous AI agent workloads where agents obtain legitimate credentials and invoke consequential tools, traditional application-layer perimeters suffer from fundamental failure modes. Conventional defenses rely on probabilistic semantic guardrails or coarse-grained operating system sandboxes under the assumption of preventing compromise.However, once internal dialogue or interpreter environments succumb to indirect prompt injection, attackers inevitably inheritvalid credentials and execute irreversible physical state changes.

This paper presents DROS-PGM, a post-compromise execution containment substrate operating at the binary execution control plane. Architecturally, the C-ABI / FFI boundary manages policy evaluation and principal capability attribution, while OS kernel hooks enforce mandatory authorization checks over explicitly instrumented operation classes Xcovered. PGM decouples application principal identity from binary execution authority, maintaining the formal containment invariant via sub-microsecond (P50 = 353 ns) lock-free evaluation and atomic RCU statepointer swaps. To rigorously evaluate boundary robustness without self-witness circularity, we introduce the PGM-VEP Five- Tier Progressive Falsification Methodology (V1–V5), encompassing attack-equivalent baselines, adaptive white-box state search, negative control meta-verification (5/5 injected flaw detection and 100/100 mutant kill score), a four-stage decoupled ground-truth oracle pipeline (OI → OA → OE → OP ), and cross-environment replication across Linux x86_64, ARM64, and Windows. Across 118,355 total executions (68,355 adversarial + 50,000 benign, BFDR = 0/50, 000), zero unauthorized executions or state drifts were observed within explicitly instrumented boundaries. We report these guarantees as empirical invariants over the evaluated state space and establish an open counterexample registry to support ongoing adversarial falsification.

在自主AI 代理獲取合法憑證與工具調用權限的現代工作負載中,應用層安全邊界正面臨根本性失效。傳統防禦體系主要依賴機率性語義護欄或粗粒度作業系統沙箱,其核心假設建立於「防範受陷」之上;然而,一旦內部對話或直譯器遭遇提示注入或邏輯受陷,攻擊者即可繼承合法憑證並引發不可逆的實體副作用。

本文提出DROS-PGM,一種運行於二進位執行控制平面之後受陷執行約束基板。在架構上,C-ABI / FFI 邊界負責策略調用與主體能力歸因,而OS 內核Hook 則在顯式插樁之受管操作類別空間Xcovered 上執行強制授權檢查。PGM 將應用層主體身分與底層執行授權實體解耦,透過亞微秒級(中位數353ns)無鎖策略評估與原子化RCU 狀態指針切換,形式化維持安全不變量。為嚴謹評估此邊界,我們引入PGM-VEP 五階漸進式對抗證偽方法學(V1–V5),涵蓋攻擊等價基準對照、白箱對抗探針搜尋、陰性對照組元驗證(5/5 缺陷捕獲與100/100 突變殺死率)、四階段解耦判定神諭(OI → OA → OE → OP )以及跨Linux x86_64、ARM64 與Windows 異質環境之獨立自動化復現。在累積68,355 次對抗與驗證執行負載及50,000 次良性基準負載(總計118,355 次執行,良性誤拒率BFDR = 0/50, 000)中,於顯式插樁觀測邊界內未曾觀測到任何授權逃逸或實體狀態漂移。本文將所得保證確立為經驗不變量而非全域安全證明,並公開發布反例登錄協議以供學術社群持續進行開放式對抗證偽。

Notes (English)

[DROS Trilogy Reading Guide]
This paper is part of the DROS Academic Trilogy, defining a deterministic runtime governance substrate for autonomous AI workloads (without replacing general-purpose operating systems):
(1) DROS-6P — Minimal closed-loop service specification across six fundamental enterprise trust boundaries;
(2) DROS 4-Layer (v3) — Bridging the Agent-to-Execution Attribution Gap via defense-in-depth and in-band C-ABI capability enforcement;
(3) DROS-PGM — [This Paper] Delivers an unbypassable, kernel-anchored deterministic execution control plane and sub-microsecond in-band physical fusing under post-compromise threat models.
Recommended Reading Order: 6P → 4-Layer (v3) → PGM.
Authoritative Trilogy Reading Guide: https://doi.org/10.5281/zenodo.22114036
Reproducible Benchmark Testbed: https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite

【DROS 三部曲導讀】
本系列由三篇互補預印本構成,合起來定位為面向自主 AI 工作負載的確定性執行期治理基板(runtime governance substrate),而非取代通用 OS:
(1) DROS-6P — 六大信任邊界(Principal / Authorization / Tool Bound / Policy Gate / Audit / Revocation)之閉環規格;
(2) DROS 四層 (v3) — 代理人至執行歸因鴻溝與 L1–L4 確定性強制(含消融與應用層治理之互補關係);
(3) DROS-PGM — 本篇聚焦妥協後(Post-Compromise)之執行信任與確定性執行控制平面。
建議閱讀順序:6P → 四層 v3 → PGM。
系列導讀(Reading Guide):https://doi.org/10.5281/zenodo.22114036
可重現測試床:https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite
技術主張與實驗數據以各篇全文及所宣告威脅模型為準;本 Note 僅供導航。

Notes (English)

<div style="background-color: #f8f9fa; border-left: 4px solid #0066cc; padding: 12px; margin-bottom: 16px;">
  <p><strong>📌 Note on Versioning & Research Lineage (版本關係與譜系說明):</strong></p>
  <p><strong>[English]</strong> This manuscript (v2.0) serves as the <em>Hardened Empirical & Falsification Extended Report</em> for the DROS-PGM architecture. While Version 1 (v1.0) establishes the complete architectural foundations and long-form system design (currently under formal peer-review), Version 2 (v2.0) specifically expands the <strong>Formal Security Claim Matrix (Table 1)</strong>, the <strong>Five-Tier Progressive Falsification Methodology (V1–V5)</strong>, the <strong>118,355-execution Accounting Ledger (Table 3)</strong>, and <strong>Negative Control Meta-Verification (100/100 Mutant Kill Score)</strong>. Together, v1.0 and v2.0 form the comprehensive theoretical and empirical corpus of the DROS Physical Guard Module.</p>
  
  <p><strong>[繁體中文]</strong> 本文稿(v2.0)為 DROS-PGM 架構之<em>「對抗證偽與實驗會計帳本硬核增強報告」</em>。第 1 版(v1.0)聚焦於完整系統架構、理論模型與長篇機制推導(目前正於 IEEE 進行同行評審);第 2 版(v2.0)則專門針對<strong>形式化主張邊界矩陣(表一)</strong>、<strong>五階漸進式證偽方法學(V1–V5)</strong>、<strong>118,355 次完整執行會計帳本(表三)</strong>與<strong>陰性對照組元驗證(100/100 突變殺死率)</strong>進行深度擴充。v1.0 與 v2.0 共同構成 DROS-PGM 之完整理論與經驗實證體系。</p>
</div>

Files

DROS-PGM-Paper_v2_20260828_EN.pdf

Files (641.6 kB)

Name Size Download all
md5:a64ec6a8048fd30014abd2f556e65699
164.3 kB Preview Download
md5:76ebe619cdec69990ec1d58c8d630149
477.2 kB Preview Download

Additional details

Related works

Cites
Preprint: 10.5281/zenodo.20823163 (DOI)
Preprint: 10.5281/zenodo.21755654 (DOI)
Is part of
Preprint: 10.5281/zenodo.22114036 (DOI)
Is supplemented by
Software: https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite (URL)

Software

Repository URL
https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite

References

  • C. C. Chen, "DROS: A Four-Layer Deterministic Runtime Operation System Bridging the Agent-to-Execution Attribution Gap," Zenodo, DOI: 10.5281/zenodo.21755654, 2026.
  • C. C. Chen, "Runtime Attribution Framework: An External C-ABI and PKI-Based Zero-Trust Infrastructure for Non-Repudiable Execution Governance in Multi-Agent Systems," Zenodo, DOI: 10.5281/zenodo.20823163, 2026.
  • P. Loscocco and S. Smalley, "Meeting critical security objectives with security-enhanced Linux," in Proc. Ottawa Linux Symposium, 2001.
  • W. Drewry, "Chrome sandbox: seccomp-bpf," Google Security Blog, 2012.
  • P. E. McKenney, "Is Parallel Programming Hard? (RCU Architecture)," IBM OS Review, 2024.
  • Agent libOS Team, "Agent libOS: A Library-OS-Inspired Runtime for LLM Agents," arXiv:2606.03895, 2026.
  • Authgate Team, "A Capability Kernel for Agent Authorization," SSRN:6931639, 2026.
  • AgentVisor Team, "AgentVisor: Defending LLM Agents via Semantic Virtualization," arXiv:2604.24118, 2026.
  • MCP Security Group, "Runtime Policy Enforcement for MCP-Based LLM Agents," MDPI Electronics, vol. 15, no. 13, p. 2829, 2026.