arXiv 论文：HMAC-SHA256 签名清单可降低多智能体交接中的需求篡改，但提取环节仍是信任边界
Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs
AI 导读
arXiv 论文提出对多智能体 LLM 任务交接使用签名需求清单，编排器以逐字引用加可校验谓词提取需求，用 HMAC-SHA256 签名并由确定性代码验证合并决策。
正文 · 原文
Abstract:Enterprise AI agents increasingly split a user's request across subagents and merge their results, and each handoff can summarize away, alter or ignore a requirement. We report a preregistered study with synthetic, exactly scorable tasks comparing free-text, structured JSON and signed requirement-manifest handoffs: the orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, code signs the manifest with HMAC-SHA256, and deterministic code verifies the merger's decision. With Qwen3-8B (1,440 trajectories, five threats), signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs. Signing is what defeats in-transit tampering: an unsigned manifest committed violations in 79% of mutated runs, the signed one in none. On identical trajectories the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms. An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing. A preregistered pre-signing injection attack confirmed this boundary: one adversarial line raised signed-manifest violations from 14.6% to 37.5% (Qwen3-8B), 11.1% to 63.9% (gpt-oss-20b) and 8.3% to 75.0% (GPT-5.6-luna), and the signature then authenticated the corrupted manifest. Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.
| Comments: | 34 pages, 0 figures. Preregistered; code, task banks, freeze manifests and run logs are available from the authors on request |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| ACM classes: | I.2.11; K.6.5 |
| Cite as: | arXiv:2611.07483 [cs.CR] |
| (or arXiv:2611.07483v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.07483 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Xiaobo Chen [view email]
[v1]
Thu, 5 Nov 2026 05:43:47 UTC (37 KB)
来源：arXiv cs.AI · arxiv.org