A security communication method for agent interaction

Abstract

The application provides a security communication method for agent interaction, belongs to the technical field of artificial intelligence and network communication, and is used for solving the problems that the agent identity authentication is unreliable, vulnerable to prompt word injection and flooding attack in the related art. The method comprises the following steps: a verification party generates a semantic challenge and issues it to a request party; the request party generates a natural language semantic response by using a large language model, and embeds API information in the response in a semantic steganography manner; the verification party receives the semantic response and performs legality verification, which comprises whether the semantic correlation and the generation cost are higher than a threshold value; after the verification is passed, the API information is extracted and an invocation is performed, and a structured result is output. The application takes semantic capability as a trust root, realizes integrated identity authentication and secure API invocation through asymmetric cost semantic challenge and semantic steganography, is immune to injection attack from the protocol level, and naturally resists flooding attack.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and network communication technologies, and in particular to a secure communication method for intelligent agent interaction. Background Technology

[0002] With the rapid development of large language models and multi-agent systems, the demand for automated interaction between agents and between agents and external services is increasing. In open networks, agents need to call each other's APIs to complete complex tasks, such as information retrieval, service invocation, and data collaboration. Currently, agents typically interact directly using natural language or communicate through structured message passing (such as JSON and XML).

[0003] In existing technologies, agent communication protocols mainly include the Model Context Protocol (MCP) led by Anthropic, the Agent-to-Agent Collaboration Protocol (A2A) led by Google, the Agent Communication Protocol (ACP) from IBM, and the decentralized Agent Network Protocol (ANP). These protocols have standardized message formats, task coordination, and interoperability, but their security mechanisms generally rely on external credentials (such as OAuth tokens, API keys, and digital signatures) and transport layer encryption (such as TLS), lacking native security designs oriented towards agent semantic capabilities. Furthermore, existing protocols typically employ a symmetric cost computation model for authentication, allowing attackers to forge requests and launch DDoS or flood attacks at low cost; API call transmissions often use plaintext or structured formats, making them easily parsed and tampered with; and natural language interactions between agents are highly susceptible to prompt injection attacks, leading to serious security problems such as instruction hijacking and unauthorized operations.

[0004] In summary, existing technologies cannot simultaneously solve technical problems such as agent identity verification, flooding attack resistance, anti-prompt injection, and secure API call transmission in a protocol-native manner without relying on external security facilities. There is an urgent need for a new communication method based on the semantic capabilities of a large language model. Summary of the Invention

[0005] This application provides a secure communication method for intelligent agent interaction, which can use semantic capabilities as the root of trust to complete intelligent agent authentication and secure API calls in the same interaction process, and achieve anti-attack and anti-injection at the protocol mechanism level.

[0006] Firstly, this application provides a secure communication method for intelligent agent interaction. The method includes:

[0007] The verifier generates a semantic challenge and sends it to the requester.

[0008] The requesting party uses a large language model to generate a semantic response in natural language format. The semantic response meets a preset generation cost condition, and the requesting party embeds the API information to be called into the semantic response in a semantic steganography manner.

[0009] The verifier receives the semantic response and performs a legality verification on the semantic response. The legality verification includes verifying the semantic relevance of the semantic response to the semantic challenge and verifying whether the generation cost of the semantic response is higher than a preset threshold.

[0010] After successful verification, the verifier extracts the API information from the semantic response according to predefined steganography rules;

[0011] The verifier executes an API call based on the extracted API information and outputs a structured call result, which does not contain free-form natural language content.

[0012] By adopting the above technical solution, this method integrates agent authentication and API call transmission into a single semantic interaction. The authenticator only needs to perform a lightweight verification to confirm whether the requester has the real ability to generate semantics for a large language model. At the same time, by using semantic steganography and structured output locking, the method eliminates prompt injection and instruction hijacking at the protocol level, significantly improving communication security and efficiency.

[0013] Furthermore, the generation cost conditions include that the number of tokens in the semantic response is greater than or equal to a first threshold, and the semantic coherence score of the semantic response is greater than or equal to a second threshold; the computational cost for the verifier to perform the legality verification is lower than the computational cost for the requester to generate the semantic response.

[0014] By adopting the above technical solution, the asymmetric cost characteristic of generating high-cost and verifying low-cost large language models is utilized to form the protocol's native anti-DDoS and anti-flood attack capabilities. Forged or batch requests are automatically filtered out because they cannot afford the high generation cost.

[0015] Furthermore, the semantic challenge includes a one-time random identifier and a topic constraint; the legality verification also includes verifying that there is at least one information unit in the semantic response that semantically matches the topic constraint, and verifying that the one-time random identifier has not been used and has not expired.

[0016] By adopting the above technical solution, each session uses a unique random identifier and dynamic topic constraints to ensure that responses are not replayable and cannot be reused, thus completely eliminating the risk of replay attacks.

[0017] Furthermore, the legitimacy verification relies solely on the requester's large language model semantic generation capability as the root of trust, without depending on any of the following: password, token, digital signature, or digital certificate.

[0018] By adopting the above technical solution, the traditional external credential system is completely abandoned, and the semantic understanding and generation capabilities of the intelligent agent itself are used as the sole basis for identity authentication, thereby fundamentally eliminating the problems of credential leakage, forgery and theft.

[0019] Furthermore, embedding the API information to be invoked into the semantic response using semantic steganography includes integrating the API interface name, calling parameters, and business intent data into the natural language context of the semantic response according to a pre-agreed semantic pattern, so that it forms an inseparable whole semantic expression with the context; the semantic pattern includes embedding the API name as an action verb into a subject-predicate-object structure, or embedding the parameter value as an attributive or adverbial into sentence components.

[0020] By adopting the above technical solution, the API call intent is hidden in natural language, without explicit structured fields. Third parties cannot identify, tamper with or forge API calls through regular expressions or string matching, thus achieving lightweight semantic confidentiality transmission.

[0021] Furthermore, the verifier extracts the API information from the semantic response according to predefined steganography rules, including extracting only three types of information: API interface name, call parameters, and business intent data, and outputs the three types of information in a fixed format; the fixed format is a key-value pair structure or a JSON structure, which contains at least an API name field and a parameter field, but does not contain any natural language description fields.

[0022] By adopting the above technical solution, the verifier only extracts structured data and does not perform open natural language generation, ensuring that the output content is controllable and parsable, and avoiding additional security risks caused by free text.

[0023] Furthermore, the structured output call result includes the verifier only returning structured data in a predetermined format, prohibiting the generation or return of any free-form natural language text; and the verifier does not retain any contextual information related to this interaction.

[0024] By adopting the above technical solution, prompt injection attacks are blocked at the protocol mechanism level: any malicious instructions contained in the semantic response cannot affect the output, because the verifier does not perform the generation action at all, and there is no context residue that can be exploited.

[0025] Furthermore, the generation and distribution of semantic challenges and the execution of API calls and output of structured call results are completed by the verifier within a single stateless request-response interaction cycle. The interaction cycle does not maintain session state, which includes not storing one-time random identifiers, not caching semantic responses, and not retaining API call history.

[0026] By adopting the above technical solutions, the stateless design eliminates the need for the verifier to maintain any session information, greatly simplifying system implementation and avoiding session hijacking and context pollution attacks.

[0027] Furthermore, the method also includes transmitting the semantic challenge and the semantic response over any underlying transport protocol; the underlying transport protocol is used to provide reliable data transmission or routing functions, without participating in the legitimacy verification and the extraction of the API information; the underlying transport protocol includes at least one of TCP, UDP, HTTP, HTTPS, WebSocket or gRPC.

[0028] By adopting the above technical solution, this protocol is completely decoupled from the underlying transmission layer, and can be flexibly deployed on existing network infrastructure without modifying the transmission layer, thus having good compatibility and portability.

[0029] Furthermore, the requester must generate high-cost semantic content, which is manifested in at least one of high token quantity, high logical coherence, or high semantic complexity; the verification process of the verifier is a lightweight verification with low computational overhead, thereby forming an asymmetric cost mechanism between the verification cost of the verifier and the generation cost of the requester.

[0030] By adopting the above technical solutions, the asymmetric cost barrier is further strengthened, ensuring that only legitimate intelligent agents with the ability to generate semantics for large models can pass the verification, while scripts, crawlers, or simple programs cannot construct effective responses within a reasonable cost.

[0031] In summary, this application has at least the following beneficial effects:

[0032] This paper presents a secure communication method for intelligent agents that uses semantic capabilities as the root of trust and integrates authentication and API calls, significantly reducing system complexity and attack surface.

[0033] Leveraging the asymmetric cost semantic challenge, the protocol natively defends against DDoS, flooding, and fake agent attacks.

[0034] By employing semantic steganography and structured output locking, the mechanism is immune to prompt injection and instruction hijacking, filling the gap in native security of existing intelligent agent communication protocols.

[0035] It should be understood that the description in the Summary Section is not intended to limit the key or essential features of the embodiments of this application, nor is it intended to restrict the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0036] The above and other features, advantages, and aspects of the embodiments of this application will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0037] Figure 1 A schematic diagram of an exemplary operating environment in which embodiments of this application can be implemented is shown.

[0038] Figure 2 A flowchart of a secure communication method for intelligent agent interaction is shown in an embodiment of this application. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0041] This application provides a secure communication method for agent interaction, which uses semantic capabilities as the root of trust and integrates agent authentication and API calls in the same interaction. It naturally resists DDoS and flood attacks and is immune to prompt injection from the protocol mechanism, filling the gap in native secure communication of open agent networks.

[0042] Figure 1 A schematic diagram of an exemplary operating environment in which embodiments of this application can be implemented is shown. (Refer to...) Figure 1The operating environment includes at least one authenticator device and at least one requester device. The authenticator device is a computing device or service gateway deployed with a semantic verification engine, a semantic extraction engine, and an API execution module. It is used to generate and distribute semantic challenges, receive semantic responses, perform legality verification, extract API information, and output structured call results. The requester device is an intelligent agent computing device deployed with a large language model and a semantic response generation module. It is used to receive semantic challenges, generate natural language semantic responses that meet the generation cost conditions, and embed API call information into the semantic response using semantic steganography. The authenticator device and the requester device are connected through any underlying transport network that supports at least one protocol among TCP, UDP, HTTP, HTTPS, WebSocket, or gRPC. This network carries the transmission of semantic challenges and responses but does not participate in the legality verification or API information extraction logic. The overall operating environment constitutes an intelligent agent interaction system based on semantic capabilities for secure communication. The authenticator device and the requester device operate independently, completing a one-time request-response interaction through the underlying transport network, realizing an integrated process of intelligent agent identity authentication and secure API calls.

[0043] Figure 2 A flowchart of a secure communication method for intelligent agent interaction according to an embodiment of this application is shown. (Refer to...) Figure 2 The method specifically includes the following steps S1 to S5.

[0044] S1: The verifier generates a semantic challenge and sends it to the requester.

[0045] The method in this step specifically includes: the semantic challenge includes a one-time random identifier and a topic constraint; the legitimacy verification also includes verifying that there is at least one information unit in the semantic response that semantically matches the topic constraint, and verifying that the one-time random identifier has not been used and has not expired; the generation and distribution of the semantic challenge and the execution of the API call and output of the structured call result are completed by the verifier within a single stateless request-response interaction cycle, the interaction cycle does not maintain session state, the lack of session state maintenance includes not storing the one-time random identifier, not caching the semantic response, and not retaining the API call history; the method also includes transmitting the semantic challenge and the semantic response on any underlying transport protocol, the underlying transport protocol is used to provide reliable data transmission or routing functions, and does not participate in the legitimacy verification and the extraction of the API information, the underlying transport protocol includes at least one of TCP, UDP, HTTP, HTTPS, WebSocket, or gRPC.

[0046] To achieve the above steps, the verifier internally deploys a semantic challenge generator, a one-time random identifier generation unit, and a challenge distribution interface. The one-time random identifier generation unit employs a cryptographically secure pseudo-random number generation algorithm, such as a deterministic random bit generator based on a hash function, to generate a random identifier (Nonce) that satisfies unpredictability and uniform distribution. Specifically, the generation of the Nonce can be represented as... ,in For cryptographic hash functions (such as SHA-256). A high-entropy key injected during system startup. It is a monotonically increasing 32-bit unsigned integer. The Nonce is the current system time in milliseconds. This Nonce is globally unique within the scope of a single validator, and a different Nonce value is used for each challenge. The topic constraints of the semantic challenge are dynamically generated by a topic generation module. This module maintains a semantic topic library, where each entry contains a natural language task description and a corresponding semantic embedding vector. Each time a challenge is generated, the validator selects a topic constraint from the topic library based on the current business scenario or a random strategy, such as "Please describe in more than 200 words how you would solve the urban traffic congestion problem." Furthermore, the validator can also attach quality requirement parameters to the challenge, including a minimum token quantity threshold. (Preset to 256), Semantic coherence scoring threshold (Default is 0.7) and response time window (Default time: 30 seconds). The semantic challenge is encapsulated as a structured object containing the following fields: Nonce (string), topic (string), min_tokens (integer), min_coherence (floating-point number), and expiry (timestamp). The verifier serializes this object into JSON or Protobuf format using the underlying transport protocol and sends it to the requester. Since this protocol is a purely semantic layer protocol, the specific transmission method of the challenge does not participate in the subsequent legality verification logic; it only needs to ensure that the data arrives completely at the requester.

[0047] S2: The requester uses a large language model to generate a semantic response in natural language format. The semantic response meets the preset generation cost conditions, and the requester embeds the API information to be called into the semantic response in a semantic steganography manner.

[0048] The specific steps of this method include: the generation cost conditions include that the number of tokens in the semantic response is greater than or equal to a first threshold, and the semantic coherence score of the semantic response is greater than or equal to a second threshold; the computational cost of the verifier performing the legitimacy verification is lower than the computational cost of the requester generating the semantic response; the legitimacy verification relies solely on the requester's large language model semantic generation capability as the root of trust, without depending on any one of passwords, tokens, digital signatures, or digital certificates; and embedding the API information to be called into the semantic response in a semantic steganography manner includes, according to a pre-agreed semantic pattern, embedding the API interface name... The API name, call parameters, and business intent data are integrated into the natural language context of the semantic response, forming an inseparable holistic semantic expression with the context. The semantic pattern includes embedding the API name as an action verb into a subject-predicate-object structure, or integrating parameter values ​​as attributives or adverbs into sentence components. The requester must generate high-cost semantic content, which is manifested in at least one of high token quantity, high logical coherence, or high semantic complexity. The verification process of the verifier is a lightweight verification with low computational overhead, thereby forming an asymmetric cost mechanism between the verification cost of the verifier and the generation cost of the requester.

[0049] The requesting device internally deploys a large language model inference engine, a semantic response generator, an API steganography encoder, and a cost condition verification module. Upon receiving the semantic challenge (including Nonce, topic constraint, and minimum token threshold) issued in step S1... Semantic coherence threshold After receiving the expiration timestamp, the requester first parses the challenge and checks if the timestamp is within the valid window. If it has expired, it discards the challenge and returns a timeout error. Then, the requester's large language model inference engine uses the topic constraint as a prefix for the prompt, and simultaneously includes the API information to be called (including the API interface name). Parameter list and business intent identifier The API information is input as the target for steganography to the API stegcoder. This stegcoder converts the API information into natural language phrases or sentence fragments based on a pre-agreed semantic steganography rule base between the communicating parties. Let the API information be represented as triples. ,in This is a set of key-value pairs for parameters. The steganography rule base defines the mapping function. ,Will Convert to natural language strings Mapping rules can be deterministic functions based on syntactic structure, such as... Mapping to verb phrases, each The code maps noun phrases as objects or adverbs, and arranges them in a fixed word order to form a sentence. To ensure the indivisibility of the steganography, the steganography encoder enforces that the generated text must be indivisible. It must be integrated into the overall natural language context of the response, rather than appearing as a separate sentence or explicit tag.

[0050] Next, the requester's large language model generates a semantic response using the following steps: constraining the topic and steganographic fragments. Together, these serve as the conditions for generation, invoking a large language model to generate a coherent natural language text. The generation process uses an autoregressive approach, and the probability distribution of the model's output text is as follows: ,in To ensure that the semantic response meets the generation cost condition, the requester enforces the following strategy: the number of tokens used to generate the text. It must be greater than or equal to the first threshold. (For example Simultaneously, the requesting party internally calls a lightweight semantic coherence scoring model (e.g., a BERT-based semantic similarity or perplexity estimator) to calculate... Consistency rating The score is defined as the inversely normalized value of the negative log-likelihood per unit length, and the specific calculation formula is as follows:

[0051]

[0052] in for The length of the token sequence, For the first generation model The conditional probability of each token. When and At that time, semantic response If the generation cost condition is met, the requester will regenerate or adjust the generation parameters (e.g., increasing the temperature coefficient to increase randomness, extending the generation length, etc.) until the condition is met. This is because large language models generate complete... This requires extensive matrix operations and memory accesses, with computational overhead far exceeding the lightweight semantic verification that the verifier only needs to perform subsequently, thus creating an asymmetric cost mechanism. Ultimately, the requesting party will generate a semantic response. (Including steganographic API information) is sent back to the verifier via the underlying transport protocol, and may also include a Nonce to associate with the original challenge.

[0053] S3: The verifier receives the semantic response and performs a legality verification on the semantic response. The legality verification includes verifying the semantic relevance of the semantic response to the semantic challenge and verifying whether the generation cost of the semantic response is higher than a preset threshold.

[0054] The specific steps of this method include: the generation cost conditions include that the number of tokens in the semantic response is greater than or equal to a first threshold, and the semantic coherence score of the semantic response is greater than or equal to a second threshold; the computational cost of the verifier performing the legality verification is lower than the computational cost of the requester generating the semantic response; the semantic challenge includes a one-time random identifier and a topic constraint, and the legality verification also includes verifying that there is at least one information unit in the semantic response that semantically matches the topic constraint, and verifying that the one-time random identifier has not been used and has not expired; the legality verification uses only the requester's large language model semantic generation capability as the root of trust, and does not rely on any one of passwords, tokens, digital signatures, or digital certificates; the generation and distribution of the semantic challenge and the execution of the API call and output of the structured call result are completed by the verifier within a single stateless request-response interaction cycle, and the interaction cycle does not maintain session state, which includes not storing the one-time random identifier, not caching the semantic response, and not retaining the API call history.

[0055] The verification device internally deploys a semantic verification engine, a one-time random identifier anti-replay cache, a semantic relevance evaluator, and an asymmetric cost verification module. When the verification device receives the semantic response from the requester via the underlying transport protocol... Next, the Nonce field is extracted, and the locally maintained anti-replay cache is queried. The validator maintains a recent time window. The set of hashes of nonces received within (e.g., 60 seconds). Let the time when the response is received be... The expiry date recorded when the challenge was issued was... ,like If the nonce already exists in the anti-replay cache, it is considered a replay attack, and the response is rejected; otherwise, the nonce is added to the cache and its expiration time is set to [time value missing]. The cache is periodically cleaned to control memory usage.

[0056] Next, the verifier will respond to the semantic response. Perform generation cost verification. The verification party first calculates the costs. Number of tokens It can be processed by a general word segmenter. After encoding, it is obtained, that is .like If the requester fails to meet the generation cost condition, the verification fails. Then, the verifier calculates the semantic coherence score of the response. The coherence score uses the same definition as in step S2, which is to calculate the inverse normalized value of the negative log-likelihood per unit length based on the lightweight language model. The specific calculation formula is as follows:

[0057]

[0058] in for The length of the token sequence, Predict the first for the lightweight language model The conditional probability of each token. If If the response quality is deemed too low, the verification fails. Since the verifier's calculations only involve token statistics and lightweight model inference, its computational cost is far lower than the requester's generation cost, forming an asymmetric cost barrier.

[0059] Next, the verifier performs semantic relevance verification. The verifier retrieves the previously issued topic constraint (usually returned by the requester in the response) from storage and calls a lightweight semantic matching model to calculate similarity. The similarity is then calculated by combining the topic and... Input each into the pre-trained semantic embedding model to obtain the embedding vector. and Then calculate the cosine similarity:

[0060]

[0061] Let the preset similarity threshold be... (For example ),like Then determine Related to the semantics of the topic, i.e. The requester must contain at least one information unit that semantically matches the topic constraint; otherwise, the verification fails. If any of the above verifications fails, the entire legality verification fails, and the verifier immediately returns a simplified status code and ends the interaction. Only when all verifications pass is the requester considered a legitimate intelligent agent.

[0062] S4: After successful verification, the verifier extracts the API information from the semantic response according to predefined steganography rules.

[0063] The method of this step specifically includes: the verifier extracts the API information from the semantic response according to the predefined steganography rules, including extracting only three types of information: API interface name, call parameters, and business intent data, and outputting the three types of information in a fixed format, which is a key-value pair structure or a JSON structure, which at least contains an API name field and a parameter field, but does not contain any natural language description fields.

[0064] The verification device is internally equipped with a semantic steganography decoder, a rule matching engine, and a structured output formatter. The verification party and the requesting party have pre-agreed on a steganography rule base. ,in For pattern matching templates (such as regular expressions or semantic slot filling templates). For the type of information to be extracted, This defines the field mapping rules. For example, for the API call "Query Weather", the steganography rule could be defined as "Query the weather for [city name]", where square brackets represent the parameter slots to be extracted. The semantic steganography decoder will then interpret the semantic response. As input, the rule base is traversed in priority order to attempt matching patterns. The matching process is based on regular expressions or named entity recognition, which has low computational overhead. Let's say a rule is matched. The extracted slot set is ,in For parameter name, This refers to the string value extracted from the text. Meanwhile, the rules... Associated with API function name and business intent identifier The extracted API information triplet is: If no rule is matched or extraction fails, an error code is returned and the interaction terminates. If extraction is successful, the verifier retains only [the data / resources]. slots and All other natural language content is discarded. Then, the structured output formatter converts these three types of information into a fixed-format JSON structure, for example:

[0065]

[0066] The output does not contain any free-form natural language description fields.

[0067] S5: The verifier executes an API call based on the extracted API information and outputs a structured call result, which does not contain free-form natural language content.

[0068] The specific steps of this method include: the output of structured call results includes the verifier only returning structured data in a predetermined format, prohibiting the generation or return of any free-form natural language text, and the verifier not retaining any contextual information related to this interaction; the generation and issuance of semantic challenges and the execution of API calls and output of structured call results are completed by the verifier within a single stateless request-response interaction cycle, the interaction cycle does not maintain session state, the lack of session state maintenance includes not storing one-time random identifiers, not caching semantic responses, and not retaining API call history.

[0069] The verification device internally deploys an API execution engine, a result structure encoder, and a one-time interaction controller. The API execution engine, based on the extracted API function names... and parameter set Execute the corresponding local or remote call. Let the constructed API request be... The engine sends requests to the backend service and receives the execution results. The result is that the structured encoder will... Structured output encapsulated in a predefined format ,For example:

[0070]

[0071] Error message It must also be a predefined enumerated string, not a dynamically generated natural language sentence. The validator does not perform any open-ended natural language generation and outputs... This does not contain any free text. The one-time interaction controller releases all resources associated with the interaction immediately after the output is sent: deletes the Nonce entry from the anti-replay cache, clears temporary state in the API execution engine, and destroys the buffer. The validator does not store semantic responses. Extracted API information Execution results or output Backups are provided. The entire interaction cycle is stateless, with each request independent, thereby minimizing the attack surface and eliminating the risk of context hijacking.

[0072] Through the steps S1 to S5 described above, the embodiments of this application realize agent legitimacy verification based on asymmetric cost semantic challenges and secure API call transmission based on semantic steganography. Identity authentication and business calls are completed in an integrated manner in a single stateless interaction, and intrinsic security capabilities such as anti-DDoS, anti-replay, and anti-prompt injection are provided from the protocol mechanism level.

[0073] Building upon the aforementioned method embodiments, this application also provides a further optimization scheme, integrating mechanisms such as generation cost verification, steganography rule updates, differential privacy protection, and auditability into a unified semantic proof-of-work framework. This framework, through an additional cryptographic challenge, enables the requester to achieve multiple security objectives while generating a semantic response, thereby significantly improving the security and privacy of the protocol without increasing the number of interaction rounds.

[0074] After receiving the semantic challenge from the verifier, the requesting party first generates the original semantic response according to the steps of the aforementioned method embodiment. Here, the original semantic response This refers to the tokens generated directly by the requester's large language model without adding any privacy-preserving noise, meeting the generation cost condition (i.e., the number of tokens is not less than a preset threshold). And the consistency score is not less than the preset threshold. The original response is the natural language text. It forms the basis for all subsequent transformations but is not sent directly to the verifier. The original response satisfies the generation cost condition, i.e., its token count. And consistent scoring At the same time, API information is embedded according to the steganography rules of the current valid version. To defend against model reverse engineering attacks, the requesting party... Differential privacy protection is applied to generate a response that is ultimately released to the public. Model reverse engineering attacks refer to attackers collecting a large amount of model output text to infer the model's internal parameters or sensitive information in the training data. Differential privacy is a mathematical framework that protects the privacy of individual data points by injecting carefully calibrated random noise into the output, making it impossible for attackers to distinguish the outputs of two training sets that differ by only one data point. Specifically, let... For privacy budget, For global sensitivity. Privacy budget. Controlling noise intensity: The smaller the value, the greater the noise and the stronger the privacy protection, but the output quality degrades; values ​​are typically between 1.0 and 4.0. Global Sensitivity Defined as: the maximum change in the model's output probability distribution for any two input sequences that differ by only one token. This value can be determined through prior model analysis. The requester obtains the original probability distribution when generating each token via autoregression. Then for each candidate word The score is increased by adding independent Laplace noise. The perturbation score is obtained. Then, the softmax function is used to obtain... Finally press The actual token is obtained through sampling. Laplace noise. It is a scale parameter with a mean of 0. The Laplace distribution has a probability density function of: Adding this noise can satisfy... -Differential privacy, in which (When the output is a single token). This step allows the final response to be obtained. It is impossible to accurately deduce the probability distribution inside the model, thus protecting the privacy of the requester's model parameters and training data. Macro-statistical attributes (such as token count, coherence, semantic relevance) and The difference is minimal and does not affect subsequent verification.

[0075] Next, the requester needs to solve a "semantic proof-of-work" deeply bound to the response content. Semantic proof-of-work is a cryptographic mechanism that requires the requester to solve a problem using given data (here, a semantic fingerprint). Based on this, and by expending certain computational resources (usually hash operations), a random number that satisfies specific difficulty conditions is found. This proof can demonstrate to the verifier, without relying on a third party, that the requester has consumed computing power proportional to the difficulty level. (Define semantic fingerprint) ,in For collision-resistant hash functions (e.g., SHA-256). To verify the one-time random identifier in the challenge issued by the verification party, Subject constraints. Hash function. It is a mathematical function that maps an input of arbitrary length to a fixed-length output (256 bits). It is unidirectional and collision-resistant, meaning it is impossible to deduce the input from the output, and it is virtually impossible to find two different inputs that produce the same output. Here, Nonce, topic, and response are used... After concatenating the three data points, inputting them into a hash function yields the result. Because the nonce is random and different each time, even if the same agent generates the same response to the same topic, This will also be completely different depending on the change in the nonce, thus preventing replay attacks. The validator adds a difficulty level to the challenge. This coefficient is dynamically generated based on the sensitivity level of the requested API and the requester's historical reputation score. Difficulty coefficient The difficulty level of proof of work was controlled: For every 1 increase, the average number of hash calculations required doubles. For highly sensitive APIs (such as fund transfers and data deletion), the verifier will set a larger value. This forces the requester to incur higher computational costs, thereby preventing abuse. The requester needs to find a random number. (called semantic random numbers) such that the following inequality holds:

[0076]

[0077] in In response The number of tokens, Let be the size of the hash function's output space. The left side of the inequality represents the semantic fingerprint. With random numbers The 256-bit integer obtained by concatenating and then performing a hash operation (considered as 0 to 1) (Integers between [a certain value]). The right side of the inequality is the difficulty threshold, which is related to [a certain value]. and Inversely proportional. Since the output of a hash function can be considered uniformly random, the probability of the inequality holding true is approximately... This means the expected number of attempts is... .Notice, It is the length of the response token, which is usually not less than (e.g., 256), therefore the solution cost increases with... The cost increases exponentially and is proportional to the length of the response. Attackers must incur the same amount of computational overhead to forge legitimate responses, thus creating a cumulative cost barrier commensurate with the API's sensitivity.

[0078] In search During the process, the requesting party also needs to utilize The low-order bits carry version information of the steganography rules and a commitment to future updates. This design cleverly combines rule negotiation and proof-of-work into one, eliminating the need for additional communication rounds. Divided into high-level parts and low position part The low-bit width is bits (e.g.) Let the version number of the currently effective steganography rule be . (An integer), the requester wants the next updated rule base hash value to be... Then let That is, the lower half is used to store the version number, and the other half stores the truncated value of the new rule hash. Here, " " indicates a left shift operation, " " indicates a bitwise XOR operation. It shifts the version number left." The bits are adjusted so that they occupy the high-order part, and then XORed with the truncated hash value, so that the two can be extracted independently without interference. The requester only changes the bits during the search process. ,Keep Fixed. Successfully found. This also proves that the requester used the correct version of the steganography rules and expressed a willingness to accept future rule updates. The verifier, during subsequent verification, will then... Extract the version number and expected update hash ,examine Is it equal to the current global version number? If a hash differs from the current rule base hash and is proposed by a majority of agents within a certain time window, an online negotiation update of the rule base is triggered.

[0079] To support zero-knowledge verification and auditability, the requester sends... Previously, it was necessary to use zero-knowledge concise non-interactive knowledge proofs (zk-SNARKs) to generate a proof. Prove the following three assertions without revealing [the relevant information]. The plaintext of zero-knowledge proofs is that one party (the prover) can prove a mathematical proposition to another party (the verifier) ​​that it is true without revealing any additional information beyond the truth value of the proposition. zk-SNARKs are a highly efficient zero-knowledge proof system, with small proof size (typically a few hundred bytes) and extremely fast verification time (milliseconds). First, there exists an original response. This makes from arrive The differential privacy perturbation amplitude is within a preset range (i.e.) yes (a legitimate, privacy-protected version); this assertion ensures the final response. It was indeed obtained by adding noise to a legitimate original response, not by arbitrarily constructed text. Secondly, from... According to the version number (from The steganography rules extracted from it can extract a unique API information triple. This assertion guarantees that the API call information hidden in the response is extractable and conforms to the rules, but the verifier does not need to see the API information itself to believe it exists. Third, the semantic work proof inequality holds, i.e. This assertion directly proves that the requester has indeed completed the required proof of work. The proof circuit includes a hash function, Laplace noise detection, a steganography lookup table, and integer comparison operations. Since the verification complexity of zk-SNARKs is constant, the verifier can quickly verify the work. The correctness of the hash is ensured without having to re-perform any hash or semantic analysis.

[0080] After receiving the data from the requester, the verifier performs verification in the following order. First, it checks... Whether it is within a valid time window and has not been used (a Bloom filter-based anti-replay cache can be used). A Bloom filter is a space-efficient probabilistic data structure used to determine whether an element belongs to a set. Here, it is used to store the Nonces that have appeared in the most recent time window, which can quickly reject used Nonces while avoiding the high memory overhead of storing all historical Nonces. If invalid, it is rejected directly. Then, the zero-knowledge proof is verified. If invalid, it will also be rejected. Then proceed from... Extract version number This confirms that it is consistent with the current global version. Finally, the verifier may selectively recalculate. And check (Although this condition has been) This is proven in the text, but verification only requires two hash operations, making the cost extremely low. After all verifications pass, the verifier accepts the interaction and, based on the... The API information actually extracted (through steganography rules) is used to execute the call.

[0081] In the above process, the difficulty level It can be adaptively adjusted. Let the median of the historical request interval sequence of the requester be... Current credit rating is divided into (Initially 100, with points deducted for each borderline legitimate response). The median request interval reflects the agent's normal request frequency, while the reputation score reflects the honesty of its historical behavior. The validator calculates the valid difficulty. and the length of the time window Values ,in For a safety factor (e.g., 1.5), Preset boundaries (e.g., 5 seconds and 60 seconds). The lower the reputation score, the lower the threshold. The larger the increase, the higher the computational cost for the requester to pass the verification. Meanwhile, the length of the time window... The exponential shortening of the timeframe as reputation score decreases makes it nearly impossible for low-reputation agents to complete complex proof-of-work within an extremely short period. Agents with low reputation and high request frequency will face even greater challenges. The shorter window makes it difficult for them to complete complex proofs within the validity period, thus effectively curbing attacks.

[0082] This optimization scheme encapsulates several previously independent security mechanisms (cost proof, rule update, privacy protection, replay defense, and reputation penalty) into a single semantic work proof solution process. The requester only needs to append a random number after generating the response. A zero-knowledge proof The additional computation for the verifier is only a constant number of hash operations and one zk-SNARKs verification, fully preserving the asymmetric cost characteristic. The entire scheme seamlessly integrates with the core process (challenge-response-verification-extraction-execution) of the aforementioned method implementation, requiring only an addition to the verification step. and The verification process, and the option to increase the difficulty level in the challenge. This design, while maintaining backward compatibility, greatly enhances the security, privacy, and auditability of the protocol.

[0083] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0084] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A secure communication method for intelligent agent interaction, characterized in that, include: The verifier generates a semantic challenge and sends it to the requester. The requesting party uses a large language model to generate a semantic response in natural language format. The semantic response meets a preset generation cost condition, and the requesting party embeds the API information to be called into the semantic response in a semantic steganography manner. The verifier receives the semantic response and performs a legality verification on the semantic response. The legality verification includes verifying the semantic relevance of the semantic response to the semantic challenge and verifying whether the generation cost of the semantic response is higher than a preset threshold. After successful verification, the verifier extracts the API information from the semantic response according to predefined steganography rules; The verifier executes an API call based on the extracted API information and outputs a structured call result, which does not contain free-form natural language content.

2. The method according to claim 1, characterized in that, The generation cost conditions include that the number of tokens in the semantic response is greater than or equal to a first threshold, and the semantic coherence score of the semantic response is greater than or equal to a second threshold; the computational cost for the verifier to perform the legality verification is lower than the computational cost for the requester to generate the semantic response.

3. The method according to claim 1, characterized in that, The semantic challenge includes a one-time random identifier and a topic constraint; the legality verification also includes verifying that there is at least one information unit in the semantic response that semantically matches the topic constraint, and verifying that the one-time random identifier has not been used and has not expired.

4. The method according to claim 1, characterized in that, The legitimacy verification relies solely on the requester's large language model semantic generation capability as the root of trust, and does not depend on any of the following: password, token, digital signature, or digital certificate.

5. The method according to claim 1, characterized in that, The step of embedding the API information to be invoked into the semantic response in a semantic steganographic manner includes integrating the API interface name, calling parameters, and business intent data into the natural language context of the semantic response according to a pre-agreed semantic pattern, so that it forms an inseparable whole semantic expression with the context; the semantic pattern includes embedding the API name as an action verb into a subject-predicate-object structure, or embedding the parameter value as an attributive or adverbial into sentence components.

6. The method according to claim 1, characterized in that, The verifier extracts the API information from the semantic response according to predefined steganography rules, including extracting only three types of information: API interface name, call parameters, and business intent data, and outputs the three types of information in a fixed format; the fixed format is a key-value pair structure or a JSON structure, which contains at least an API name field and a parameter field, but does not contain any natural language description fields.

7. The method according to claim 1, characterized in that, The structured output of the call results includes the verifier returning only structured data in a predetermined format, prohibiting the generation or return of any free-form natural language text; and the verifier does not retain any contextual information related to this interaction.

8. The method according to claim 1, characterized in that, The generation and distribution of semantic challenges and the execution of API calls and output of structured call results are completed by the verifier within a single stateless request-response interaction cycle. The interaction cycle does not maintain session state, which includes not storing one-time random identifiers, not caching semantic responses, and not retaining API call history.

9. The method according to claim 1, characterized in that, The method further includes transmitting the semantic challenge and the semantic response over any underlying transport protocol; the underlying transport protocol is used to provide reliable data transmission or routing functions, without participating in the legitimacy verification and the extraction of the API information; the underlying transport protocol includes at least one of TCP, UDP, HTTP, HTTPS, WebSocket or gRPC.

10. The method according to claim 1, characterized in that, The requester must generate high-cost semantic content, which is manifested in at least one of high token quantity, high logical coherence, or high semantic complexity; the verification process of the verifier is a lightweight verification with low computational overhead, thereby forming an asymmetric cost mechanism between the verification cost of the verifier and the generation cost of the requester.

Images