Skill encryption packaging based on large language model and three-layer leak prevention system and method

Abstract

The application discloses a Skill encryption packaging and three-layer leakage prevention system and method based on a large language model, a publishing side encryption packaging module encapsulates a Skill into a plaintext interface file, an encryption implementation file and an integrity signature file, and interface and implementation are separated; a dynamic decryption execution module completes one-time decryption execution in a sandbox secure memory based on identity authorization, and immediately erases a key and plaintext data after execution; a three-layer leakage prevention module blocks user inquiry leakage, LLM execution process leakage and output content leakage through input interception, execution isolation and output filtering; an information disclosure strategy is defined by a publisher, and information disclosure boundaries are controlled throughout the whole process. The application can realize Skill core logic encryption protection, LLM execution process information isolation and output content accurate filtering, and effectively solves problems such as source code exposure and LLM natural language leakage in an Agent scene.

Description

Technical Field

[0001] This invention relates to the field of large language model security technology, and in particular to a Skill encryption encapsulation and three-layer anti-leakage system and method based on a large language model. Background Technology

[0002] With the widespread deployment of AI Agent systems, Skills (skills / tools) serve as the core carriers of agent capabilities. However, the existing technology system faces three major technical challenges: Plaintext distribution of skills completely exposes proprietary algorithms and business logic. In the existing AI Agent ecosystem, skills are distributed and deployed in plaintext source code or unencrypted bytecode. Any user who obtains the skill package can directly view, copy, and even modify its complete implementation logic. For skills containing core technologies such as proprietary algorithms, proprietary model invocation logic, and commercial pricing strategies, their entire commercial value is exposed the moment of distribution. Traditional software can increase the difficulty of reverse engineering through obfuscation and compilation into machine code, but in the AI ​​Agent scenario, the skill interface description itself contains a large amount of semantic information, weakening the protection effect. Publishers cannot securely sell skills as commercial products, severely restricting the healthy development of the commercial skill market in the Agent ecosystem.

[0003] The threat model unique to Large Language Models (LLMs) involves the risk of natural language leakage during execution. Traditional code protection techniques assume attackers obtain implementation details through reverse engineering, completely neglecting the novel threat vector of LLMs. LLMs possess powerful language expression and reasoning capabilities. During Skill execution, they may observe execution logs, intermediate results, and call parameters, describing this information to the user in fluent natural language. Users can simply ask questions like "How is this function implemented?" or "What interface did you just call?" and LLMs can unintentionally leak sensitive information such as Skill implementation details, internal states, and call chains. This is a leakage threat model unique to AI Agent scenarios, rendering code-level protection methods completely ineffective.

[0004] Existing code protection technologies systematically fail in LLM agent scenarios. The existing code protection technology system (static obfuscation, bytecode encryption, TEE trusted execution environments, etc.) is based on the assumption of a "trustworthy execution environment and irreversible output." However, in the LLM agent architecture: ① the execution environment (LLM inference process) has language generation capabilities, capable of converting any observed information into natural language output; ② skill interface descriptions must be exposed to the LLM in natural language, making it impossible to completely hide the implementation intent; ③ the call chain during multi-skill collaboration is visible to the LLM, allowing the LLM to infer the implementation details of each skill from the overall behavior pattern. These three points collectively cause existing protection technologies to systematically fail in agent scenarios, necessitating a comprehensive protection solution specifically designed for LLM agent threat models. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a Skill encryption encapsulation and three-layer anti-leakage system and method based on a large language model.

[0006] To achieve the objectives of this invention, the technical solution adopted is as follows: A Skill encryption encapsulation and three-layer anti-leakage system based on a large language model includes a release-side encryption encapsulation module, a dynamic decryption execution module, a three-layer anti-leakage module, and an information disclosure strategy configuration module. The publishing-side encryption encapsulation module is used to encapsulate the Skill into a skill package containing a plaintext interface file, an encrypted implementation file, and an integrity signature file, thereby separating the interface from the implementation. The dynamic decryption and execution module is used to complete one-time decryption and execution in the sandbox secure memory based on identity authentication and authorization; The three-layer anti-leakage module consists of an input interception layer, an execution isolation layer, and an output filtering layer, which blocks leakage of user queries, leakage of LLM execution process, and leakage of output content; The information disclosure strategy configuration module is used by the Skill publisher to define the scope of information that is allowed and prohibited from being disclosed, and is executed throughout the three-layer anti-leakage module.

[0007] Furthermore, the publishing-side encryption encapsulation module includes: The plaintext API file manifest.json contains a description of the skill, an API summary, input / output parameter specifications, version metadata, publisher information, and information disclosure policy fields, but does not contain implementation details. The encryption implementation file impl.enc is generated by compiling the Skill source code into bytecode or WebAssembly format and then using AES-256-GCM symmetric encryption. The integrity signature file, signature.sig, is generated by digitally signing the hash values ​​of manifest.json and impl.enc using the publisher's private key. It is used for identity and integrity verification during loading.

[0008] Furthermore, the dynamic decryption execution module performs the following process: When the intelligent agent is running, it initiates a decryption key request to the authorization center, carrying identity credentials and a unique Skill identifier; the authorization center completes identity verification, authorization validity verification, and multi-dimensional binding constraint checks; after successful verification, a one-time temporary decryption key OTK is generated and distributed through a secure channel; the agent is decrypted and executed in the sandbox-protected memory using OTK, and immediately erased from the OTK and plaintext bytecode after execution, without persistent storage.

[0009] Furthermore, the input interception layer employs a two-stage cascaded classifier: The first level is a rule engine, which uses precise matching of keywords and sentence templates to directly block explicit leak queries. The second level is a lightweight intent classification model, which performs semantic recognition on ambiguous and indirect disclosure queries; blocked requests are not entered into LLM inference, and whitelisted queries are exempted from the disclosure policy.

[0010] Furthermore, the execution isolation layer is implemented through process-level physical isolation: Skills execute in an independent sandbox process, which is strongly isolated from the LLM inference process. Input parameters, execution status, and final return values ​​are only passed through an IPC whitelist. The LLM can only access plaintext interface files and cannot physically access encrypted implementation files. All output streams from the sandbox execution are intercepted and discarded, and only the final result is output. When multiple Skills are executed collaboratively, the call chain is black-boxed, and the LLM only receives the final aggregated result.

[0011] Furthermore, the output filtering layer employs two-level detection: Structured rule filtering: Based on regular expressions and keyword blacklists, it quickly scans and removes structured sensitive information. Semantic similarity detection compares the output with the prohibited description domain vector to remove obscure and leaky expressions; after filtering, only legitimate business results are retained, adhering to the principle of pure business results.

[0012] Furthermore, the information disclosure strategy includes an allow_questions whitelist, a block_questions blacklist, and a default_policy, declared in manifest.json in JSON format, which collaboratively control the interception, isolation, and filtering behavior of the three-layer anti-leakage module.

[0013] A Skill encryption encapsulation and three-layer anti-leakage method based on a large language model includes the following steps: (1) Skill Encryption Packaging: Compile the Skill source code into bytecode or WebAssembly, encrypt it with AES-256-GCM to generate impl.enc; extract interface information and disclosure policy to generate manifest.json; digitally sign the two files to obtain signature.sig, and package it into skill.pkg for distribution; (2) Authorization and decryption execution: The agent verifies the skill package signature and applies for authorization from the authorization center; after passing the identity, license, and binding constraint verification, it obtains a one-time key; it decrypts and executes the code in the sandbox secure memory, and immediately erases the key and plaintext after execution; (3) Input interception: User requests are detected by the rule engine and the lightweight intent model at two levels. Information leakage inquiries are intercepted, whitelisted issues are allowed, and intercepted requests are not entered into the LLM. (4) Execution isolation: Skill runs in an independent sandbox process, physically isolated from the LLM process, and only transmits input, status and results through IPC whitelist, shielding execution logs and intermediate information, making the call chain black box; (5) Output filtering: Perform two-layer detection of structured rules and semantic similarity on the LLM output, remove the leaked content, and retain only the legitimate business results output; (6) Strategy control: Load manifest disclosure strategy to control the information disclosure boundary throughout the entire process.

[0014] The beneficial effects of this invention are as follows: Compared with the prior art, the encrypted encapsulation and three-layer anti-leakage system proposed in this invention has the following technical effects: The implementation details of the Skill are completely invisible: encrypted distribution ensures that no unauthorized party can obtain the implementation content from skill.pkg; the separation of interface and implementation design allows users to see only the interface summary and the delivery capability rather than the delivery implementation, fully protecting the core of Skill development and enabling secure operation in the commercial Skill market.

[0015] LLM cannot infer the Skill implementation from the execution process: the execution isolation layer severs the information channel between LLM and the implementation details of the Skill from an information theory perspective. LLM cannot physically access impl.enc, the execution output is completely truncated, and the call chain is black-boxed. LLM fundamentally does not know the implementation details, rather than relying on them not to reveal them, providing a more reliable security guarantee than the autonomy of LLM.

[0016] Users cannot obtain Skill / Agent internal characteristics through queries: A three-layer anti-leakage architecture forms a complete protection loop. The three independent defenses cover different attack paths, complementing each other to form a defense-in-depth system. The input interception layer blocks queries before they enter the LLM; the execution isolation layer ensures that the LLM has no implementation content to answer; and the output filtering layer detects and removes leaked content as a fallback.

[0017] Publishers can finely control the boundaries of information disclosure: The configurable disclosure strategy mechanism empowers publishers to customize information boundaries according to business needs, protecting intellectual property rights without affecting legitimate functional inquiries, effectively improving the user experience of Skill products, and achieving the optimal balance between security protection and product usability.

[0018] Anti-tampering ensures Skill integrity: The digital signature mechanism ensures that skill.pkg is not tampered with during distribution. The Agent forces signature verification when loading, preventing attackers from injecting malicious code into the execution environment by replacing the Skill package, thus ensuring the overall security of the Agent system and establishing a trustworthy Skill supply chain system.

[0019] License authorization is traceable and revoked: Multi-dimensional binding and a real-time revocation mechanism from the authorization center give Skill publishers complete visibility and immediate control over the usage status of each license. The one-time nature of the Temporary Key (OTK) ensures immediate revocation, solving the problem of delayed revocation in traditional software licenses. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the Skill encryption encapsulation and three-layer anti-leakage system based on a large language model as described in this invention; Figure 2 This is a schematic diagram of the information disclosure strategy mechanism. Detailed Implementation

[0021] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of this application.

[0022] like Figure 1 As shown, the Skill encryption and three-layer anti-leakage system based on a large language model described in this invention includes a publishing-side encryption and encapsulation module, a dynamic decryption execution module, a three-layer anti-leakage module, and an information disclosure strategy configuration module; it achieves full-link protection from four dimensions: skill production, distribution, execution, and interaction, and provides systematic protection against the unique threat model of LLM Agent scenarios.

[0023] The release-side encryption encapsulation module is used to encapsulate Skill into a skill package containing plaintext interface files, encrypted implementation files, and integrity signature files; achieving complete separation of interface and implementation, and solving the problem of Skill source code distribution exposure.

[0024] The manifest.json file (plaintext API file) contains a description of the skill's functionality, an API summary, input / output parameter specifications, version metadata, publisher information, and disclosure policy fields configured by the publisher (allow_questions / block_questions / default_policy). This file exists in plaintext for Large Language Models (LLMs) to read in order to understand the skill's capabilities, strictly excluding any implementation details. The API summary generation algorithm ensures a complete description (LLM can accurately understand what the skill can do) but cannot deduce the implementation logic, thus fully exposing the API while completely protecting the implementation.

[0025] impl.enc (encrypted implementation file): After the Skill source code is compiled into bytecode (Python bytecode / JVM bytecode) or WebAssembly (WASM) format, it is encrypted using the AES-256-GCM symmetric encryption algorithm to generate a ciphertext file. This prevents the ciphertext from being tampered with during storage or transmission and subsequently decrypted to execute malicious code. The encryption key is held by the publisher and registered with an authorization center. Any third party without a valid license cannot decrypt and view the implementation content. Compared to the source code, the bytecode / WASM format further increases the difficulty of reverse analysis assuming successful decryption, forming a double layer of protection.

[0026] signature.sig (integrity signature file): The publisher uses their private key (RSA-2048 or ECDSA-P256) to digitally sign the SHA-256 hashes of manifest.json and impl.enc, generating a signature file. The Agent enforces signature verification when loading the Skill, confirming the publisher's legitimacy and that the file has not been tampered with. This fundamentally prevents the Skill package from being maliciously replaced or injected with malicious code during distribution, ensuring the trustworthiness and integrity of the entire distribution chain.

[0027] Complete release process: ① Write Skill source code; ② Compile to bytecode / WASM; ③ Encrypt bytecode with AES-256-GCM to generate impl.enc, and register the encryption key with the authorization center; ④ Extract interface digest to generate manifest.json (including interface specifications and disclosure policy); ⑤ Jointly sign the two files with the publisher's private key to generate signature.sig; ⑥ Package into skill.pkg and upload to the Skill registry for distribution. After obtaining the skill package skill.pkg, users can only read manifest.json. The implementation details of impl.enc are completely invisible at the physical level, truly achieving the core protection goal of delivering capabilities rather than just the implementation.

[0028] The dynamic decryption and execution module is used to complete one-time decryption and execution in the sandbox secure memory based on identity authentication and authorization license, so that the key and plaintext are not written to disk.

[0029] Dynamic decryption execution process: ① When the agent runs, it initiates a decryption key application to the central authorization center (License Authority), carrying the agent's identity credentials (digital certificate or JWT token) and the target skill's unique identifier; ② The authorization center performs multi-dimensional verification: agent identity verification (certificate chain), license validity query (database), and multi-dimensional binding constraint check; ③ After successful verification, a one-time temporary decryption key (OTK) is generated and distributed through the bidirectional transport layer security protocol mutual TLS secure channel; ④ The sandbox process uses the OTK to decrypt impl.enc in the protected memory, obtains the plaintext bytecode, and immediately loads and executes it; ⑤ After execution, the OTK and plaintext bytecode are immediately cleared through secure memory erasure, without being written to any persistent storage medium, achieving zero key write-to-disk.

[0030] License multi-dimensional binding supports any combination of four binding dimensions: ① Agent ID binding (only specific Agent instances can apply for keys); ② Machine fingerprint binding (CPU serial number / motherboard universal unique identifier UUID combination, preventing virtual machine copying to bypass authorization); ③ Time window binding (automatically rejects key applications after subscription expires, supporting subscription-based business models); ④ Call count binding (rejects applications after cumulative calls exceed the authorization limit, hardware security module HSM protects against tampering counters, supporting pay-as-you-go billing). The authorization center supports real-time revocation, and the one-time nature of OTK ensures that revocation takes effect immediately from the next call request, without needing to track issued keys.

[0031] The three-layer data leakage prevention module consists of an input interception layer, an execution isolation layer, and an output filtering layer, forming a defense in depth.

[0032] The input interception layer performs intent analysis and selective interception before user requests reach the LLM inference engine, serving as the first line of defense in the three-layer data leakage prevention architecture. By completely decoupling the interception judgment from the LLM inference, it ensures that queries involving the internal characteristics of the Skill / Agent are blocked before reaching the LLM, fundamentally eliminating the inherent risk that the LLM may know the implementation details but inadvertently reveal them during the conversation.

[0033] The input interception layer employs a two-stage cascaded classifier design, balancing interception speed and coverage breadth: Level 1 rule engine (latency <1ms): Performs precise string matching based on a predefined list of keywords (implementation / source code / code / algorithm / interface call, etc.) and sentence templates ("how it's implemented", "what technology is used", "how it works internally", etc.). Interception coverage includes: ① querying Skill implementation logic / source code / algorithm; ② querying Agent internal configuration / system prompt; ③ querying execution process / call chain / function call. Upon a clear match, interception is triggered directly without proceeding to Level 2, ensuring minimal latency overhead.

[0034] The second-level lightweight intent classification model (latency approximately 10ms): For variant expressions, indirect questions, and ambiguous semantic queries not covered by the rule engine, a specially fine-tuned lightweight text classification model with fewer than 100M parameters is used for intent recognition, classifying the input as either a privacy query or a normal business request. It can recognize implicit expressions in natural language such as "Could you explain the underlying logic in detail?" and "How did you achieve this capability?", significantly expanding the coverage blind spots of the rule engine.

[0035] When an interception is successful, the system directly returns a pre-defined rejection response with fixed wording, containing no hints about the reason for the interception, the interception mechanism, or internal information about the Skill / Agent, preventing attackers from inferring the system structure through multiple rounds of probing. The entire interception process prevents the request from entering the LLM inference stage, completely eliminating the fundamental risk that the LLM might know something but inadvertently reveal it. A whitelist (from the `allow_questions` field of the manifest disclosure policy) is allowed to be injected into the rule engine as an exception rule set. Query requests within the whitelist bypass the interception and directly enter LLM processing, allowing the publisher to customize the scope of acceptable responses.

[0036] The execution isolation layer ensures that internal information during Skill execution is not leaked to the LLM inference context through process-level physical isolation. This layer guarantees from the system architecture level that the LLM only knows the result when scheduling a Skill, not the process, completely cutting off the LLM's access to implementation details through execution observation.

[0037] The implementation of the isolation layer includes the following four key design mechanisms: Physical process isolation: Skill executes in an independent sandbox process (strong isolation via Linux namespaces / seccomp / cgroups), completely separated from the LLM inference process. The two processes interact through a strictly defined IPC whitelist interface, which only allows the transmission of three types of information: call input parameters (structured data), execution status (success / failure / error code), and final return value (structured data); the IPC layer whitelist filters and rejects any content outside the scope.

[0038] LLM knowledge access restrictions: When understanding and scheduling a Skill, the LLM can only access the interface digest (plaintext) in manifest.json. It cannot physically access impl.enc, and the ciphertext itself is not passed to the LLM process, completely eliminating the possibility of side-channel attacks by the LLM inferring implementation through analysis of ciphertext patterns. The LLM only knows what the Skill can do (interface), but has no physical knowledge of how it does it (implementation).

[0039] Output is completely truncated: the standard output stream stdout, standard error stream stderr, and system logs of the sandbox process are all intercepted and discarded by the isolation layer output monitoring component, and are not recorded to any location accessible to the LLM process. Debugging information, exception stacks, function call logs, performance metrics, and all other output streams that may contain implementation details are masked; the isolation layer only passes the execution status and final return value to the LLM context through an IPC whitelist.

[0040] Call chain black boxing: When multiple skills are executed in a chain in a pipeline, the output of the intermediate skill is directly passed to the next skill in the sandbox coordination layer. The LLM only receives the final aggregated result of the entire pipeline and has no way to observe the output content of the intermediate skills, the mutual call relationship and the data flow process. This eliminates the attack vector of the LLM inferring the implementation details of each skill by observing the intermediate result pattern.

[0041] All the information that LLM can receive about the Skill execution process is strictly limited to a subset of the manifest interface summary. There are no channels for information that could leak implementation details. This architectural design fundamentally solves the problem of the LLM-specific threat model.

[0042] The output filtering layer performs comprehensive risk detection and precise filtering of data leaks before the LLM generates and returns the response content to the user. The detection coverage includes: ① Skill name / version number / unique identifier; ② Agent internal configuration / system Prompt fragments; ③ Execution path / call stack / internal function name / module path / internal variable name; ④ Encryption key / License serial number / authentication token format string.

[0043] A two-tiered detection mechanism achieves a balance between high recall and low false positive rate: Structured rule filtering (delay <5ms, priority execution): Based on regular expressions (matching structured patterns such as API key format, UUID format, Skill ID format, token format, etc.) and keyword blacklists, the LLM output is scanned at high speed. Content fragments that match the rules are directly marked as leakage risks and removed, ensuring zero leakage of structured sensitive information.

[0044] Semantic similarity detection (handling cryptic expressions): Dense vector embeddings of the prohibited description domains (the implementation detail description space outside the manifest interface summary) for each Skill are pre-computed; the LLM output is segmented and encoded, and the cosine similarity between each segment and the prohibited description domain vectors is calculated; segments exceeding a preset threshold are marked as potentially leaky and removed. It can identify cryptic technical descriptions that rules cannot capture, such as "This feature uses a sequence labeling model based on the Transformer architecture and has been fine-tuned on a private dataset."

[0045] Filtering Decisions and Output Principles: When a risk of data leakage is detected, the filtering layer precisely removes the risky segments, retaining only the business results directly related to the user's task, ensuring that the user receives a complete and valid task response. The final output follows the principle of pure business results: the output only contains results related to the user's task; any Skill / Agent-specific information (except for those allowed by the manifest allow_questions whitelist) does not appear in the final output.

[0046] The information disclosure strategy configuration module is used by the Skill publisher to define the scope of information that is allowed to be disclosed and prohibited from being disclosed, and it is executed throughout the three-layer anti-leakage module.

[0047] like Figure 2 As shown, the information disclosure strategy mechanism empowers Skill publishers with fine-grained configuration capabilities for the three-tier data loss prevention architecture, enabling publishers to define the boundaries of information flow. The disclosure strategy is declared in manifest.json in structured JSON format, distributed along with skill.pkg, and loaded and takes effect during Agent deployment, persisting throughout the entire decision-making process of the three-tier data loss prevention mechanism.

[0048] The disclosure strategy includes three core fields: `allow_questions` (allowed whitelist): A list of question types that the publisher explicitly allows the LLM to answer for users, including functional and usability information such as "what can be done", "input / output format", "supported parameter types", "error code meaning", and "call frequency limit". The three-layer anti-leakage mechanism exempts the corresponding interception / isolation / filtering processing when it detects queries or outputs within the whitelist, allowing such information to flow normally to users, protecting intellectual property rights without reducing the usability and user experience of the Skill product.

[0049] `block_questions` (blacklist): Question types that the publisher explicitly refuses to allow LLM answers to. Typical examples include implementation-related and principle-related information such as "implementation principles," "models used," "training data sources," "internal architecture design," and "performance optimization methods." Blacklisted types are injected with high priority into the rule engine (as mandatory keyword patterns) and semantic detection prohibited description domains (as reference vectors for similarity matching), achieving highly targeted blocking.

[0050] `default_policy`: For issues that are neither in the whitelist nor the blacklist, the default behavior is executed: set to "allow" (default allows, suitable for feature-specific skills) or "block" (default denies, suitable for security-sensitive skills). Publishers can choose the appropriate default policy based on their business scenario.

[0051] The synergistic effect of the disclosure strategy across the three layers is as follows: Layer 1 (Input Interception Layer): The `allow_questions` whitelist injects exception rules into the rule engine, allowing whitelisted queries to bypass interception and directly enter the LLM; the `block_questions` blacklist prioritizes interception of corresponding keywords. Layer 2 (Execution Isolation Layer): Whitelisted information types are passed to the LLM context via the IPC protocol whitelist. Layer 3 (Output Filtering Layer): Whitelisted content types are excluded from the semantic detection prohibition description domain, allowing them to appear in the final output; blacklisted types are added to the structured rules for filtering. This three-layer synergy ensures that the information boundaries declared by the publisher are consistently enforced throughout the request processing chain, enabling the publisher to achieve fine-grained, programmable, and auditable precise control over the flow of Skill information.

[0052] This invention also provides a Skill encryption encapsulation and three-layer anti-leakage method based on a large language model, including the following steps: (1) Skill Encryption Packaging: Compile the Skill source code into bytecode / WASM, encrypt it with AES-256-GCM to generate impl.enc; extract interface information and disclosure policy to generate manifest.json; digitally sign the two files to obtain signature.sig, and package it into skill.pkg for distribution; (2) Authorization and decryption execution: The Agent verifies the skill package signature and applies for authorization from the authorization center; after passing the identity, license, and binding constraint verification, it obtains the one-time key OTK; it decrypts and executes the skill package in the sandbox secure memory, and immediately erases the key and plaintext after execution; (3) Input interception: User requests are detected by the rule engine and the lightweight intent model at two levels. Information leakage inquiries are intercepted, whitelisted issues are allowed, and intercepted requests are not entered into the LLM. (4) Execution isolation: Skill runs in an independent sandbox process, physically isolated from the LLM process, and only transmits input, status and results through IPC whitelist, shielding execution logs and intermediate information, making the call chain black box; (5) Output filtering: Perform two-layer detection of structured rules and semantic similarity on the LLM output, remove the leaked content, and retain only the legitimate business results output; (6) Policy control: Load manifest disclosure policy to control the information disclosure boundary throughout the entire process and ensure a balance between security and availability.

[0053] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

Claims

1. A Skill encryption encapsulation and three-layer anti-leakage system based on a large language model, characterized in that, This includes a release-side encryption and encapsulation module, a dynamic decryption execution module, a three-layer anti-leakage module, and an information disclosure strategy configuration module; The publishing-side encryption encapsulation module is used to encapsulate the Skill into a skill package containing a plaintext interface file, an encrypted implementation file, and an integrity signature file, thereby separating the interface from the implementation. The dynamic decryption and execution module is used to complete one-time decryption and execution in the sandbox secure memory based on identity authentication and authorization; The three-layer anti-leakage module consists of an input interception layer, an execution isolation layer, and an output filtering layer, which blocks leakage of user queries, leakage of LLM execution process, and leakage of output content; The information disclosure strategy configuration module is used by the Skill publisher to define the scope of information that is allowed to be disclosed and prohibited from being disclosed, and is executed throughout the three layers of the anti-leakage module; The input interception layer employs a two-stage cascaded classifier: The first level is a rule engine, which uses precise matching of keywords and sentence templates to directly block explicit leak queries. The second level is a lightweight intent classification model, which performs semantic recognition on ambiguous and indirect disclosure queries; blocked requests are not entered into LLM inference, and whitelisted queries are exempted from disclosure policies. The execution isolation layer is implemented through process-level physical isolation: Skills execute in an independent sandbox process, strongly isolated from the LLM inference process, and only pass input parameters, execution status, and final return values ​​through an IPC whitelist; LLM can only access plaintext interface files and cannot physically access encrypted implementation files; all output streams from the sandbox execution are intercepted and discarded, and only the final result is output externally; when multiple Skills are executed collaboratively, the call chain is black-boxed, and LLM only receives the final aggregated result; The output filter layer employs a two-level detection process: Structured rule filtering: Based on regular expressions and keyword blacklists, it quickly scans and removes structured sensitive information. Semantic similarity detection compares the output with the prohibited description domain vector to remove obscure and leaky expressions; after filtering, only legitimate business results are retained, adhering to the principle of pure business results.

2. The Skill encryption encapsulation and three-layer anti-leakage system based on a large language model according to claim 1, characterized in that, The publishing-side encryption encapsulation module includes: The plaintext API file manifest.json contains a description of the skill, an API summary, input / output parameter specifications, version metadata, publisher information, and information disclosure policy fields, but does not contain implementation details. The encryption implementation file impl.enc is generated by compiling the Skill source code into bytecode or WebAssembly format and then using AES-256-GCM symmetric encryption. The integrity signature file, signature.sig, is generated by digitally signing the hash values ​​of manifest.json and impl.enc using the publisher's private key. It is used for identity and integrity verification during loading.

3. The Skill encryption encapsulation and three-layer anti-leakage system based on a large language model according to claim 1, characterized in that, The dynamic decryption execution module performs the following process: When the intelligent agent is running, it initiates a decryption key request to the authorization center, carrying identity credentials and a unique Skill identifier; the authorization center completes identity verification, authorization validity verification, and multi-dimensional binding constraint checks; after verification, a one-time temporary decryption key is generated and distributed through a secure channel; the temporary decryption key is used to decrypt and execute the code in the sandbox-protected memory, and the temporary decryption key and plaintext bytecode are immediately erased after execution and are not persistently stored.

4. The Skill encryption encapsulation and three-layer anti-leakage system based on a large language model according to claim 1, characterized in that, The information disclosure strategy includes an allow_questions whitelist, a block_questions blacklist, and a default_policy, which work together to control the interception, isolation, and filtering behavior of the three-layer anti-leakage module.

5. A Skill encryption encapsulation and three-layer anti-leakage method based on a large language model, based on the system described in any one of claims 1-4, characterized in that, Includes the following steps: (1) Skill Encryption Packaging: Compile the Skill source code into bytecode or WebAssembly, encrypt it with AES-256-GCM to generate impl.enc; extract interface information and disclosure policy to generate manifest.json; digitally sign the two files to obtain signature.sig, and package it into skill.pkg for distribution; (2) Authorization and decryption execution: The agent verifies the skill package signature and applies for authorization from the authorization center; after passing the identity, license, and binding constraint verification, it obtains a one-time key; Decrypt and execute within the sandbox's secure memory; immediately erase the key and plaintext after execution. (3) Input interception: User requests are detected by the rule engine and the lightweight intent model at two levels. Information leakage inquiries are intercepted, whitelisted issues are allowed, and intercepted requests are not entered into the LLM. (4) Execution isolation: Skill runs in an independent sandbox process, physically isolated from the LLM process, and only transmits input, status and results through IPC whitelist, shielding execution logs and intermediate information, making the call chain black box; (5) Output filtering: Perform two-layer detection of structured rules and semantic similarity on the LLM output, remove the leaked content, and retain only the legitimate business results output; (6) Strategy control: Load manifest disclosure strategy to control the information disclosure boundary throughout the entire process.

Images