An agent security detection method based on time sequence semantic graph and behavior cooperation

Abstract

The application belongs to the field of artificial intelligence, and provides an intelligent agent security detection method based on time sequence semantic graph and behavior cooperation, comprising: firstly, for each segment of heterogeneous data of the intelligent agent, segmented capture and differentiated normalization are performed to generate full-link normalized semantic vectors and normalized intention vectors containing perception and decision intention, and a heterogeneous space-time dynamic semantic graph with a time sequence window and logical association is constructed; secondly, based on the graph, a time sequence graph neural network model containing time sequence bias coding and security risk offset is used to quantize semantic evolution, identify and output semantic drift risk samples; then, a semantic-behavior dynamic mapping matrix is trained to check the consistency of intention and behavior, intercept implicit violations, and identify risks through reverse tracing; finally, a parameter efficient fine-tuning and risk weight pruning optimization model is used to update parameters and thresholds and add risk samples for continuous optimization. The application can detect risks in full link, and can be adapted and optimized in a closed loop.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology and provides a method for intelligent agent security detection based on temporal semantic graphs and behavioral collaboration. Background Technology

[0002] With the rapid iteration of artificial intelligence technology, AI agents have been widely applied in many key fields such as industrial control, financial data analysis, and intelligent operation and maintenance. Their operation follows a full-link logic of perception-reasoning-decision-execution (PRDE), the core of which is to receive external input, autonomously reason and analyze, generate decision instructions, and execute operations to achieve specific business objectives. However, AI agents are prone to implicit semantic risks during the entire PRDE process. These risks do not manifest as syntactic violations but rather as implicit problems such as semantic drift and semantic-behavioral dissonance. Once these occur, they can lead to serious security incidents such as decision bias, data leakage, and system loss of control. Therefore, there is an urgent need for security detection across the entire PRDE chain of AI agents.

[0003] Currently, existing agent security detection technologies mostly focus on syntactic level detection at a single stage, and have not yet formed a systematic detection solution covering the entire PRDE link. Furthermore, they suffer from numerous technical shortcomings and cannot effectively solve the problem of detecting implicit semantic risks across the entire link. Specific shortcomings are as follows: First, the data types generated by the agent's PRDE (Performance-Related Execution) stages are significantly heterogeneous. The perception stage involves input data such as text and multimodal data; the reasoning stage involves data such as hidden layer states of the model and intermediate representations of the thought chain; the decision-making stage involves structured instructions such as tool / API calls; and the execution stage involves behavioral trajectory data such as SQL statements and system logs. Existing technologies lack segmented capture and differentiated normalization strategies for such heterogeneous data, making it impossible to map different types and dimensions of data to the same representation space. This results in independent detection at each stage, a lack of correlation, and an inability to form a holistic understanding of the semantic logic across the entire chain, making it difficult to detect hidden risks across stages.

[0004] Second, the reasoning and decision-making processes of intelligent agents exhibit significant temporal correlations, with semantic logic evolving dynamically over time. Semantic drift, a core latent risk, manifests as semantic logic gradually deviating from its initial intent over time; this change is subtle and slow. Existing detection technologies do not model the temporal correlations of semantic nodes, making it impossible to quantify the evolutionary patterns of semantic logic. They can only assess risk based on the static features of a single node, failing to accurately capture the dynamic changes in semantic drift, resulting in a high rate of missed detections for latent semantic risks.

[0005] Third, the decision-making intent (semantic flow) and the actual execution behavior (behavioral flow) of an intelligent agent belong to different representation spaces. Existing technologies lack an effective cross-space mapping mechanism, making it impossible to uniformly compare the intent vector and the behavioral feature vector, and making it difficult to determine whether the two are consistent. For implicit violations that are grammatically legal but deviate from the original semantic intent (i.e., semantic-behavioral dissonance), existing technologies cannot effectively identify and intercept them, and cannot trace the root cause of the risk, resulting in the inability to accurately locate and handle the risk.

[0006] In summary, existing intelligent agent security detection technologies suffer from problems such as fragmented detection, inaccurate identification of latent risks, inability to align semantics and behavior across spaces, poor model adaptability, and lack of closed-loop optimization capabilities. These technologies cannot meet the requirements for accurate identification, real-time interception, and root cause tracing of latent semantic risks across the entire PRDE (Progress, Depth, and Evidence) chain of intelligent agents. There is an urgent need for an intelligent agent end-to-end security detection solution that can solve the above-mentioned technical problems. Summary of the Invention

[0007] The technical solution of the present invention includes: Heterogeneous data from each stage of the agent's PRDE are normalized and then mapped to the same intent representation space to generate normalized semantic vectors covering the entire PRDE chain. These normalized semantic vectors are then used to construct a heterogeneous spatiotemporal dynamic semantic graph.

[0008] By using a temporal graph neural network model, high-dimensional temporal correlation features of semantic nodes in a heterogeneous spatiotemporal dynamic semantic graph are learned, the temporal evolution logic of semantic nodes is quantified, and semantic drift is judged by comparing the predicted semantic evolution direction with the actual quantization of semantic nodes, thereby outputting a compliant semantic intent vector.

[0009] By comparing and learning the attention weight matrix generated by the compliant semantic intent vector and the temporal graph neural network model, a training semantic-behavior dynamic mapping matrix is ​​generated. The semantic-behavior dynamic mapping matrix performs cross-space bidirectional mapping between the agent's decision intent space and execution behavior feature space. Based on the agent's decision nodes, an intent vector is generated to obtain the agent's expected behavior distribution. The consistency between the expected behavior distribution and the actual behavior trajectory flow is verified to intercept implicit violations of semantic-behavior dissonance. Based on the attention weight matrix, reverse causal tracing and risk type identification are performed on the violations, and the identification results and the specific location of the violations are output, thereby completing the security detection.

[0010] Furthermore, the normalization process for heterogeneous data at each stage of the agent's PRDE includes: Natural language understanding technology is used to extract predicate logic and core entity features from text prompts. A visual encoder is used to transform multimodal inputs into attribute-value pair features. A cross-modal semantic alignment function is used to map the two types of features to the same intent representation dimension, generating a perceptual intent normalized vector. Deploy model hook functions in the intelligent agent large language model inference framework, intercept the intermediate representation of the thought chain and the hidden layer state vector when the model generates inference lexical units, decompose the thought chain into inference logic nodes with causal relationships, and use the hidden layer state vector as the node feature weight to generate inference logic normalized vectors. The structured decision instructions generated by the agent are captured and transformed into a decision intent normalization vector with the same dimension as the perception intent normalization vector through an encoder and a mapping matrix. Collect behavioral trajectory data of intelligent agents from SQL statements, API return codes, and system logs. Map these data to the same intent representation dimension using a transformation matrix to generate normalized behavioral feature vectors. Introduce a semantic entropy filtering mechanism to calculate the semantic entropy increment between the current and previous moments. Retain the feature vectors of substantive state transition behaviors whose entropy increment exceeds a preset threshold.

[0011] Furthermore, the method for constructing the heterogeneous spatiotemporal dynamic semantic graph is as follows: Based on the node core attributes of the normalized semantic vectors of each stage—perception, reasoning, decision-making, and execution—timestamp and security weight attributes are configured for each node. Among them, the nodes corresponding to the perception intent normalized vector and the decision intent normalized vector are assigned security baseline weights. By establishing logical connections between nodes through causal edges, temporal edges, and referential edges, the causal inference relationship, temporal sequence relationship, and the referential relationship between decision nodes and perception nodes are respectively represented to form a heterogeneous spatiotemporal dynamic semantic graph. Furthermore, a time-series window is set up to record the lifecycle of each node in the heterogeneous spatiotemporal dynamic semantic graph, automatically shielding expired semantic nodes from erroneous interference with the current semantic analysis, so that the heterogeneous spatiotemporal dynamic semantic graph can be updated and evolved in real time.

[0012] Furthermore, the quantitative comparison includes: By using the sinusoidal temporal coding function, the time offset between nodes corresponding to the normalized semantic vectors in the heterogeneous spatiotemporal dynamic semantic graph is mapped to a high-dimensional continuous vector space, enabling the temporal graph neural network model to perceive the impact of the time dimension on the semantic logic consistency and weakening the feature contribution of expired semantic nodes. For the current target node of the temporal graph neural network model, a query vector Q is generated. For the neighboring nodes of the target node, the historical features of their normalized semantic vectors are concatenated with the temporal bias encoding vector to generate a key vector K and a value vector V with temporal bias. A security risk offset is introduced to add attention weights to the nodes corresponding to the normalized vectors of perception intent and decision intent, as well as sensitive operation nodes of code execution and privilege requests, thereby strengthening the feature learning of baseline and risk nodes. The features of K independent attention heads are computed in parallel. The attention weights calculated by QK similarity are summed for the value vectors of the neighboring nodes of each attention head to generate intermediate feature vectors for each head. All intermediate feature vectors are concatenated and projected through a linear layer. The normalized semantic vector features of the node itself are then fused with the self-evolving weight matrix to output the real-time semantic representation of the node, realizing the fusion of semantic association features across stages and links. Based on the temporal evolution law of normalized semantic vectors learned by the temporal graph neural network model, and using the normalized vectors of perception intent and decision intent as benchmarks, the compliant semantic vectors at the next moment are predicted; the Euclidean distance between the semantic vectors actually generated by the agent and the compliant semantic vectors is calculated, and when the Euclidean distance exceeds a preset threshold, it is determined that the agent has undergone semantic drift, thereby realizing the quantification and dynamic recognition of semantic drift.

[0013] Furthermore, the reverse causal tracing and risk type identification include: By contrastive learning, a semantic-behavior dynamic mapping matrix is ​​trained from a high-dimensional intent space to a behavioral feature space. This semantic-behavior dynamic mapping matrix has the ability to map the intent space and the behavioral feature space in both directions, and can realize cross-space transformation and dimensional unification of the decision intent normalization vector and the behavioral feature normalization vector. The normalized vector of decision intent and the normalized vector of behavioral features are combined using the matrix corresponding to the normalized vector of decision intent. The matrix corresponding to the normalized vector of behavioral features Projecting them onto the same shared feature space, the cosine similarity algorithm is used to calculate the end-to-end consistency alignment score between the two. The calculation formula is: in For the normalized vector of decision intent, This is a normalized vector of behavioral features. When the consistency alignment score is lower than a preset threshold, the agent is determined to have semantic-behavioral disharmony. Even if a single action instruction is syntactically legal, the implicit security overreach behavior that deviates from the semantic intent of the normalized vector representation of the decision intention will still be intercepted in advance, so as to achieve precise control over the implicit risks at the execution layer.

[0014] Furthermore, the reverse causal attribution of the aforementioned risk includes: Taking the abnormal behavior nodes corresponding to the normalized vector of behavioral features in the execution phase as the starting point for tracing the source, the multi-head attention weight matrix of the abnormal behavior nodes generated by the time sequence graph neural network model is extracted, the parent node path with the highest attention score is found, and the entire logical propagation link of the risk from generation to execution is restored along this path, and a risk tracing map is automatically generated. Risk types are distinguished based on the type of normalized vector corresponding to the starting node of the tracing link. If the starting node is an inducing input node corresponding to the normalized vector of perception intent, it is determined to be a violation caused by external attack. If the starting node is an autonomous logic deviation node corresponding to the normalized vector of reasoning logic, and there are no abnormalities in the normalized vectors of perception intent and decision intent, it is determined to be a violation caused by model illusion.

[0015] Furthermore, the output of the compliance semantic intent vector also outputs semantic drift risk samples, and the output of the identification results also outputs semantic-behavioral dissonance risk samples. Based on semantic drift risk samples and semantic-behavioral misalignment risk samples, a parameter-efficient fine-tuning method is adopted to perform low-cost adaptive adaptation of the detection model in the agent across scenarios. The computational cost of the model is optimized through a risk weight-driven parameter pruning method, and the optimized model parameters are fed back to the detection threshold to update the normalized vector generation rules, the modeling benchmark of the temporal graph neural network model, and the semantic-behavioral alignment verification threshold. At the same time, semantic drift risk samples and semantic-behavioral misalignment risk samples are added to the training set to continuously optimize the model, thus dynamically self-optimizing the entire detection method.

[0016] Furthermore, the efficient parameter fine-tuning method for low-cost adaptive adaptation of the detection model across scenarios includes: A lightweight adapter layer is nested between each layer of the temporal graph neural network model. This lightweight adapter layer is a learnable module with a low number of parameters, keeping the main parameters of the temporal graph neural network model fixed and avoiding overall model retraining. When the detection method is migrated to a new application domain, the KL divergence of the node distribution of normalized semantic vectors in the heterogeneous spatiotemporal dynamic semantic graphs of the new and historical domains is calculated, and the degree of scene offset is quantified by the KL divergence value. The parameters of the lightweight adaptation layer are updated only based on the degree of scene offset, and the semantic drift judgment threshold and semantic-behavior alignment verification threshold based on the risk characteristics of the new domain are automatically adjusted.

[0017] Furthermore, the risk weight-driven parameter pruning method includes: The contribution of each node and edge pair corresponding to the normalized semantic vector in the heterogeneous spatiotemporal dynamic semantic graph to the security judgment score is evaluated in real time. The pruning threshold is set based on the contribution and the security benchmark weight of the normalized vector node of perception and decision intention. Non-critical associated edges with a contribution value lower than the pruning threshold and their corresponding temporal graph neural network model weight matrices are removed. During the removal process, all parameters of the nodes corresponding to the normalized intent vector, risk-sensitive nodes, and core logic edges are retained to ensure that the detection method is not affected in terms of the accuracy of identifying latent risks such as semantic drift and semantic-behavioral dissonance.

[0018] Furthermore, the dynamic self-optimization includes: The update parameters of the lightweight adaptation layer, the optimization parameters after model pruning, and the adjustment threshold for new domains are fed back to the heterogeneous data normalization mapping rules, the attention weight configuration of the temporal graph neural network model, and the semantic-behavior alignment verification threshold, respectively, to dynamically update the core configurations of each detection process. Simultaneously, the normalized semantic vector and normalized intent vector corresponding to the risk samples are added to the training set to continuously optimize the feature learning ability of the semantic-behavior dynamic mapping matrix and the temporal graph neural network model, thereby improving the detection method's ability to identify new hidden risks.

[0019] The technical solution provided by this invention has the following advantages compared with the prior art: 1. The heterogeneous data of each stage of the agent are normalized and mapped to the same intent representation space. A heterogeneous spatiotemporal dynamic semantic graph is constructed based on this. This breaks through the barriers of fragmented detection links and limited monitoring scope within the model or a single link in the existing technology. It realizes the integration and association of semantic information of the entire PRDE link of the agent, effectively captures the semantic association features across stages, and solves the problem of missing semantic information across stages in the existing technology.

[0020] 2. By using a temporal graph neural network model to learn high-dimensional temporal correlation features of semantic nodes, the temporal evolution logic of semantic nodes is quantified, and semantic drift is judged by comparing the prediction with the actual semantic nodes. This makes up for the lack of existing technology in characterizing the temporal correlation of the semantic flow of intelligent agents. It can accurately identify the semantic drift phenomenon that gradually occurs in long chain reasoning in dynamic task scenarios, and solve the problem of low recognition rate of implicit risks in dynamic task scenarios in existing technology.

[0021] 3. Finally, by combining the compliant semantic intent vector and the attention weight matrix, a semantic-behavior dynamic mapping matrix is ​​trained to achieve cross-space bidirectional mapping and consistency verification between decision intent and execution behavior. It can also rely on the attention weight matrix to complete the reverse causal tracing of violations and risk type identification. This solves the shortcomings of existing technologies, such as the lack of a bidirectional collaborative mapping mechanism between semantic flow and behavior flow, the inability to use high-dimensional semantic information to constrain underlying behavior actions, and the inability to reverse trace the reasoning layer after the behavior results deviate. It not only achieves accurate pre-interception of implicit violations of semantic-behavior disharmony, but also completes the root cause localization of risks, fundamentally solving the problem of inaccurate identification of implicit risks in existing technologies, and ultimately achieving accurate security detection of the entire PRDE link of the intelligent agent.

[0022] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating the overall process architecture of the present invention.

[0025] Figure 2 This is a flowchart of the PRDE full-link semantic element extraction process.

[0026] Figure 3 A schematic diagram illustrating the modeling and detection principles of dynamic temporal semantic graphs.

[0027] Figure 4 This is a logical diagram for the collaborative alignment of semantic flow and behavioral flow, as well as for reverse causal tracing. Detailed Implementation

[0028] The following detailed description of a specific embodiment of the present invention is provided in conjunction with the accompanying drawings. However, it should be understood that the scope of protection of the present invention is not limited to the specific embodiment.

[0029] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the technical solution of this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0030] In the description of the embodiments of the present invention, unless otherwise stated, "a plurality of" means two or more.

[0031] like Figures 1 to 4 As shown, this invention provides an agent security detection method based on temporal semantic graphs and behavioral collaboration, comprising: To address the heterogeneous data characteristics at different stages of an agent, a segmented capture and differentiated normalization approach is adopted to map the heterogeneous data to the same intent representation space, generating normalized semantic vectors covering the entire agent's lifecycle. Normalized intent vectors are then extracted from these normalized semantic vectors. Simultaneously, a heterogeneous spatiotemporal dynamic semantic graph with temporal windows and logical connections is constructed using these normalized semantic vectors. The normalized intent vectors include normalized vectors for perceptual intent and normalized vectors for decision intent. The heterogeneous data includes text, multimodal perception, model hidden layers, and behavioral trajectory data.

[0032] Based on heterogeneous spatiotemporal dynamic semantic graphs, a temporal graph neural network model with temporal bias coding and security risk offset is introduced to learn high-dimensional temporal correlation features of semantic nodes, quantify the temporal evolution logic of semantic nodes, and output compliance semantic intent vectors and semantic drift risk samples by comparing the predicted semantic evolution direction with the actual quantification of semantic nodes.

[0033] Based on the compliance semantic intent vector and the attention weight matrix generated by the temporal graph neural network model, the semantic-behavior dynamic mapping matrix is ​​trained through comparative learning to perform cross-space bidirectional mapping between the decision intent space and the execution behavior feature space. The consistency of the normalized intent vector and behavior feature vector is verified to intercept implicit violations of semantic-behavior dissonance. Based on the attention weight matrix, the risk is traced back to the reverse causal source and the risk type is identified, and the identification results and semantic-behavior dissonance risk samples are output.

[0034] Based on the detection results and risk samples from the above steps, a parameter-efficient fine-tuning method is used to perform low-cost adaptive adaptation of the detection model across scenarios. The computational cost of the model is optimized through a risk weight-driven parameter pruning method, and the optimized model parameters and detection thresholds are fed back to the above steps to update the normalized vector generation rules, the modeling benchmark of the temporal graph neural network model, and the semantic-behavior alignment verification threshold. At the same time, risk samples are added to the training set to continuously optimize the model, thus dynamically self-optimizing the entire detection method.

[0035] Repeat the above steps to complete continuous dynamic security detection across the entire intelligent agent chain.

[0036] Furthermore, the segmented capture and differential normalization includes: Natural language understanding technology is used to extract predicate logic and core entity features from text prompts. A visual encoder is used to transform multimodal inputs into attribute-value pair features. The two types of features are mapped to the same intent representation dimension through a cross-modal semantic alignment function to generate a perceptual intent normalized vector. The perceptual intent normalized vector is a common component of the normalized intent vector and the normalized semantic vector.

[0037] In the intelligent agent large language model inference framework, a model hook function is deployed to intercept the intermediate representation of the thought chain and the hidden layer state vector when the model generates inference lexical units. The thought chain is decomposed into inference logic nodes with causal relationships. The hidden layer state vector is used as the node feature weight to generate the inference logic normalized vector. The inference logic normalized vector is a component of the normalized semantic vector.

[0038] The structured decision instructions generated by the agent are captured and transformed into a decision intent normalized vector with the same dimension as the perception intent normalized vector through an encoder and a mapping matrix. The decision intent normalized vector is a common component of the normalized intent vector and the normalized semantic vector.

[0039] Collect behavioral trajectory data of intelligent agents from SQL statements, API return codes, and system logs, and map them to the same intent representation dimension through a transformation matrix to generate a behavior feature normalization vector. This feature normalization vector is a component of the normalized semantic vector. A semantic entropy filtering mechanism is introduced to calculate the semantic entropy increment between the current and previous time moments, and retain the feature vectors of substantial state transition behaviors whose entropy increment exceeds a preset threshold.

[0040] Furthermore, the method for constructing the heterogeneous spatiotemporal dynamic semantic graph is as follows: Using the normalized semantic vectors of each stage of PRDE as the core attributes of the nodes, timestamps and security weight attributes are configured for each node. Among them, the nodes corresponding to the normalized vectors of perception intent and decision intent are given higher security baseline weights.

[0041] By establishing logical connections between nodes through causal edges, temporal edges, and referential edges, the causal inference relationship, temporal sequence relationship, and referential relationship between decision nodes and perception nodes are respectively represented to form a heterogeneous spatiotemporal dynamic semantic graph.

[0042] Then, a time-series window is set to record the lifecycle of each node, automatically shielding expired semantic nodes from erroneous interference with the current semantic analysis, so that the heterogeneous spatiotemporal dynamic semantic graph can be updated and evolved in real time.

[0043] Furthermore, the quantitative comparison includes: A sinusoidal temporal coding function is used to map the time offset between nodes corresponding to normalized semantic vectors in a heterogeneous spatiotemporal dynamic semantic graph to a high-dimensional continuous vector space. This enables the temporal graph neural network model to perceive the impact of the time dimension on the consistency of semantic logic and weakens the feature contribution of expired semantic nodes.

[0044] A query vector Q is generated for the current target node of the temporal graph neural network model. For the neighboring nodes of the target node, the historical features of their normalized semantic vectors are concatenated with the temporal bias encoding vector to generate a key vector K and a value vector V with temporal bias. A security risk offset is introduced to increase the attention weights of nodes corresponding to the normalized vectors of perception intent and decision intent, as well as sensitive operation nodes of code execution and privilege requests, thereby strengthening the feature learning of baseline and risk nodes.

[0045] The features of K independent attention heads are computed in parallel. The attention weights calculated by QK similarity are summed for the neighboring node value vectors of each attention head to generate intermediate feature vectors for each head. All intermediate feature vectors are concatenated and projected through a linear layer. The normalized semantic vector features of the node itself are then fused with the self-evolving weight matrix to output the real-time semantic representation of the node, realizing the fusion of semantic association features across stages and links.

[0046] Based on the temporal evolution law of normalized semantic vectors learned by the temporal graph neural network model, and using the normalized vectors of perception intent and decision intent as benchmarks, the compliant semantic vectors at the next moment are predicted; the Euclidean distance between the semantic vectors actually generated by the agent and the compliant semantic vectors is calculated, and when the Euclidean distance exceeds a preset threshold, it is determined that the agent has undergone semantic drift, thereby realizing the quantification and dynamic recognition of semantic drift.

[0047] Furthermore, the reverse causal tracing and risk type identification include: By contrastive learning, a semantic-behavior dynamic mapping matrix is ​​trained from a high-dimensional intent space to a behavioral feature space. This semantic-behavior dynamic mapping matrix has the ability to map the intent space and the behavioral feature space in both directions, and can realize cross-space transformation and dimensional unification of decision intent normalization vector and behavioral feature normalization vector.

[0048] The normalized vector of decision intent and the normalized vector of behavioral features are combined using the matrix corresponding to the normalized vector of decision intent. The matrix corresponding to the normalized vector of behavioral features Projecting them onto the same shared feature space, the cosine similarity algorithm is used to calculate the end-to-end consistency alignment score between the two. The calculation formula is: in For the normalized vector of decision intent, This is a normalized vector of behavioral features.

[0049] When the consistency alignment score is lower than a preset threshold, the agent is determined to have semantic-behavioral disharmony. Even if a single action instruction is syntactically legal, the implicit security overreach behavior that deviates from the semantic intent of the normalized vector representation of the decision intention will still be intercepted in advance, so as to achieve precise control over the implicit risks at the execution layer.

[0050] Furthermore, the reverse causal attribution of the aforementioned risk includes: Taking the abnormal behavior nodes corresponding to the normalized vector of behavioral features in the execution phase as the starting point for tracing the source, the multi-head attention weight matrix of the abnormal behavior nodes generated by the time sequence graph neural network model is extracted, the parent node path with the highest attention score is found, and the entire logical propagation link of the risk from generation to execution is restored along this path, and a risk tracing map is automatically generated.

[0051] Risk types are distinguished based on the type of normalized vector corresponding to the starting node of the tracing link. If the starting node is an inducing input node corresponding to the normalized vector of perception intent, it is determined to be a violation caused by external attack. If the starting node is an autonomous logic deviation node corresponding to the normalized vector of reasoning logic, and there are no abnormalities in the normalized vectors of perception intent and decision intent, it is determined to be a violation caused by model illusion.

[0052] Furthermore, the efficient parameter fine-tuning method for low-cost adaptive adaptation of the detection model across scenarios includes: A lightweight adapter layer is nested between each layer of the temporal graph neural network model. This lightweight adapter layer is a learnable module with a low number of parameters, keeping the main parameters of the temporal graph neural network model fixed and avoiding overall model retraining.

[0053] When the detection method is migrated to a new application domain, the KL divergence of the node distribution of the normalized semantic vector in the heterogeneous spatiotemporal dynamic semantic graph of the new domain and the historical domain is calculated, and the degree of scene offset is quantified by the KL divergence value.

[0054] The parameters of the lightweight adaptation layer are updated only based on the degree of scene offset, and the semantic drift judgment threshold and semantic-behavior alignment verification threshold based on the risk characteristics of the new domain are automatically adjusted.

[0055] Furthermore, the risk weight-driven parameter pruning method includes: The contribution of each node and edge pair corresponding to the normalized semantic vector in the heterogeneous spatiotemporal dynamic semantic graph to the security judgment score is evaluated in real time. The pruning threshold is set based on the contribution and the security benchmark weight of the normalized vector node of perception and decision intention.

[0056] Non-critical associated edges with a contribution value lower than the pruning threshold and their corresponding temporal graph neural network model weight matrices are removed. During the removal process, all parameters of the nodes corresponding to the normalized intent vector, risk-sensitive nodes, and core logic edges are retained to ensure that the detection method is not affected in terms of the accuracy of identifying latent risks such as semantic drift and semantic-behavioral dissonance.

[0057] Furthermore, the dynamic self-optimization includes: The update parameters of the lightweight adaptation layer, the optimization parameters after model pruning, and the adjustment threshold for new domains are fed back to the heterogeneous data normalization mapping rules, the attention weight configuration of the temporal graph neural network model, and the semantic-behavior alignment verification threshold, respectively, to dynamically update the core configurations of each detection process.

[0058] Simultaneously, the normalized semantic vector and normalized intent vector corresponding to the risk samples are added to the training set to continuously optimize the feature learning ability of the semantic-behavior dynamic mapping matrix and the temporal graph neural network model, thereby improving the detection method's ability to identify new hidden risks.

[0059] Specifically: Traditional tracking technologies often focus on low-level system calls or simple syntax validation, failing to capture the internal logic of an intelligent entity (such as thought chains). This invention employs a four-stage PRDE (Perception, Reasoning, Decision-Making, and Execution) approach, specifically:

[0060] (0) Perception stage: The system captures all raw environmental variables entering the system by monitoring the sensory input gateway of the intelligent agent in real time and by using a cross-modal semantic parsing layer.

[0061] Text semantic extraction: The system utilizes Natural Language Understanding (NLU) techniques (such as predicate logic extraction algorithms) to extract the semantic meaning of the original prompt text to identify the core action and target object of the instruction. For example, if the instruction is "Analyze the asset risk of Company A", the system will identify the core entity as "Company A" and its financial background, the action predicate as "risk assessment", and generate an initial intent vector accordingly. .

[0062] Multimodal semantic extraction: For non-textual multimodal inputs (such as real-time status information acquired by sensors and image information captured by cameras), the system uses a visual encoder to convert them into "attribute-value pairs".

[0063] Multi-semantic fusion: Defining perceptual semantics ,in This represents the normalized semantic vector ultimately generated during the perception stage; It is a text encoder that processes natural language input, operating on the raw prompts or instructions entered by the user. (Corresponding to text semantic extraction, it acts as a text encoder, processing the user's original prompts or instructions P); while It is a visual feature encoder, responsible for processing environmental images or multimodal input data. Feature capture is performed (corresponding to multimodal semantic extraction, which acts as a visual feature encoder and is responsible for capturing features from environmental images or multimodal input data V). It is a cross-modal semantic alignment function used to map the text semantic space and the visual semantic space to a unified representation dimension, ensuring that the agent's perceptual input to the outside world is accurately digitized.

[0064] (1) Reasoning stage: This invention addresses the problem of the "black box" being invisible during the agent's inference phase by deploying model hooks (Hook functions) in the agent's LLM inference framework to achieve monitoring.

[0065] The system first performs logicalization of nodes. For agents based on the CoT (CoT) or ReAct architecture, the system intercepts the internally generated logical reasoning text or intermediate code representation (IR) in real time. The system decomposes long-chain logic into a series of reasoning steps with causal relationships. Each reasoning step is defined as a logical reasoning node. Each node records the logical dependencies between nodes (such as conditional judgments and causal inferences), referenced background knowledge fragments, and intermediate conclusions output.

[0066] When generating each inference token (related to the long chain, because for agents based on the CoT or ReAct architecture, the system breaks down the long chain logic into multiple inference steps with causal relationships, and hooks are used to intercept the generation of each inference token in order to monitor in real time whether semantic deviations have occurred during the evolution of this long chain), the system uses model hooks to capture and extract the hidden layer state vectors when the large language model LLM generates inference text. (Specifically, it refers to the state embedding vector of the hidden layer inside the large model when generating each reasoning token. These vectors reflect the current deep semantic features of the model at that reasoning step.) This vector serves as the feature weight of the node and is used to monitor whether logical deviations in the semantic space occur during the model's reasoning process due to minor inducements such as cue word injection. (The system uses a temporal graph neural network model to predict the normal semantic direction of the next moment based on historical logical nodes. Then, it calculates the Euclidean distance Ddrift between the actual vector captured by the Hook and the predicted direction. If the distance exceeds a preset threshold (e.g., Ddrift > 0.9, it is determined that semantic drift has occurred, indicating that the Agent's thinking logic has deviated from the original safe semantics due to inducement or illusion.)

[0067] (3) Decision stage: The decision-making layer transforms abstract reasoning logic into key nodes of concrete API calls or system operation instructions. This layer captures and parses the tool call sequences or API call lists and parameter dictionaries generated by the agent.

[0068] The system uses an encoder to transform these structured decision instructions into action vectors in the intent space through a mapping matrix. For example, in a data analysis scenario, if the decision is a "export data" instruction, the system will evaluate the distance between this instruction and the center of the preset semantic "compliant scope of exported data" (here, the preset semantic includes two dimensions, which can be understood as a combination of dynamic and static meanings).

[0069] Dynamic model prediction: The time-series graph neural network model in the system predicts the security intent that the agent should generate next based on previous reasoning logic. For example, if the previous discussion focused on analyzing reports, the model will predict that the next intent should fall within the scope of operations such as data querying.

[0070] Pre-defined static baseline: The "compliance range of exported data" mentioned here refers to the pre-defined security value range by developers in different domains. When an agent generates a decision instruction, the system converts this instruction into coordinates and checks how far it is from the center of this security zone (compliance vector space). If the distance is too far, it indicates that it may be attempting to bypass risk control to perform some illegal operations, thus identifying whether there is an intention to bypass risk control.

[0071] (4) Execution phase: The system's real-time monitoring tool displays behavioral trajectory information after being invoked, including the original status code returned by the API, the SQL statements executed by the database, or response logs.

[0072] The execution phase includes: 1) Content extraction: The system captures information left by the Agent's actions in real time, including the status code returned after calling the API (success or error), the SQL statement sent to the database, and detailed system logs, etc. 2) Normalization: Since the Agent's original intent (intent vector) and the specific operation (SQL statement or code) are two completely different pieces of information and cannot be directly compared, the system uses a transformation matrix ψ to translate complex SQL statements, API calls, and other behavioral features into mathematical vectors of the same dimension as the intent. In this way, the original intent and the specific operation become points in a coordinate system, and the distance between them (cosine similarity) can be directly calculated.

[0073] To address the massive logs generated by end-to-end monitoring, this invention designs a semantic entropy-based filtering mechanism (this belongs to the execution phase logic, as the execution phase generates the largest amount of data; once the Agent starts running, it produces massive amounts of logs, and recording all of them would cause the system to freeze. The system calculates the information content difference between the current state and the state of the previous second (semantic entropy increment). If it finds that the Agent is only repeating some meaningless actions (small entropy increase), it is discarded, and only when the Agent performs a substantial action (entropy increase exceeds the threshold) is the data recorded, which can greatly improve monitoring efficiency). The system calculates the current extraction state. With historical status entropy difference (The historical state here does not refer to your chat history with the AI, but rather to the trajectory of task evolution. That is, during the execution phase, the Agent's state is not a static line of code, but rather the probability distribution p(Si) of its internal semantic features in the vector space. At each observation time t, the system extracts the current semantic feature representation. Therefore, this distribution changes as the task is executed. Each new state that is determined immediately becomes the historical state of the next observation point. In other words, although the dialogue may be new, as long as the task starts executing, the state after the first step becomes the historical state of the second step (t-1). When the system observes the Agent at time t, it compares it with the data at time t-1.)

[0074] The system then uses entropy from information theory to quantify the uncertainty or information content of the agent's current state. By comparing the entropy difference ΔH(S) between the current time t and the previous time t-1, the system will exhibit the following three scenarios:

[0075] Normal progress (normal): ΔH(S) exceeds the preset threshold (usually 0.15), indicating a substantial state transition has occurred, and the system triggers feature writing.

[0076] No change (redundancy): ΔH(S) is extremely small, indicating that the Agent is waiting or repeating actions, and the system only records the increment to save computing power.

[0077] Abnormal mutations (risk): Unpredictable fluctuations in entropy values ​​may indicate that the agent has been attacked or is experiencing hallucinations. in Representative moment The probability distribution of the next semantic state, expressed as follows: Representative moment The Shannon entropy reflects the information content or uncertainty of the current semantic state, while Then it corresponds to the previous moment. The system's inherent semantic entropy. This formula is used to calculate the change in the system's semantic entropy. ,when Exceeding the threshold When the value is set to 0.15, it is determined that the agent has undergone a substantial semantic state transition, that is, it has taken a new action. Only then is the feature writing update of the entire link node triggered. Otherwise, only the increment is recorded to ensure the real-time performance of the monitoring system.

[0078] After acquiring the full-link data of PRDE, this module constructs a dynamic semantic graph and uses a refined temporal graph neural network model algorithm to determine whether the agent has experienced "semantic drift," that is, the problem that the agent's logical thinking gradually deviates from the safety goal.

[0079] (1) Dynamic semantic graph Definition: The system constructs a heterogeneous spatiotemporal graph ,in: Node set : Representing semantic nodes, including perceptual intent nodes, reasoning logic nodes, decision instruction nodes, and behavior execution result nodes, the node attributes contain their semantic embedding vectors. timestamp Safety weight .

[0080] edge set : Representing logical edges, including causal edges (logical associations), temporal edges (transitional associations), and referential edges (referential associations of decision-making to perception).

[0081] Timing window Timing window The lifecycle of each state is recorded to capture erroneous interference from outdated semantics on the current decision.

[0082] (2) Temporal graph neural network model algorithm based on multi-head attention mechanism: The relationship between this part and the constructed heterogeneous spatiotemporal graph is as follows: The heterogeneous spatiotemporal graph is a static data structure that describes all fragmented information from the four stages of an agent's perception, reasoning, decision-making, and execution, according to chronological order and causal logic, into a complex heterogeneous spatiotemporal graph. This complex graph tells us who had what ideas, when, and what behaviors were resulting from them. The temporal graph neural network model algorithm runs and analyzes on this graph, learning the patterns of agent thinking by continuously learning the relationships between these nodes and edges.

[0083] Therefore, the graph forms the space for analysis, and the temporal graph neural network model allows for dynamic analysis. The temporal graph neural network model can predict the nodes that may appear in the graph in the future. If the actual nodes deviate too much from the predictions, the algorithm will issue an alarm saying that semantic drift has occurred.

[0084] To capture complex cross-stage semantic relationships, this invention introduces a multi-head attention mechanism in the aggregation function AGG of the temporal graph neural network model.

[0085] Timing bias coding To enable the model to perceive the impact of time on semantic and logical consistency (e.g., in long-chain dialogues, initial instructions may be overwritten by subsequently generated irrelevant content), the system introduces a sinusoidal temporal coding function to map time offsets to a high-dimensional continuous vector space. ; In the timing coding formula Indicates time offset In the encoding vector The specific values ​​in the dimension; where This refers to the time interval or time offset between different semantic nodes. For dimension indexing starting from 0, and This defines the total dimension of the entire temporal coding vector.

[0086] Multi-head attention aggregation function AGG: for the current node In the previous moment The hidden layer state or semantic features are represented as Parallel computing of the system Each head has its own attention. In the first step, feature transformation is performed to generate the query vector. It represents the current target node. The information you want to query; among which Then it means in the first Learnable query weight matrix used for linear mapping in each attention head.

[0087] For the target node neighboring nodes ,in Represents a node The neighborhood set is used to compute the key vector containing the temporal bias. Sum value vector The key vector Used to match similarity with the query vector, it is determined by neighboring nodes. Historical characteristics With time-series coding vector Through splicing operation After combination, with the first Learnable key weight matrix of size Multiplication generates; value vector It carries the semantic content actually transmitted by neighboring nodes, among which It involves splicing together the historical characteristics and time-coded information of neighbors, and Then it is the first The learnable weight matrix used to map feature content in each attention head.

[0088] In essence, the temporal graph neural network model algorithm performs three steps of thinking in one iteration: The first step is temporal bias encoding: this is used to timestamp each piece of information. Because AI is prone to forgetting or being interfered with by old instructions, this encoding helps the model know which information has just happened and which is from a long time ago, thus paying more attention to the logical consistency of the present.

[0089] The second step is to query the vector Q: the query sent by the current node, such as the decision node, to its neighboring nodes. It represents the information the current node wants to know; for example, the decision node might ask the perception node: what exactly was the original instruction it just received?

[0090] The third step is key-value pairs (K / V): neighboring nodes, such as sensing nodes, prepare answers based on their own historical features and timestamps. Here, K (key) is similar to a timestamped index label used to match the question Q, while V (value) is the actual semantic content.

[0091] Finally, the algorithm calculates the matching degree (similarity) between Q and K, assigns different attention weights to different neighbors, and then aggregates these weighted V values ​​to obtain the latest representation of the current node that incorporates temporal logic. This achieves cross-stage semantic association capture.

[0092] Then, a security risk offset is introduced. This is used to adjust weight preferences based on node security attributes. For example, nodes involving sensitive operations such as code execution and privilege requests are given higher attention weights. The formula for calculating attention weights is as follows: The formula calculates the first... Neighbor For the current node Influence score ;in For query vector, For key vectors, Based on dimensions The scaling factor is finally determined by... The normalization function ensures that the sum of the weights of all neighbors is 1.

[0093] Each attention head Feature aggregation formula: ,in It is the first An intermediate feature vector is generated by an attention head; this vector is obtained by analyzing the neighborhood set. The value vector of all neighboring nodes According to its corresponding attention weight The result is obtained by weighted summation.

[0094] Suppose we want to analyze an agent's behavior, and we consult K experts (attention heads). For example, expert A specializes in temporal logic. Expert A will observe all neighboring nodes (such as previous perception, reasoning, and decision-making information), assigning high scores (scores based on weight α) to important information and low scores to less important information. The result of the formula, headk, is the conclusion about temporal logic given by expert A after integrating all neighboring information. Therefore, this formula, within a specific feature subspace, compresses the useful information of neighboring nodes into an intermediate feature vector through weighted summation, thereby capturing the key semantic relationships within that dimension.

[0095] Finally, cross-stage feature aggregation is performed, and the aggregation results from each head are concatenated and projected through a linear layer to output the semantic embedding of the current node state of the time-series neural network model. : ; In the formula, For a moment The final semantic representation of the next node, It is a non-linear activation function; It is a self-evolving weight matrix that maintains the logical coherence of the nodes themselves. All The aggregation results of each attention head are concatenated, and finally the projection matrix is ​​output. Map high-dimensional features back to the target representation dimension.

[0096] The aggregated results here refer to the K partial conclusions written by the K experts mentioned above. First, these K partial conclusions are concatenated into a complete conclusion. Then, a projection matrix is ​​used for mapping, which involves quickly reviewing this complete conclusion, removing duplicate information, extracting the core logic, and finally summarizing it into a concise text.

[0097] Finally, the self-evolving weight matrix that maintains the logical coherence of the node also needs to be compared with what the Agent was thinking a second ago to ensure that the thinking is correct and there is no sudden interruption.

[0098] Therefore, the formula result is the most accurate coordinate of the Agent's mental state at that moment.

[0099] (3) Detection of temporal semantics: The temporal graph neural network model continuously predicts the semantic evolution direction at the next moment based on historical states. By calculating the actual generated semantic node vector Euclidean distance from the predicted direction If the Euclidean distance exceeds the threshold, such as If so, it is determined that the agent has experienced "semantic drift," meaning that the agent's logical thinking has gradually deviated from the safety objective.

[0100] In complex task scenarios, agents often exhibit inconsistencies between their semantic flow and behavioral flow. Therefore, this step is responsible for verifying the alignment of the agent's semantic flow and behavioral flow (alignment refers to both instructions and actions, not just superficial comparisons. The semantic flow corresponds to the intent vector generated during the decision-making phase, which is simply what the agent wants to do, such as "I want to query the average salary of Company A." The behavioral flow, in simple terms, is what the agent actually does, corresponding to the actual behavioral trajectory captured during the execution phase, such as the actual SQL statement it sends to the database. Since some agents' API instructions may appear compliant, but their underlying parameters or executed code (behavior) may be unauthorized, we need to align the semantic flow and behavioral flow. This is achieved by using a transformation matrix to project these two different dimensions into the same shared space, much like translating Chinese and English instruction manuals into mathematical coordinates and calculating cosine similarity to determine the distance between two points).

[0101] (1) Semantic-behavior dynamic mapping matrix Construction: The system uses contrastive learning to train a transformation matrix from a high-dimensional intent space to an actual behavior feature space. When the agent's decision node generates the intent vector At that time, the system utilizes a matrix Calculate the expected behavior distribution of the agent in the behavior space. ,in As a bias term, the system simultaneously collects real behavioral trajectory streams. (e.g., characteristics of executed SQL commands, frequency of API calls), and use cosine similarity to project the two onto the same dimension to calculate the alignment consistency score. :

[0102] in and These are the decision intentions and actual behavioral characteristics flow The transformation matrix for converting to the shared space. Transpose of the actual behavior feature vector Correlation is calculated using the dot product and the norm is utilized. Normalization is performed to calculate cosine similarity, which defines the end-to-end consistency alignment score. A higher numerical value indicates a greater degree of consistency between the semantic flow and the behavioral flow. The system determines that a semantic and behavioral mismatch has occurred. Even if a single behavioral instruction is syntactically legal, it may contain implicit security overreach behavior because it deviates from the original semantic intent.

[0103] Taking the verification of a "data analysis agent" scenario as an example, when handling data compliance, the alignment logic of the data analysis agent manifests as a verification of whether the agent's true semantic intent aligns with its data access behavior. For instance, the agent derives the logic "need to obtain user consumption trends" during the inference phase, and therefore generates the SQL intent "SELECT avg(spend) FROM table" during the decision-making phase. However, during the execution phase, it is detected that the underlying SQL actually sent contains "SELECT avg(spend) FROM table," indicating that the agent is attempting to extract sensitive information. At this point, the system uses a mapping matrix... It was discovered that the execution end's access to sensitive information and the decision-making end's intent to acquire it were inconsistent in the semantic space. If the SQL statement is sent to the database, the system will intercept it.

[0104] (2) Reverse causal attribution based on attention weights: when After a security alert is triggered, the system utilizes the weight matrix of multi-head attention in the time-series graph neural network model. Perform reverse causal tracing, which means starting from the node where the abnormal behavior is executed, finding the parent node path with the highest attention score, reconstructing the logical link in reverse, and then the system automatically generates a tracing graph based on this link.

[0105] Source tracing can help the system analyze external attacks, such as finding that the source is a strange prompt (injection of prompt words). Source tracing can also help the system analyze model illusions, such as finding that the source instruction is normal, but the agent makes a mistake halfway through inference.

[0106] For example: prompting words hidden within normal instructions during the perception stage. Disrupted logical thinking during the reasoning stage Incorrect execution decisions This approach to detecting the execution of abnormal SQL commands can distinguish whether the violation is due to a model illusion or an external attack.

[0107] To ensure the system's reliability in complex and ever-changing environments, this invention introduces a lightweight and adaptive mechanism, including: (1) Lightweight and adaptive mechanisms: The operating environment of intelligent agents is highly dynamic; therefore, this invention designs a lightweight adapter layer that continuously accumulates safety samples through a scenario feedback loop. When the application scenario of the intelligent agent migrates to a new domain (such as from data analysis to industrial control), this invention utilizes incremental learning technology to update only a portion of the adaptation layers of the time-series graph neural network model. By comparing the KL divergence between the node distribution in the new domain and the historical distribution, the scenario shift is identified, and the detection threshold of the adapter layer is automatically triggered. Adjustments were made to achieve rapid adaptation.

[0108] For computing-constrained environments such as edge devices, this invention introduces a risk-weighted approach. The system employs a lightweight parameter dynamic pruning strategy, and evaluates the safety judgment score of each node in the dynamic graph in real time. and Contribution For those factors with a lower weight influencing safety assessments... Non-critical related edges and their corresponding weight matrices are removed.

[0109] (2) Experimental design and testing: To verify the effectiveness of the end-to-end semantic-behavior collaborative modeling scheme described in this invention in detecting latent risks, this experiment constructed a highly simulated intelligent agent operating environment. The baseline was selected from existing patented schemes based on syntax, and the tests focused on indicators such as latent attacks, semantic drift, and source tracing accuracy.

[0110] Scenario 1: Industrial Control Agent Jailbreak Test: By injecting non-keyword implicit inducement instructions during the perception phase (Prompt), the system attempts to induce the agent to generate the logic of "closing the safety limiter" during the reasoning phase and generate high-risk physical instructions during the decision-making phase.

[0111] Scenario 2: Compliance Testing of Data Analysis Agents: Simulating long-chain data mining tasks, monitoring whether the agent experiences semantic drift after multiple rounds of dialogue, leading to unauthorized data reading behavior during the execution phase. abnormal.

[0112] In the experimental verification described in this invention, 5000 samples containing implicit attacks and logical inducements were tested. The experimental data shows that this invention achieved a 94.8% interception rate for implicit semantic attacks (a 32.4% improvement compared to traditional solutions), a semantic drift recognition rate of 91.2%, and a causal tracing path reconstruction accuracy of 88.5%, significantly better than the baseline level of only 31.0%. In terms of performance, thanks to the security weight-based approach... The lightweight pruning algorithm reduces computing resource consumption by 42.0% while maintaining high-precision detection, fully demonstrating that the solution can meet the real-time and reliability requirements of key security fields such as industry and finance while ensuring the logical consistency of the entire PRDE chain.

[0113] It should be noted that any parts not disclosed or specifically described in this invention are existing technology or conventional configurations, and their specific structures and working principles will not be elaborated further. In this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0114] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. It can be applied to various fields suitable for the present invention. Other modifications can be readily implemented by those skilled in the art. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and examples shown and described herein.

Claims

1. A method for intelligent agent security detection based on temporal semantic graphs and behavioral collaboration, characterized in that, include: The heterogeneous data from each stage of the agent's PRDE are normalized and then mapped to the same intent representation space to generate normalized semantic vectors covering the entire PRDE link. The normalized semantic vectors are then used to construct a heterogeneous spatiotemporal dynamic semantic graph. By using a temporal graph neural network model, high-dimensional temporal correlation features of semantic nodes in a heterogeneous spatiotemporal dynamic semantic graph are learned, the temporal evolution logic of semantic nodes is quantified, and the semantic drift is judged by comparing the predicted semantic evolution direction with the actual quantization of semantic nodes, thereby outputting a compliant semantic intent vector. By using the compliant semantic intent vector and the attention weight matrix generated by the temporal graph neural network model, a training semantic-behavior dynamic mapping matrix is ​​generated through comparative learning. The semantic-behavior dynamic mapping matrix performs a cross-space bidirectional mapping between the agent's decision intent space and execution behavior feature space. Based on the agent's decision nodes, an intent vector is generated to obtain the agent's expected behavior distribution. The consistency between the expected behavior distribution and the actual behavior trajectory flow is verified to intercept implicit violations of semantic-behavior dissonance. Furthermore, based on the attention weight matrix, reverse causal tracing and risk type identification are performed on the violations, and the identification results and the specific location of the violations are output, thereby completing the security detection.

2. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 1, characterized in that, Normalization of heterogeneous data at each stage of the agent's PRDE includes: Natural language understanding technology is used to extract predicate logic and core entity features from text prompts. A visual encoder is used to transform multimodal inputs into attribute-value pair features. A cross-modal semantic alignment function is used to map the two types of features to the same intent representation dimension to generate a normalized vector of perceptual intent. Deploy model hook functions in the intelligent agent large language model inference framework, intercept the intermediate representation of the thought chain and the hidden layer state vector when the model generates inference lexical units, decompose the thought chain into inference logic nodes with causal relationships, and use the hidden layer state vector as the node feature weight to generate inference logic normalized vectors. The structured decision instructions generated by the agent are captured and transformed into a decision intent normalization vector with the same dimension as the perception intent normalization vector through an encoder and a mapping matrix. Collect behavioral trajectory data of intelligent agents from SQL statements, API return codes, and system logs. Map these data to the same intent representation dimension using a transformation matrix to generate normalized behavioral feature vectors. Introduce a semantic entropy filtering mechanism to calculate the semantic entropy increment between the current and previous moments. Retain the feature vectors of substantive state transition behaviors whose entropy increment exceeds a preset threshold.

3. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 2, characterized in that, The method for constructing the heterogeneous spatiotemporal dynamic semantic graph is as follows: Based on the node core attributes of the normalized semantic vectors of each stage—perception, reasoning, decision-making, and execution—timestamp and security weight attributes are configured for each node, with security baseline weights assigned to the nodes corresponding to the perception intent normalized vector and the decision intent normalized vector. By establishing logical connections between nodes through causal edges, temporal edges, and referential edges, respectively representing the causal inference relationship, temporal sequence relationship, and the referential relationship between decision nodes and perception nodes, a heterogeneous spatiotemporal dynamic semantic graph is formed. Furthermore, a time-series window is set up to record the lifecycle of each node in the heterogeneous spatiotemporal dynamic semantic graph, automatically shielding expired semantic nodes from erroneous interference with the current semantic analysis, so that the heterogeneous spatiotemporal dynamic semantic graph can be updated and evolved in real time.

4. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 3, characterized in that, The quantitative comparison includes: Based on the sinusoidal temporal coding function, the time offset between nodes corresponding to the normalized semantic vectors in the heterogeneous spatiotemporal dynamic semantic graph is mapped to a high-dimensional continuous vector space, enabling the temporal graph neural network model to perceive the influence of the time dimension on the semantic logic consistency and weakening the feature contribution of expired semantic nodes. A query vector Q is generated for the current target node of the temporal graph neural network model. For the neighboring nodes of the target node, the historical features of their normalized semantic vectors are concatenated with the temporal bias encoding vector to generate a key vector K and a value vector V with temporal bias. A security risk offset is introduced to increase the attention weights of nodes corresponding to the normalized vectors of perception intent and decision intent, as well as sensitive operation nodes of code execution and privilege requests, thereby strengthening the feature learning of baseline and risk nodes. The features of K independent attention heads are computed in parallel. The attention weights calculated by QK similarity are summed for the neighboring node value vectors of each attention head to generate intermediate feature vectors for each head. All intermediate feature vectors are concatenated and projected through a linear layer. The normalized semantic vector features of the node itself are then fused with the self-evolving weight matrix to output the real-time semantic representation of the node, realizing the fusion of semantic association features across stages and links. Based on the temporal evolution law of normalized semantic vectors learned by the temporal graph neural network model, and using the normalized vectors of perception intent and decision intent as benchmarks, the compliant semantic vectors at the next moment are predicted; the Euclidean distance between the semantic vectors actually generated by the agent and the compliant semantic vectors is calculated, and when the Euclidean distance exceeds a preset threshold, it is determined that the agent has undergone semantic drift, thereby realizing the quantification and dynamic recognition of semantic drift.

5. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 4, characterized in that, The reverse causal tracing and risk type identification include: By contrastive learning, a semantic-behavior dynamic mapping matrix is ​​trained from a high-dimensional intent space to a behavioral feature space. This semantic-behavior dynamic mapping matrix has a bidirectional mapping capability between the intent space and the behavioral feature space, and can realize cross-space transformation and dimensional unification of decision intent normalization vector and behavioral feature normalization vector. The normalized vector of decision intent and the normalized vector of behavioral features are combined using the matrix corresponding to the normalized vector of decision intent. The matrix corresponding to the normalized vector of behavioral features Projecting them onto the same shared feature space, the cosine similarity algorithm is used to calculate the end-to-end consistency alignment score between the two. The calculation formula is: in For the normalized vector of decision intent, This is a normalized vector of behavioral features; When the consistency alignment score is lower than a preset threshold, the agent is determined to have semantic-behavioral disharmony. Even if a single action instruction is syntactically legal, the implicit security overreach behavior that deviates from the semantic intent of the normalized vector representation of the decision intention will still be intercepted in advance, so as to achieve precise control over the implicit risks at the execution layer.

6. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 5, characterized in that, The reverse causal attribution of the risk includes: Taking the abnormal behavior nodes corresponding to the normalized vector of behavioral features in the execution phase as the starting point for tracing the source, the multi-head attention weight matrix of the abnormal behavior nodes generated by the time sequence graph neural network model is extracted, the parent node path with the highest attention score is found, and the entire logical propagation link of the risk from generation to execution is restored along this path, and a risk tracing map is automatically generated. Risk types are distinguished based on the type of normalized vector corresponding to the starting node of the tracing link. If the starting node is an inducing input node corresponding to the normalized vector of perception intent, it is determined to be a violation caused by external attack. If the starting node is an autonomous logic deviation node corresponding to the normalized vector of reasoning logic, and there are no abnormalities in the normalized vectors of perception intent and decision intent, it is determined to be a violation caused by model illusion.

7. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 1, characterized in that, The output includes both a compliance semantic intent vector and semantic drift risk samples, as well as semantic-behavioral dissonance risk samples. Based on semantic drift risk samples and semantic-behavioral misalignment risk samples, a parameter-efficient fine-tuning method is adopted to perform low-cost adaptive adaptation of the detection model in the agent across scenarios. The computational cost of the model is optimized through a risk weight-driven parameter pruning method, and the optimized model parameters are fed back to the detection threshold to update the normalized vector generation rules, the modeling benchmark of the temporal graph neural network model, and the semantic-behavioral alignment verification threshold. At the same time, semantic drift risk samples and semantic-behavioral misalignment risk samples are added to the training set to continuously optimize the model, thus dynamically self-optimizing the entire detection method.

8. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 7, characterized in that, The efficient parameter fine-tuning method enables low-cost adaptive adaptation of the detection model across scenarios, including: A lightweight adapter layer is nested between each layer of the temporal graph neural network model. This lightweight adapter layer is a learnable module with a low number of parameters. The main parameters of the temporal graph neural network model remain fixed, avoiding overall model retraining. When the detection method is migrated to a new application domain, the KL divergence of the node distribution of the normalized semantic vector in the heterogeneous spatiotemporal dynamic semantic graph of the new domain and the historical domain is calculated, and the degree of scene offset is quantified by the KL divergence value. The parameters of the lightweight adaptation layer are updated only based on the degree of scene offset, and the semantic drift judgment threshold and semantic-behavior alignment verification threshold based on the risk characteristics of the new domain are automatically adjusted.

9. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 7, characterized in that, The risk weight-driven parameter pruning method includes: The contribution of each node and edge pair corresponding to the normalized semantic vector in the heterogeneous spatiotemporal dynamic semantic graph to the security judgment score is evaluated in real time. The pruning threshold is set by combining the security benchmark weight of the normalized vector node with the perception and decision intention as the core. Non-critical associated edges with a contribution value lower than the pruning threshold and their corresponding temporal graph neural network model weight matrices are removed. During the removal process, all parameters of the nodes corresponding to the normalized intent vector, risk-sensitive nodes, and core logic edges are retained to ensure that the detection method is not affected in terms of the accuracy of identifying latent risks such as semantic drift and semantic-behavioral dissonance.

10. The agent security detection method based on temporal semantic graph and behavioral collaboration according to claim 7, characterized in that, The dynamic self-optimization includes: The update parameters of the lightweight adaptation layer, the optimization parameters after model pruning, and the adjustment threshold of the new domain are fed back to the heterogeneous data normalization mapping rules, the attention weight configuration of the temporal graph neural network model, and the semantic-behavior alignment verification threshold, respectively, to dynamically update the core configuration of each detection process. Simultaneously, the normalized semantic vector and normalized intent vector corresponding to the risk samples are added to the training set to continuously optimize the feature learning ability of the semantic-behavior dynamic mapping matrix and the temporal graph neural network model, thereby improving the detection method's ability to identify new hidden risks.

Images