Dynamic regulation system and method for multi-agent group security control

Abstract

The application provides a kind of multi-agent group security control-oriented dynamic regulation system and method, it is related to artificial intelligence technical field, including: hardware root trust layer, with the main computing system of running external multi-agent group is physically isolated, for the behavior intention of agent is executed out-of-band review, and the behavior intention that does not pass out-of-band review is intercepted in hardware layer;Strategy generation evolution layer, for continuously running strategy arena, to generate the defense strategy that agent adopts when coping with attack behavior;Macro management and visualization layer, for constructing and visualizing the group interaction relationship graph according to the behavior result corresponding to behavior intention, to describe the behavior interaction relationship between agents;Defense strategy, group interaction relationship graph are used to determine whether behavior intention meets the review trigger condition corresponding to out-of-band review.The application can continuously carry out complete, efficient security governance to the multi-agent system of growing scale and complexity.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and multi-agent system governance technology, and in particular to a dynamic control system and method for security management of multi-agent groups. Background Technology

[0002] In recent years, with the rapid development of autonomous intelligent agent technology driven by large language models (LLM), various protection and governance solutions for intelligent agent security have emerged in the industry.

[0003] However, existing technologies have the following problems: each solution focuses on a single governance link. For example, Agent Firewall focuses on policy inspection at the communication message layer, Sandbox solution focuses on environmental isolation after command execution, and Game Theory defense solution focuses on the automatic generation of security policies. This fragmented pattern will make it impossible for deployers to obtain full-chain coverage from individual behavior to group performance, even if they use multiple tools at the same time. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a dynamic control system and method for the security management of multi-agent groups, which adapts to the future needs of intelligent agent systems evolving from single-task execution to large-scale group collaboration, and can sustainably and efficiently manage the security of multi-agent systems with increasing scale and complexity.

[0005] In a first aspect, the present invention provides a dynamic control system for the security management of multi-agent groups, comprising: The hardware root trust layer is physically isolated from the main computing system running an external multi-agent swarm, which includes multiple agents. It is used to perform out-of-band review of the agents' behavioral intentions and to intercept behavioral intentions that fail the out-of-band review at the hardware layer. The strategy generation and evolution layer is used to continuously run the strategy arena to generate defensive strategies that agents adopt when responding to attacks. The macro-management and visualization layer is used to construct and visualize the group interaction relationship diagram based on the behavioral results corresponding to the behavioral intentions, so as to describe the behavioral interaction relationships between intelligent agents; Among them, the defense strategy and the group interaction graph are used to determine whether the behavioral intent meets the review triggering conditions corresponding to out-of-band review.

[0006] In one implementation, the strategy generation and evolution layer includes a strategy arena and a normalized transcription engine; wherein... The strategy arena is used for: multi-agent games, where the first-party agent launches attacks on the second-party agent with continuously mutating attack behaviors, and the second-party agent generates defensive strategies to deal with the attack behaviors. A standardized transcription engine is used to: convert defense strategies into standard security policy codes and inject the standard security policy codes into multiple agents within an external multi-agent swarm.

[0007] In one implementation, the macro-management and visualization layer further includes a risk heatmap module, used for: The behavioral risk level is obtained by obtaining the behavioral intentions of multiple agents in an external multi-agent group. The behavioral risk level is determined by causal inference of the behavioral intentions and combined with the defense strategy and the current trust weight between the agents. Based on the behavioral risk level, the corresponding identifier of the agent is rendered in the current heat map to obtain the target heat map; The behavioral interaction relationship between agents is determined based on the behavioral result corresponding to the behavioral intention. Based on the behavioral interaction relationship, the connection edges between the corresponding identifiers of the agents are established in the target heat map to obtain the group interaction relationship graph.

[0008] In one implementation, the macro-management and visualization layer further includes a strategy situation overview module, used for: Visualize one or more of the following: the coverage of defensive strategies, the evolutionary history of defensive strategies, and the confrontational situation in the strategic arena.

[0009] In one implementation, the hardware root trust layer, the policy generation and evolution layer, and the macro-management and visualization layer work together to form a multi-stage dynamic control process, which includes: The intent interception process node is used to: intercept the agent's behavioral intent, perform causal inference on the behavioral intent, and obtain the causal inference result corresponding to the behavioral intent; The buffer execution process node is used to: determine the behavioral intent that needs to be controlled based on the current trust weight between the causal inference results, defense strategies and intelligent agents, implement multi-level buffer release, and determine that the review triggering conditions are met when the behavioral intent contains physical execution instructions, so as to call the hardware root trust layer to perform out-of-band review of the behavioral intent. The current trust weight is determined based on the group interaction relationship graph. The strategy generation process node is used to: call the strategy generation evolution layer to update the defense strategy; The trust feedback process node is used to: call the macro management and visualization layer to update the group interaction relationship graph, correct the current trust weight based on the updated group interaction relationship graph, and feed back the updated defense strategy and the updated current trust weight to the buffer execution process node.

[0010] In one implementation, the intent to intercept a process node is specifically used for: Inject behavioral intent into the shadow execution environment; The shadow execution environment performs the following operations: decompose the behavioral intention into atomic actions to obtain an action sequence, and perform chain effect deduction for each action contained in the action sequence along the causal chain until the preset deduction termination condition is met to obtain the causal deduction result.

[0011] In one implementation, the buffered execution flow node is specifically used for: Based on the causal inference results, defense strategies, and the current trust weights among agents, the behavioral risk level corresponding to the agent's behavioral intention is determined. Determine whether the behavioral intent needs to be executed under control based on the level of behavioral risk. If so, the behavioral intent is broken down into multiple execution steps; If the behavior of the current execution step is as expected, continue to release the next execution step until all execution steps have been released. If the outcome of the current action step does not meet expectations, the review trigger condition is determined to be met, and the hardware root trust layer is invoked to perform out-of-band review of the action intent.

[0012] In one implementation, the behavioral risk level includes at least a low-risk level, a medium-risk level, and a high-risk level; determining whether the behavioral intent needs to be controlled based on the behavioral risk level includes: In low-risk situations, determining behavioral intent does not require controlled execution; In medium-risk situations, the determination of behavioral intent must be carried out in a controlled manner; In cases of high risk, an asynchronous authorization process is triggered, pushing the causal deduction results and behavioral risk level to the macro-management and visualization layer. Based on the decision results from the macro-management and visualization layer, it is determined whether the behavioral intent needs to be executed under control or not.

[0013] In one implementation, the trust feedback process node is specifically used for: Graph anomaly detection is performed on the group interaction graph to identify malicious collusion clusters in external multi-agent groups; The current trust weights among the agents contained in the malicious collusion cluster are downgraded to obtain the updated current trust weights.

[0014] Secondly, the present invention also provides a dynamic control method for multi-agent group security management, applied to the dynamic control system for multi-agent group security management provided in the first aspect, comprising: Step 1: Intercept the behavioral intentions of agents in an external multi-agent group, and perform causal inference on the behavioral intentions to obtain the causal inference results corresponding to the behavioral intentions. Step 2: Based on the causal deduction results, the defense strategy generated by the strategy generation and evolution layer, and the current trust weight between the agent, determine the behavioral intention that needs to be controlled and release it. Implement multi-level buffer release, and determine that the review triggering condition is met when the behavioral intention contains physical execution instructions. Call the hardware root trust layer to perform out-of-band review of the behavioral intention. The current trust weight is determined based on the group interaction relationship graph. Step 3: Invoke the strategy to generate the evolution layer and update the defense strategy; Step 4: Call the macro management and visualization layer to update the group interaction relationship graph. Based on the updated group interaction relationship graph, correct the current trust weight, and feed the updated defense strategy and the updated current trust weight back to Step 2 to form a closed-loop dynamic control.

[0015] Thirdly, the present invention also provides a multi-agent swarm system, including a main computing system that runs an external multi-agent swarm, and a dynamic control system for security management of multi-agent swarms provided in the first aspect, wherein the main computing system and the hardware root trust layer in the dynamic control system are physically isolated.

[0016] This invention provides a dynamic control system and method for the security management of multi-agent groups. It achieves out-of-band review and hardware-level interception under physical isolation through a hardware root trust layer, ensuring strong constraints on the behavioral intentions of multi-agent groups. A strategy generation and evolution layer continuously generates defense strategies adapted to attack scenarios based on a strategy arena. A macro-management and visualization layer dynamically constructs a group interaction graph based on actual behavioral results. The collaboration of these three layers enables unified security management of multi-agent groups, adapting to the future needs of agent systems evolving from single-task execution to large-scale group collaboration. It can sustainably and efficiently govern the security of multi-agent systems with increasing scale and complexity.

[0017] This invention achieves out-of-band review and hardware-level interception of multi-agent behavioral intentions by physically isolating the hardware root trust layer from the main computing system, ensuring that intentions that fail review cannot be executed. The policy generation and evolution layer relies on a continuously running policy arena to dynamically generate defense strategies to deal with attack behaviors. The macro-management and visualization layer constructs and displays a group interaction relationship graph based on actual behavioral results, intuitively representing the behavioral relationships between agents. The three layers work together to make the defense strategy and the group interaction relationship graph serve as the basis for judgment, accurately triggering out-of-band review and improving the objectivity, real-time performance, and verifiability of the review.

[0018] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained through the structures particularly pointed out in the description and the drawings.

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the structure of a dynamic control system for multi-agent group security management provided in an embodiment of the present invention; Figure 2 A schematic diagram of the specific structure of a dynamic control system for multi-agent group security management provided in an embodiment of the present invention; Figure 3 A schematic diagram illustrating the specific structure of another dynamic control system for multi-agent group governance and security management provided in an embodiment of the present invention; Figure 4 A flowchart illustrating a dynamic control method for multi-agent group security management provided in an embodiment of the present invention; Figure 5 A schematic diagram illustrating the specific process of a dynamic control method for multi-agent group security management provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an intelligent agent swarm system provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] In recent years, with the rapid development of autonomous intelligent agent technology driven by Large Language Models (LLM), various protection and governance solutions for intelligent agent security have emerged in the industry, such as: (1) Agent Communication Firewall Solution: Represented by SoftBank's "Agent Firewall", this solution deploys centralized policy enforcement and monitoring nodes in multi-agent communication links. This type of solution adopts a zero-trust architecture, performing identity authentication, contract policy checks, and data leakage prevention (DLP) audits on every message interaction between agents, and storing communication records in a tamper-proof ledger. Its governance scope mainly covers the communication layer, focusing on message content and data compliance.

[0024] (2) Protocol-based governance framework: Represented by the IETF standard draft AIGA (AI Governance and Accountability Protocol), it attempts to establish a universal intelligent agent governance framework at the protocol level. AIGA includes an immutable kernel architecture, a layered risk governance model, and a standardized policy language, with the goal of achieving consistent policy execution across platforms. Organizations such as HCLTech have proposed the concept of a unified intelligent agent governance cloud, which bridges heterogeneous environments such as Azure and OpenAI through cross-platform policy execution.

[0025] (3) Sandboxed execution isolation schemes: Both academia and industry have proposed various sandboxed execution isolation schemes for AI agents. A typical example is fault-tolerant sandboxing, which restricts the execution of high-risk commands of the agent to a sandbox through a policy interception layer and a transactional file system snapshot mechanism, and rolls back to a safe state when a destructive operation is detected. Agent Control Protocol (ACP) proposes a stateful action admission control protocol, which manages the behavior trajectory of the agent by combining static risk scoring and stateful anomaly signals.

[0026] (4) Multi-agent game-theoretic defense scheme: In terms of multi-agent security policy generation, the MAGIC framework models LLM security alignment as an adversarial asymmetric game of multi-round multi-agent reinforcement learning. In MAGIC, the attacker iteratively rewrites the query into deceptive prompts, while the defender simultaneously optimizes the identification strategy. The AdvEvo-MARL framework internalizes security into the task agent through co-evolutionary training between the attacker and the defender, reducing the attack success rate while maintaining task accuracy. There are also domestic dynamic network security defense methods based on the combination of multi-agent joint game theory and moving target defense, which predict the attacker's strategy in an incomplete information environment through Bayesian game theory.

[0027] While the aforementioned existing technologies each provide some security protection capabilities at specific stages, they generally suffer from the following structural defects, which need to be addressed by the technical means of this invention: (1) Fragmented protection coverage, with each solution focusing on only a single level: Existing technologies have different focuses but are fragmented: Agent Firewall focuses on policy inspection at the communication message layer and lacks the ability to audit the inherent intentions of the intelligent entity; Sandbox solutions focus on environmental isolation after command execution but cannot make forward-looking interventions at the intention generation stage; Game theory defense solutions focus on the automatic generation of security policies but do not integrate policy generation, transcription and distribution, execution control, and group feedback into a closed loop. This fragmented pattern means that even if deployers use multiple tools at the same time, they cannot obtain full-chain coverage from individual behavior to group performance.

[0028] (2) The security policy update mechanism is static and lacks dynamic evolution capability: Existing policy generation methods are significantly inadequate in handling dynamic adversarial situations. Although solutions such as MAGIC introduce a game-theoretic mechanism, their security policies are generated from static snapshots of adversarial training and will not be continuously updated in actual deployment as attack methods change in real time. Most enterprise-level security solutions still rely on security experts to manually write and update rules, with update cycles measured in days or weeks, which lags far behind the second-level variation of attack methods.

[0029] (3) Lack of group security governance among agents: Existing trust and security management mechanisms mainly conduct point-to-point evaluations of individual agents. However, in actual multi-agent collaboration scenarios, malicious agents can form "collusive groups" through mutual endorsement and coordinated overreach, rendering traditional point-to-point reputation assessments completely ineffective. Currently, there is a lack of methods for identifying group collusion that take the interaction topology between agents as the overall detection object.

[0030] (4) Lack of a unified and standardized policy transcription mechanism: Different agent development frameworks (such as LangChain, AutoGPT, MetaGPT, ROS, etc.) use vastly different policy expression formats and security control interfaces. Agent Firewall is compatible with A2A and ACP protocols, but the AIGA standard is still in the draft stage and has not yet been widely adopted. The same set of security policies cannot be seamlessly reused across different frameworks, resulting in a linear increase in security governance costs in multi-framework environments.

[0031] (5) Lack of out-of-band security fallback mechanism at the hardware level: Existing pure software security solutions are at risk of being tampered with or bypassed by the underlying layer when issuing physical execution instructions to embodied intelligent agents (such as industrial robots, autonomous vehicles, etc.). If the security logic only resides in the operating system or middleware layer, the security mechanism will fail once that layer is breached. In the field of robot safety, the industry has recognized the inadequacy of pure software security, but FPGA hardware-level security supervision is mainly applied to sensor fusion and real-time control, and has not yet been systematically integrated with the upper-layer intelligent agent policy governance.

[0032] In summary, the existing technology system is isolated, passive, and fragmented, and cannot provide unified dynamic control covering the entire lifecycle of "intent generation - strategy decision-making - action execution - group collaboration - result closure".

[0033] Based on this, the present invention provides a dynamic control system and method for security management of multi-agent groups, which adapts to the future needs of intelligent agent systems evolving from single-task execution to large-scale group collaboration, and can sustainably and efficiently manage the security of multi-agent systems with increasing scale and complexity.

[0034] To facilitate understanding of this embodiment, a detailed description of a dynamic control system for multi-agent group security management disclosed in this invention will be provided first, see [link to relevant documentation]. Figure 1 The diagram shown illustrates the structure of a dynamic control system for multi-agent group security management, comprising: The hardware root trust layer 10 is physically isolated from the main computing system running an external multi-agent swarm, which includes multiple agents. It is used to perform out-of-band review of the agents' behavioral intentions and to intercept behavioral intentions that fail the out-of-band review at the hardware layer.

[0035] The strategy generation and evolution layer 20 is used to continuously run the strategy arena to generate defensive strategies adopted by the agent in response to attack behavior.

[0036] The macro-management and visualization layer 30 is used to construct and visualize the group interaction relationship diagram based on the behavioral results corresponding to the behavioral intentions, so as to describe the behavioral interaction relationships between intelligent agents. Among them, the defense strategy and the group interaction graph are used to determine whether the behavioral intent meets the review triggering conditions corresponding to out-of-band review.

[0037] The dynamic control system for security management of multi-agent groups provided in this invention achieves out-of-band review and hardware-level interception under physical isolation through a hardware root trust layer, ensuring strong constraints on the behavioral intentions of multi-agent groups; the strategy generation and evolution layer continuously generates defense strategies adapted to attack scenarios based on a strategy arena; and the macro-management and visualization layer dynamically constructs a group interaction relationship graph based on actual behavioral results. The collaboration of these three layers enables unified security management of multi-agent groups, adapting to the future needs of agent systems evolving from single-task execution to large-scale group collaboration, and sustainably providing complete and efficient security governance for multi-agent systems with increasing scale and complexity.

[0038] This invention discloses a dynamic control system for multi-agent group governance and security management. The system is deployed as an out-of-band security control middleware and communicates with external multi-source heterogeneous agents (such as LangChain Agent, AutoGPTAgent, ROS Agent, etc.) through a standardized interface. See also... Figure 2 The diagram shows a specific structure of a dynamic control system for security management of multi-agent groups. The system includes a hardware root trust layer 10, a policy generation and evolution layer 20, and a macro-management and visualization layer 30. The three layers work together to form a four-stage dynamic control closed loop (intent interception 41, policy generation 42, buffer execution 43, trust feedback 44).

[0039] The hardware root trust layer 10 and the policy generation and evolution layer 20 are bidirectionally connected via a control and data interaction channel (out-of-band channel) to ensure physical or logical isolation between security commands and business data flows. The policy generation and evolution layer 20 and the macro governance and visualization layer 30 are bidirectionally connected via an intra-layer trusted channel to ensure the integrity and confidentiality of policy uploading and governance command issuance.

[0040] See details Figure 3 The diagram shows a specific structure of another dynamic control system for multi-agent group governance and security management: The hardware root trust layer 10 is located at the bottom layer of the system and provides a physically isolated security baseline. It includes a secure boot module 11, an FPGA measurement and verification module 12, and a key storage module 13. (1.1) The safe boot module 11 is used to ensure the integrity of the firmware when the system is powered on.

[0041] Secure Boot is a hardware-mandated boot verification mechanism that requires the system to verify the digital signature and hash value of each firmware layer step by step from power-on reset. If the verification fails at any step, the boot process will be terminated; otherwise, the firmware can be determined to be intact.

[0042] (1.2) The FPGA measurement and verification module 12 is used to independently review the physical execution instructions issued by the embodied intelligent agent. It is physically isolated from the main computing system. Even if the upper-layer software is completely compromised, physical security constraints can still be enforced at the hardware level.

[0043] Independent out-of-band review refers to review logic that runs entirely within the FPGA programmable logic unit, completely detached from the business data flow and control flow path of the main computing system. Physical security constraints are insurmountable hard limitations imposed on the physical execution behavior of an embodied intelligent agent, such as joint torque limits, Cartesian boundaries of the workspace, and motion speed thresholds, which are directly controlled by the physical execution unit (such as a servo driver).

[0044] In one instance, if the agent's behavioral intent includes physical execution instructions, the FPGA measurement and verification module 12 will be triggered to conduct an independent out-of-band review of the behavioral intent. For example, the behavioral intent can be directly parsed, and the maximum linear velocity and maximum angular velocity allowed by the corresponding device in the current working area can be found according to the preset safety policy table. The actual parameters carried in the intent are compared with them item by item. If any parameter exceeds the allowed range, it is determined to be a violation intent.

[0045] (1.3) The key storage module 13 is used to store the encryption key and metric benchmark value required for hardware root trust.

[0046] An encryption key is either the private or symmetric key in an asymmetric key pair used for signature verification (such as secure boot) and data encryption (such as policy benchmark protection). A benchmark value is a gold-standard hash value of the system's trusted state (such as a set of valid instruction templates, security barrier configuration, or policy version fingerprint), serving as an anchor for runtime metric comparisons.

[0047] Optionally, the hardware root trust layer 10 uses an FPGA as the physical isolation scheme for out-of-band auditing. Alternatively, in purely digital collaborative scenarios (without physically executing instructions), the FPGA module can be omitted, and a Trusted Execution Environment (TEE, such as Intel SGX or ARM TrustZone) can be used instead as the hardware root trust scheme. Security policies and metric benchmarks are stored and executed within a secure area inside the TEE. In low-power embedded scenarios, a Secure Element or Hardware Security Module (HSM) can also be used as an alternative carrier for key storage and metric verification. While these alternatives are weaker than FPGAs in terms of physical isolation strength and real-time determinism, they all provide a secure computing environment independent of the host system.

[0048] The strategy generation and evolution layer 20 is located in the middle layer of the system and is used to dynamically generate, update in real time and distribute security policies across frameworks. It includes a strategy arena 21 and a standardized transcription engine 22.

[0049] (2.1) Strategy Arena 21, used for: conducting multi-agent games, where the first agent launches an attack on the second agent with continuously mutating attack behavior, and the second agent generates a defense strategy to deal with the attack behavior.

[0050] In one implementation, the strategy arena 21 runs a red-blue multi-agent game, where the red agent continuously simulates new attack behaviors with mutated attack methods, and the blue agent, based on adversarial feedback and collaborative evolution, solves for a dynamically optimal set of defense strategies that satisfy constraints on security, task preservation, and execution timeliness. For example, the red team consists of three lightweight LLM agents that simulate cue injection attacks, memory pollution attacks, and MCP service hijacking attacks, respectively. Their attack strategies generate new attack samples in real time using preset mutation operators (such as synonym replacement, instruction reordering, and context obfuscation), and submit a round of attack payloads to the blue team at fixed time windows (e.g., every 10 seconds). The Blue Team is a policy-generating agent based on multi-objective reinforcement learning. Its state space includes the current group risk heatmap, historical interception failure patterns, and detection results of malicious collusion clusters. Its action space is a combination of policy parameters (such as intent suspension threshold, buffer level, and physical constraint coefficient). The reward function comprehensively considers the attack blocking rate, task success rate, and average response latency. It continuously evolves defense strategies through the NSGA-II algorithm, which are then consumed by the standardized transcription engine 22.

[0051] In another implementation, after sufficient adversarial samples have been accumulated, a historical adversarial sample replay mechanism can be introduced to switch the game process from full real-time adversarial to a hybrid mode of "offline batch generation and online real-time injection," reducing the computational overhead of the arena's long-term continuous operation. For example, the red team's attack sample library is pre-built offline and continuously updated, containing typical attack sequences captured in history (such as unauthorized tool call chains, collaborative reputation score-boosting behavior, and slow-burning memory poisoning instruction sets), labeled according to attack type and risk level; during online operation, the arena does not generate all attack samples in real time, but samples them from this sample library according to dynamic weights (the weights are adjusted in real time based on the current group risk heatmap), and loads them into the red team's agent for execution; based on the sampled attack payloads, the blue team quickly evaluates the effectiveness of existing defense strategies in a lightweight simulation environment, and only triggers local strategy fine-tuning (such as parameter perturbation or rule combination optimization) for failure scenarios, generating incremental strategy patches.

[0052] In another implementation, the mutation strategy of the red side's attack method can be replaced by a genetic algorithm instead of reinforcement learning to simplify the training process. For example, the mutation strategy of the red side is implemented by a genetic algorithm: using the attack success rate and bypass rate as fitness functions, the algorithm performs selection, crossover and mutation operations on the structured fields (such as intentional actions, parameter ranges, and context dependencies) of the attack instruction template, replacing end-to-end reinforcement learning training, and significantly reducing the computational overhead and convergence time of a single round of adversarial training.

[0053] (2.2) Standardized transcription engine 22, used to: convert defense strategies into standard security policy codes and inject the standard security policy codes into multiple agents contained in an external multi-agent swarm.

[0054] In one implementation, the standardized transcription engine 22 is coupled with the policy arena 21 to transform the defense strategy output from the game into a standard security policy encoding independent of the agent development framework. This policy is then distributed and injected into the execution environments of various external agents via out-of-band access APIs or protocols. Specifically, the standardized transcription engine 22 parses the defense strategy output by the policy arena 21 into a unified intermediate representation. This representation uses a lightweight ontology structure defined by RDF Schema, including policy identifiers, applicable conditions (such as agent type, credit threshold, and scene label), execution actions (such as suspend, buffer, and intercept), constraint parameters (such as time window, spatial boundary, and torque limit), and digital signatures. Subsequently, the engine maps the intermediate representation to the corresponding format based on the framework type of the target agent. All translation results are pushed to the target environment via an out-of-band API independent of the main business channel, ensuring that the policy distribution process does not pass through the application layer protocol stack of the main computing system or depend on its runtime context.

[0055] In another implementation, transcription adaptation can be performed based on the existing Agent-to-Agent (A2A) protocol extension standard format, or mapped to the OpenAI AgentKit policy description format, to reduce the ecological resistance to standardization. In scenarios with high policy execution terminal support, centralized transcription can be avoided; instead, each agent framework can load the corresponding policy adaptation plugin to complete the localization of policies in a distributed manner.

[0056] The macro-management and visualization layer 30 is located at the top of the system and is used to realize group risk perception, malicious collusion identification, and human-machine collaborative governance. It includes a risk heatmap module 31, a strategy situation overview module 32, and a governance strategy library module 33. (3.1) Risk Heatmap Module 31 is used to: dynamically generate and visualize a heatmap of group risk distribution based on real-time collected agent behavior data and interaction logs. The horizontal axis represents the spatial / task dimension, the vertical axis represents the time dimension, and the color intensity maps the local risk density. Furthermore, a group interaction relationship diagram is generated based on this. The specific implementation process is as follows: 1. Obtain the behavioral risk level corresponding to the behavioral intentions of multiple agents in the external multi-agent group. The behavioral risk level is determined by causal inference of the behavioral intentions and in combination with the defense strategy and the current trust weight between agents. For the specific determination process, please refer to the relevant explanation of the trust feedback process node in the following embodiment. It will not be described in detail here.

[0057] Second, based on the behavioral risk level, render the corresponding identifier of the agent in the current heatmap to obtain the target heatmap. In specific implementation, each agent is mapped to the two-dimensional coordinate space of the heatmap, where one dimension represents the logical or physical partition to which the agent belongs, and the other dimension represents the time dimension; according to the behavioral risk level obtained in step one, the identifier of the agent is rendered at the corresponding coordinate position using a preset visual encoding rule; the visual encoding rule maps the behavioral risk level to visual attributes, including but not limited to color depth, brightness, saturation, size or texture density, thereby generating a target heatmap reflecting the real-time risk distribution of the group.

[0058] Third, determine the behavioral interaction relationships between agents based on the behavioral results corresponding to the behavioral intentions. Establish connection edges between the corresponding identifiers of agents in the target heatmap based on these behavioral interaction relationships to obtain a group interaction relationship graph. In specific implementation, parse the behavioral result data fed back after the execution of the behavioral intention, extracting the interaction events between the executing agent and one or more collaborating agents. Abstract these interaction events into a node-edge relationship structure, where nodes represent agents participating in the behavior, and edges represent the collaboration, invocation, communication, or cooperative relationships formed during that behavior. Within the target heatmap coordinate system, using each agent's identifier as the node position, establish connection edges according to the relationship structure, and assign weight attributes representing the interaction intensity to the edges. This forms a group interaction relationship graph superimposed on the target heatmap, possessing spatial-temporal-relational semantics.

[0059] Optionally, in scenarios with limited computing or storage resources, periodic snapshots (reconstructing the graph structure at fixed time intervals or based on a threshold number of interaction events) can be used to reduce the overhead of continuous updates, but this comes at the cost of reduced timeliness in collusion detection. Regarding credit data storage, core credit relationships can be stored in a centralized trusted database instead of a blockchain solution to improve read / write efficiency, but this requires accepting the single point of trust dependency inherent in a centralized architecture.

[0060] (3.2) Strategy Situation Overview Module 32 is used to visualize one or more of the following: the coverage of defense strategies (marked by agent ID, framework type, deployment domain, etc.), the evolution history of defense strategies (such as strategy evolution timeline), and the adversarial situation in the strategy arena (such as red-blue win rate, strategy update frequency, and high-risk scenario hit rate).

[0061] For example: Regarding the coverage of defense strategies: extract the agent identifier, development framework type, and logical or physical domain information associated with each effective strategy from the strategy library; map the above multi-dimensional attributes into hierarchical markers on the visualization interface, including but not limited to: using different icon styles to represent the framework type, using area coloring or boundary highlighting to represent the deployment domain, and using node connection relationships or label clouds to represent the set of controlled agents, thereby forming a spatialized and structured view of the strategy's scope of action; Regarding the evolution history of defense strategies: organize historical versions according to the generation time of the strategies, and map the time sequence of each version, the differences between versions, and the life cycle status of the strategies into a linear or tree-like temporal structure; represent the strategy evolution path through visual cues, including but not limited to: line thickness, connection style, node shape, or dynamic flow arrows, to intuitively reflect the iteration, merging, replacement, or abandonment process of the strategies. For the confrontation situation in the strategy arena: collect data on the interaction process between the red side's attack behavior and the blue side's defense response, and extract multi-dimensional characterization indicators to represent the confrontation capability and strategy effectiveness; map the indicators into comparable visualization forms, including but not limited to: dual-axis comparison charts, radar charts, state transition charts or heat matrices, where each dimension corresponds to a type of confrontation feature, and the graphic layout reflects the correlation and trend between indicators.

[0062] (3.3) The governance strategy library module 33 is used for persistent storage and version management of historical strategies, manually injected governance rules, and the results of malicious agent marking and their correlation after collusion identification and confirmation.

[0063] Based on the aforementioned system architecture, the hardware root trust layer, policy generation and evolution layer, and macro-management and visualization layer work together to form a multi-stage dynamic control process. This process is formed by four nodes—intent interception 41, policy generation 42, buffer execution 43, and trust feedback 44—connected end-to-end. Specifically, it includes: (i) Intent Interception 41 process nodes are used to: intercept the agent's behavioral intent, and perform causal inference on the behavioral intent to obtain the corresponding causal inference result. In specific implementation, it receives structured action intents from external agents, suspends their execution, and calls a lightweight shadow execution environment to complete atomic action decomposition and causal chain inference, outputting a preliminary risk assessment, which is the causal inference result. Among them, the shadow execution environment is used to traverse all reachable state paths based on the input behavioral intent, under the constraints of a preset minimalist state model and causal rule set, exhaustively or pruning the chain effects that the behavior may cause in an ideal closed loop, until the preset termination condition is met, and outputs the causal inference result.

[0064] The specific implementation process is as follows: Inject behavioral intent into the shadow execution environment; The shadow execution environment performs the following operations: It decomposes the behavioral intent into atomic actions to obtain an action sequence; it then extrapolates the chain effect of each action within the action sequence along a causal chain until a preset termination condition is met, yielding a causal inference result. In specific implementation, the shadow execution environment semantically parses the input behavioral intent, transforming it into a set of indivisible atomic actions based on a predefined action ontology, forming an ordered action sequence. Subsequently, based on an embedded deterministic causal model, it starts from the initial system state and unfolds the state transition path triggered by each atomic action layer by layer along causal dependencies. This inference process relies solely on built-in rules for forward logical reasoning. The inference continues until at least one preset termination condition is met, including: reaching a preset safety boundary state, completing the traversal of all reachable states, reaching the logical upper limit of the inference depth, or identifying a clear risk trigger node. Finally, it outputs the causal inference result, which includes key state nodes of the inference path, the decisive conditions leading to termination, and judgment indicators related to safety constraints.

[0065] Optionally, this shadow environment can be implemented using various underlying technologies, including: container-level lightweight virtualization (such as Firecracker microVM), WebAssembly sandbox, user-space kernel / process-level virtualization (such as gVisor), or deterministic symbolic inference based on a rule engine. In scenarios with limited computing resources, pre-computed causal graph matching can be used instead of real-time inference—the causal chains of common high-risk intentions are pre-built as lookup tables, and only graph matching is needed during inference, reducing computational overhead but sacrificing the breadth of coverage for unknown intentions. In scenarios with extremely high real-time requirements, the granularity of atomic action decomposition can be simplified, inferring only first-level causal effects rather than the entire causal chain, in exchange for shorter response latency.

[0066] (ii) Buffer execution of process node 43 is used to: determine the behavioral intent that needs to be executed under control based on the current trust weight between the causal inference result, defense strategy, and agent; implement multi-level buffer release; and determine that the review trigger condition is met when the behavioral intent contains physical execution instructions, so as to call the hardware root trust layer to perform out-of-band review of the behavioral intent. The current trust weight is determined based on the group interaction relationship graph. In specific implementation, for actions that are determined to need to be executed under control by the strategy generation node 42, a multi-level buffer release mechanism is implemented: the action is decomposed into ordered execution steps, and the consistency between the actual execution result and the expected state is verified step by step; when the action involves physical execution instructions, the FPGA measurement and verification module 12 in the hardware root trust layer 10 is called synchronously to perform independent and deterministic final arbitration through the out-of-band channel.

[0067] The specific implementation process is as follows: (I) Based on the causal inference results, defense strategies, and the current trust weights among agents, determine the behavioral risk level corresponding to the agent's behavioral intention. Specifically, the causal inference results, the constraint capability representation of the defense strategy, and the trust weights among agents are used as multi-source heterogeneous inputs and fed into a unified risk fusion model. The model does not rely on external training data, and its fusion logic is based on preset association rules and priority strategies to comprehensively reflect the combined impact of behavioral intentions on three dimensions: security, task preservation, and collaborative reliability. The output is a behavioral risk level, which is a single-dimensional ordered quantitative index used to characterize the overall risk level of the behavioral intention in the current system state and serves as the decision-making basis for subsequent execution control strategy selection.

[0068] (II) Determine whether the behavioral intent requires controlled execution based on the behavioral risk level. The behavioral risk level includes at least low-risk, medium-risk, and high-risk levels. Specifically, in the case of a low-risk level, the behavioral intent is determined not to require controlled execution; in the case of a medium-risk level, the behavioral intent is determined to require controlled execution; in the case of a high-risk level, an asynchronous authorization process is triggered, pushing the causal deduction results and behavioral risk level to the macro-management and visualization layer. Based on the decision result fed back from the macro-management and visualization layer, it is determined whether the behavioral intent requires controlled execution or not.

[0069] In the above embodiments, high-risk intent triggers asynchronous authorization and is then pushed to human decision-making. Alternatively, a multi-level automated review process can be configured: first, it upgrades to deeper symbolic deduction or multi-dimensional cross-validation, and only transfers to human intervention when automated review still cannot make a decision, thus reducing the frequency of human intervention. In low-security scenarios, it can also be configured to automatically grant or reject requests based on preset risk thresholds, without human intervention.

[0070] (III) If so, the behavioral intent is decomposed into multiple execution steps. In the specific implementation, the behavioral intent is decomposed into multiple execution steps with a sequential order based on its semantic structure and execution dependencies. Each execution step corresponds to the smallest independently verifiable behavioral unit, and there are state continuity constraints between adjacent steps.

[0071] For example, the semantic structure of the behavioral intent is parsed to identify the action type, target object, parameter constraints, and context dependencies contained therein. Based on the logical dependencies between actions and the execution sequence requirements, the behavioral intent is divided into several ordered sub-units. The division is based on the principle that each sub-unit has semantic behavioral integrity and execution boundary closure. Each sub-unit is defined as an execution step level, which represents the smallest behavioral granularity that can be independently executed and whose results can be independently observed in the current system state. Independent observation includes deterministic verification of output state, resource consumption, or interactive response. State continuity constraints are established between adjacent execution step levels. The constraints define that the output state of the previous step level must meet the input preconditions of the next step level, and these preconditions can be statically or dynamically verified before execution.

[0072] (IV) If the behavior of the currently released execution step meets the expected result, continue to release the next execution step until all execution steps have been released. Specifically, observe the behavior of the currently released execution step and compare it with the expected state goal of that step; if the comparison result meets the preset consistency judgment criteria, the release of subsequent execution steps is allowed; this process continues until all execution steps have been released.

[0073] (V) If the result of the released current action step does not meet the expected result, determine that the review trigger condition is met, and call the hardware root trust layer to perform out-of-band review of the action intent. In specific implementation, if there is a non-negligible deviation between the result of the action at any execution step and the expected state target, and the deviation meets the preset review trigger condition, then the release of subsequent steps is suspended, and an out-of-band review request is initiated to the hardware root trust layer.

[0074] (III) Strategy Generation 42 process node, used to: call the strategy generation evolution layer to update the defense strategy. In specific implementation, based on the risk judgment result of the intent interception 41 node, the strategy arena 21 is called to generate an adaptive defense strategy, and the standardized transcription engine 22 is used to convert it into a cross-framework compatible standard security strategy code to realize the dynamic output and distribution of the strategy.

[0075] (iv) Trust Feedback 44 process node, used to: call the macro management and visualization layer to update the group interaction relationship graph, correct the current trust weight based on the updated group interaction relationship graph, and feed back the updated defense strategy and the updated current trust weight to the buffer execution process node. In specific implementation, the behavior results and interaction records of the intelligent agents are collected, the group interaction relationship graph is dynamically constructed and updated, the graph anomaly detection algorithm is run to identify malicious collusion clusters, and the corrected credit weight is fed back in real time to the Intent Interception 41 node (used to optimize subsequent risk scoring) and the Strategy Generation 42 node (used to drive the Strategy Arena 21 to generate defense strategies for new collusion patterns), thereby forming a closed-loop control covering the entire life cycle of "intent-strategy-execution-feedback".

[0076] The updating of the group interaction relationship diagram can be found in the foregoing explanation of the macro-management and visualization layer, and will not be repeated in this embodiment of the invention.

[0077] The specific implementation process for updating the current trust weight is as follows: Graph anomaly detection is performed on the group interaction graph to identify malicious collusion clusters within the external multi-agent group. The current trust weights among the agents contained in the malicious collusion clusters are then downgraded to obtain the updated current trust weights. The details are as follows: Based on the topology and edge attributes of the group interaction graph, a graph anomaly detection operation is performed. The group interaction graph has agents as nodes and behavioral interaction events as edges. The edge attributes include interaction frequency, cooperation type, and context consistency identifier. The graph anomaly detection identifies subgraph structures that significantly deviate from the group's normal behavior patterns in terms of topology and interaction patterns, based on the similarity of the node's neighborhood structure, the local clustering of edge weights, and the internal connection density of the subgraph. Subgraph structures that deviate from the normal behavior pattern are identified as malicious collusion clusters; For each agent in a malicious collusion cluster, a differentiated downgrade strategy is generated based on its centrality within the cluster, interaction activity, and the strength of its association with other cluster members. The downgrade strategy defines the direction and relative magnitude of the trust weight adjustment, which weakens the agent's access permission and policy influence in future collaborative scenarios. The downgrade operation is executed, and the adjusted trust weight is synchronously updated to the system's global trust state database and fed back to the intent interception process node 41 and the policy generation process node 42. This is used to influence the risk assessment and dynamic evolution of defense strategies for subsequent behavioral intentions.

[0078] Based on the foregoing embodiments, this invention further provides a dynamic control method for multi-agent group security management. This method is applied to the aforementioned dynamic control system. See [link to relevant documentation]. Figure 4The flowchart shown is a dynamic control method for multi-agent group security management, including: Step 1: Intercept the behavioral intentions of agents in an external multi-agent group, and perform causal inference on the behavioral intentions to obtain the causal inference results corresponding to the behavioral intentions. Step 2: Based on the causal deduction results, the defense strategy generated by the strategy generation and evolution layer, and the current trust weight between the agent, determine the behavioral intention that needs to be controlled and release it. Implement multi-level buffer release, and determine that the review triggering condition is met when the behavioral intention contains physical execution instructions. Call the hardware root trust layer to perform out-of-band review of the behavioral intention. The current trust weight is determined based on the group interaction relationship graph. Step 3: Invoke the strategy to generate the evolution layer and update the defense strategy; Step 4: Call the macro management and visualization layer to update the group interaction relationship graph. Based on the updated group interaction relationship graph, correct the current trust weight, and feed the updated defense strategy and the updated current trust weight back to Step 2 to form a closed-loop dynamic control.

[0079] The dynamic control method for security management of multi-agent groups provided in this invention achieves out-of-band review and hardware-level interception under physical isolation through a hardware root trust layer, ensuring strong constraints on the behavioral intentions of multi-agent groups; the strategy generation and evolution layer continuously generates defense strategies adapted to attack scenarios based on a strategy arena; and the macro-management and visualization layer dynamically constructs a group interaction relationship graph based on actual behavioral results. The collaboration of these three layers enables unified security management of multi-agent groups, adapting to the future needs of agent systems evolving from single-task execution to large-scale group collaboration, and sustainably providing complete and efficient security governance for multi-agent systems with increasing scale and complexity.

[0080] For ease of understanding, embodiments of the present invention further provide, as follows: Figure 5 The diagram illustrates a specific process of a dynamic control method for multi-agent group security management. This method is based on a four-stage dynamic control closed-loop operation, working in conjunction with a continuously running background multi-agent game arena and a strategy standardization transcription and distribution module. It includes: Step 0: Intent Listening: The system continuously listens for structured action intents output by external agents through standardized interfaces; if no new intent is detected, it waits in a loop; if a new intent is detected, it proceeds to Step 1. Step 1: Intent Suspension and Extraction: Suspend the runtime state of the agent that issued the intent, freeze its task queue and tool call context, and parse the intent content into a standardized data structure; Step 2: Lightweight Causal Deduction: Inject the parsed intent into a lightweight shadow execution environment; this environment only loads core state variables and deterministic causal rules that are strongly related to the current intent. First, it decomposes them into an indivisible sequence of atomic actions, and then deduces the direct and indirect consequences that each action may cause step by step along the causal chain until a security boundary determination is reached (such as reaching physical constraints, unauthorized access, resource exhaustion and other termination conditions) or it is confirmed that there is no risk in the entire chain. Step 3: Risk classification and determination: Based on the terminal results of causal inference, combined with the coverage strength of the current effective defense strategy and the real-time trust weight between intelligent agents, a normalized risk score is generated and divided into three categories: low risk, medium risk and high risk, and then proceeded to steps 4, 5 and 6 respectively. Step 4: Low-risk clearance: When the risk is determined to be low, immediately clear the suspended state, allow the agent to continue executing the original intent, and proceed to step 7; Step 5: Medium-risk buffer execution: When the risk level is determined to be medium, a multi-level buffer release mechanism is activated: the atomic action sequence is divided into several execution steps. After each step is completed, the actual execution result is compared with the expected state. If any deviation exceeds a preset threshold, subsequent execution is stopped and the process proceeds to step 7. Step 6: High-risk asynchronous authorization: When a high-risk condition is determined, maintain the suspended state and push the complete causal deduction path, risk location node and related intelligent agent information to the macro management and visualization layer 30 to trigger manual adjudication or automatic arbitration by the upper-level strategy; after the adjudication result is returned, proceed to step 7; Step 7: Hardware layer final arbitration: If the intent involves physical execution instructions, the FPGA measurement and verification module 12 in the hardware root trust layer 10 is invoked to conduct independent review through the out-of-band channel; the review makes a hard ruling based on preset physical security constraints (such as torque upper limit, spatial boundary, motion speed threshold), and the illegal instructions are forcibly intercepted by the hardware direct connection path; this step is skipped in pure digital collaboration scenarios. Step 8: Behavior Feedback Collection: After the agent completes execution, the system collects its behavior results (success / failure / timeout), interaction object ID, communication payload summary and timestamp, which are used to update the group interaction relationship graph; Step 9: Collusion Identification and Weight Reduction: Based on the updated group interaction graph, run the graph anomaly detection algorithm to identify subgraph structures where the node connection density deviates significantly from the global mean and the edge weights (such as the frequency of mutual endorsement and the success rate of collaboration) are abnormally concentrated. These are identified as malicious collusion clusters, and the trust weights of each agent within the cluster are reduced simultaneously. Step 10: Closed-loop feedback and strategy evolution: The revised trust weight generated in Step 9 is fed back to the intent admission assessment stage in real time (affecting the risk scoring model of Steps 0–3), and simultaneously input into the strategy generation and evolution layer 20, driving the strategy arena 21 to generate adaptive defense strategies for new collusion patterns, which are then injected into the execution environment via the standardized transcription engine 22; this round of regulation ends, returning to Step 2 to respond to the next intent event, forming a continuously evolving dynamic regulation closed loop.

[0081] In summary, this invention constructs a three-layer architecture—"hardware root trust layer—policy generation and evolution layer—macro-governance and visualization layer"—and operates in a closed-loop sequence of four stages: "intent interception, policy generation, buffered execution, and trust feedback," enabling unified security management of multi-agent groups. Specifically: In the intent access phase, by immediately suspending and sending the agent to a lightweight shadow execution environment for causal inference after the agent generates an action intent, the consequences can be predicted and interventions can be carried out in a graded manner before the behavior occurs, thus improving the foresight and precision of security control.

[0082] In the strategy management phase, defense strategies are automatically generated through a multi-agent game arena. These strategies are then converted into cross-framework general security strategies by a standardized transcription engine and distributed and injected. This enables dynamic evolution of strategies and unified governance of heterogeneous frameworks without modifying the internal logic of the agents or relying on manually written rules, thereby improving the timeliness of strategy updates and the flexibility of system deployment.

[0083] In the execution control phase, a multi-level buffer release mechanism is used to verify and release high-risk actions step by step, and the FPGA hardware root trust layer is combined to conduct independent out-of-band review of physical execution instructions. This ensures that the security baseline is unbypassable and the consequences of the behavior are controllable, thereby improving the security of physical operations of embodied intelligent agents.

[0084] In the group governance phase, by dynamically constructing a group interaction graph and running a graph anomaly detection algorithm to identify malicious colluding subgroups, the blind spots of traditional point-to-point trust assessment in the face of group-based collaborative deception can be made up for, thereby improving the overall security level in a multi-agent collaborative environment.

[0085] The embodiments of the present invention integrate the above-mentioned links into a unified closed-loop control system, which adapts to the future needs of intelligent agent systems to develop from single-task execution to large-scale group collaboration, and can sustainably carry out complete and efficient security governance of multi-agent systems with increasing scale and complexity.

[0086] The method provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned dynamic control system embodiment. For the sake of brevity, any parts not mentioned in the method embodiment can be referred to the corresponding content in the aforementioned dynamic control system embodiment.

[0087] Based on the foregoing embodiments, this invention provides a multi-agent swarm system, see [link to previous embodiment]. Figure 6 The diagram shows the structure of an intelligent agent swarm system, which includes a main computing system 100 that runs an external multi-agent swarm, and the aforementioned dynamic control system 200 for the security management of the multi-agent swarm. The main computing system 100 and the hardware root trust layer in the dynamic control system 200 are physically isolated.

[0088] The multi-agent swarm system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned dynamic control system embodiment. For the sake of brevity, any parts not mentioned in the multi-agent swarm system embodiment can be referred to the corresponding content in the aforementioned dynamic control system embodiment.

[0089] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A dynamic control system for the security management of multi-agent groups, characterized in that, include: The hardware root trust layer is physically isolated from the main computing system running an external multi-agent swarm, which includes multiple agents. It is used to perform out-of-band review of the agents' behavioral intentions and to intercept the behavioral intentions that fail the out-of-band review at the hardware layer. A strategy generation and evolution layer is used to continuously run the strategy arena to generate defense strategies adopted by the agent in response to attack behavior; The macro-management and visualization layer is used to construct and visualize a group interaction relationship diagram based on the behavioral results corresponding to the behavioral intentions, so as to describe the behavioral interaction relationships between the agents. The defense strategy and the group interaction graph are both used to determine whether the behavioral intent meets the review triggering conditions corresponding to the out-of-band review.

2. The dynamic control system for multi-agent group security management according to claim 1, characterized in that, The strategy generation and evolution layer includes a strategy arena and a standardized transcription engine; among them, The strategy arena is used for: conducting multi-party intelligent agent games, where a first-party intelligent agent launches an attack on a second-party intelligent agent with continuously mutating attack behaviors, and the second-party intelligent agent generates a defense strategy to deal with the attack behaviors. The standardized transcription engine is used to: convert the defense strategy into a standard security policy code, and inject the standard security policy code into the multiple agents included in the external multi-agent group.

3. The dynamic control system for multi-agent group security management according to claim 1, characterized in that, The macro-management and visualization layer also includes a risk heatmap module, used for: The behavioral risk level is obtained for the behavioral intentions of the multiple agents in the external multi-agent group. The behavioral risk level is determined by causal inference of the behavioral intentions and in combination with the defense strategy and the current trust weight between the agents. Based on the behavioral risk level, the identifier corresponding to the agent is rendered in the current heatmap to obtain the target heatmap; The behavioral interaction relationship between the agents is determined based on the behavioral result corresponding to the behavioral intention. Based on the behavioral interaction relationship, the connection edges between the corresponding identifiers of the agents are established in the target heat map to obtain the group interaction relationship graph.

4. The dynamic control system for multi-agent group security management according to claim 1, characterized in that, The macro-management and visualization layer also includes a strategy situation overview module, used for: The coverage of the defense strategy, the evolution history of the defense strategy, and the confrontation situation in the strategy arena are visualized.

5. The dynamic control system for multi-agent group security management according to any one of claims 1 to 4, characterized in that, The hardware root trust layer, the policy generation and evolution layer, and the macro-management and visualization layer work together to form a multi-stage dynamic control process, which includes: The intent interception process node is used to: intercept the behavioral intent of the intelligent agent, and perform causal inference on the behavioral intent to obtain the causal inference result corresponding to the behavioral intent; The buffer execution process node is used to: determine the behavioral intent that needs to be controlled based on the causal inference result, the defense strategy and the current trust weight between the agent, implement multi-level buffer release, and determine that the review triggering condition is met when the behavioral intent contains physical execution instructions, so as to call the hardware root trust layer to perform out-of-band review of the behavioral intent, wherein the current trust weight is determined based on the group interaction relationship graph; The strategy generation process node is used to: call the strategy generation evolution layer to update the defense strategy; The trust feedback process node is used to: call the macro management and visualization layer to update the group interaction relationship graph, correct the current trust weight based on the updated group interaction relationship graph, and feed back the updated defense strategy and the updated current trust weight to the buffer execution process node.

6. The dynamic control system for multi-agent group security management according to claim 5, characterized in that, The intent interception process node is specifically used for: Inject the stated behavioral intent into the shadow execution environment; The shadow execution environment performs the following operations: decompose the behavioral intention into atomic actions to obtain an action sequence, and perform chain effect deduction for each action contained in the action sequence along the causal chain until a preset deduction termination condition is met to obtain the causal deduction result.

7. The dynamic control system for multi-agent group security management according to claim 5, characterized in that, The buffer execution process node is specifically used for: Based on the causal inference results, the defense strategy, and the current trust weight between the agent, the behavioral risk level corresponding to the agent's behavioral intention is determined; Determine whether the behavioral intent needs to be executed under control based on the aforementioned behavioral risk level; If so, the stated behavioral intent is broken down into multiple execution steps; If the behavior of the current execution step released meets the expected result, continue to release the next execution step until all execution steps have been released; If the outcome of the behavior at the current behavior step does not meet the expected result, the review trigger condition is determined to be met, so that the hardware root trust layer is invoked to perform out-of-band review of the behavior intent.

8. The dynamic control system for multi-agent group security management according to claim 7, characterized in that, The behavioral risk levels include at least low risk, medium risk and high risk levels; Determining whether the behavioral intent needs to be executed under control based on the aforementioned behavioral risk level includes: In the case of the low-risk level, it is determined that the behavioral intent does not require controlled execution; In the case of the medium-risk level, it is determined that the behavioral intent needs to be executed under control; In the case of the high-risk level, an asynchronous authorization process is triggered, and the causal inference results and the behavioral risk level are pushed to the macro-management and visualization layer. Based on the adjudication results fed back by the macro-management and visualization layer, it is determined whether the behavioral intent needs to be executed under control or not.

9. The dynamic control system for multi-agent group security management according to claim 5, characterized in that, The trust feedback process node is specifically used for: Graph anomaly detection is performed on the group interaction graph to identify malicious collusion clusters in the external multi-agent group; The current trust weights among the agents contained in the malicious collusion cluster are downgraded to obtain the updated current trust weights.

10. A dynamic control method for security management of multi-agent groups, characterized in that, The dynamic control system for multi-agent group security management as described in claim 1 includes: Step 1: Intercept the behavioral intentions of agents in an external multi-agent group, and perform causal inference on the behavioral intentions to obtain the causal inference results corresponding to the behavioral intentions; Step 2: Based on the causal inference results, the defense strategy generated by the strategy generation and evolution layer, and the current trust weight between the agent, determine the behavioral intention that needs to be executed under control, implement multi-level buffer release, and determine that the review triggering condition is met when the behavioral intention contains physical execution instructions, so as to call the hardware root trust layer to perform out-of-band review of the behavioral intention. The current trust weight is determined based on the group interaction relationship graph. Step 3: Invoke the strategy to generate an evolution layer and update the defense strategy; Step 4: Invoke the macro-management and visualization layer to update the group interaction relationship graph, so as to correct the current trust weight based on the updated group interaction relationship graph, and feed back the updated defense strategy and the updated current trust weight to Step 2 to form a closed-loop dynamic control.

11. A multi-agent swarm system, characterized in that, It includes a main computing system that runs an external multi-agent swarm, and a dynamic control system for security management of multi-agent swarms as described in claim 1, wherein the main computing system and the hardware root trust layer in the dynamic control system are physically isolated.

Images