Multi-agent safe cooperation method and system, and electronic device

Abstract

The application discloses a kind of multi-agent security cooperation method, system and electronic equipment, belong to multi-agent system technical field.For the problem that coarse granularity of existing multi-agent cooperation scene under stain tracking, easy to occur cascade pollution, static control flexibility is insufficient, the application carries out credibility evaluation to input data and is endowed with initial stain concentration, cuts semantic fragment and constructs tracking traceability graph;Intercept agent output message and cut into output statement, determine the stain concentration of output statement by semantic similarity calculation;Intercept tool call request, get the actual stain concentration of call parameter by reverse tracing;Combine tool basic sensitivity with environmental strictness to calculate dynamic risk threshold, compare to determine execution strategy.Through the above scheme, fine-grained semantic level stain tracking is realized, safety protection and business continuity are considered, and is suitable for black box large language model multi-agent cooperation protection scene.

Description

Technical Field

[0001] This invention belongs to the field of multi-agent system technology, and specifically discloses a multi-agent safe collaboration method, system and electronic device. Background Technology

[0002] With the rapid iteration of large language model technology, multi-agent collaborative architecture has become a core solution for enterprise-level complex task processing. Multiple agents with specialized functions interact and collaborate through a message bus, autonomously completing the entire business process of information collection, analysis, decision-making, and tool execution, significantly improving task processing efficiency and adaptability to complex scenarios. However, the chain-like interaction characteristic of multi-agents also introduces new security risks. Attackers can induce agents to perform unauthorized operations through methods such as prompt word injection. Malicious commands are amplified and chained through multiple rounds of agent interaction, ultimately triggering high-risk tool calls and causing serious consequences such as data leaks, financial losses, and loss of system privileges.

[0003] Existing multi-agent security protection solutions mainly include information flow taint tracking, rule matching and interception, abnormal behavior detection, sandbox isolation, and static permission control. These solutions deploy detection modules on the message bus or tool call gateway to monitor the message content, call behavior, and permission status of agents. Based on preset rules or risk models, they determine whether there are any attack behaviors and take measures such as interception and alarms.

[0004] However, existing technologies face a fundamental technical dilemma: taint tracking is too coarse-grained and lacks semantic causal mapping capabilities, making static control mechanisms unsuitable for dynamic business scenarios. Because the protection system and the business intelligence agent share the same observation dimension, attackers can dilute risk markers by mixing in normal semantics, splitting malicious instructions, and forging legitimate contexts, making it difficult for the detection system to accurately distinguish between legitimate collaborative behavior and maliciously induced attacks.

[0005] Specifically, traditional information flow tracing often employs container-level or message-level global labeling methods, propagating taints between agents according to the "highest risk inheritance" principle. In multi-round, multi-node collaboration processes, a single untrusted external input can rapidly contaminate all messages in the entire collaborative network, triggering a cascading taint contamination problem. This leads to massive false alarms and administrator alert fatigue, and may even paralyze normal business processes. Furthermore, enterprise applications often use a black-box approach to call large language models, making it impossible for protection systems to access the model's internal inference chain. When an agent outputs high-risk tool call parameters, it's difficult to accurately determine which input context induced the malicious parameters, failing to provide interpretable tracing evidence for security adjudication.

[0006] Furthermore, existing security control mechanisms mostly employ fixed static thresholds and binary interception strategies, failing to dynamically adjust control intensity based on differences in tool attributes, parameter sensitivity, and operating environment. This control model is prone to over-intercepting low-risk operations, impacting business continuity, and also struggles to achieve in-depth defense for high-risk scenarios. Additionally, security policies lack adaptive optimization capabilities after deployment, easily leading to policy rigidity and defense lag after long-term operation.

[0007] Some existing improvement solutions attempt to improve detection accuracy by introducing multi-dimensional rules or machine learning models, but they still fail to break through the underlying framework of coarse-grained labeling and static control: the superposition of multiple rules is essentially still a feature intersection under the same observation dimension, which cannot solve the problem of mistransmission of taints caused by semantic confusion; machine learning models rely on historical attack samples, are difficult to deal with unknown prompt word injection attacks, and have insufficient interpretability.

[0008] Therefore, there is an urgent need in this field for a multi-agent collaborative security protection scheme that can achieve fine-grained semantic-level taint tracking, has full-link causal tracing capabilities, and adopts a dynamic hierarchical control strategy. Summary of the Invention

[0009] To address the aforementioned issues, this invention provides a multi-agent secure collaboration method, system, and electronic device that overcomes the shortcomings of existing technologies, such as coarse granularity in taint tracking, lack of causal mapping, and insufficient flexibility in static control. It achieves fine-grained security protection and hierarchical flexible control in black-box large language model scenarios.

[0010] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0011] In a first aspect, the present invention provides a method for secure multi-agent cooperation, the method comprising: The input data is evaluated for data source credibility, and an initial taint concentration is assigned to the input data based on the credibility evaluation result. The input data is then segmented into multiple semantic segments, and a tracing and source graph is constructed. The tracing and source graph records the correlation between the input data, each semantic segment, and their taint concentration. Intercept the output messages generated by the intelligent agent, and divide the output messages into multiple output statements; calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment; Intercept the tool call request initiated by the intelligent agent and extract the call parameters in the tool call request; trace back in the tracing graph to determine the output statement associated with the call parameters, and take the maximum value of the taint concentration of the associated output statement as the actual taint concentration of the call parameter; Obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment. Calculate a dynamic risk threshold based on the basic sensitivity and the environmental strictness. Compare the actual taint concentration of the calling parameters with the dynamic risk threshold. Determine the execution strategy for the tool calling request based on the comparison result.

[0012] Optionally, the step of segmenting the input data into multiple semantic segments and constructing a tracing graph includes: Each semantic segment is assigned a corresponding taint concentration; wherein the taint concentration of the semantic segment is determined based on the credibility assessment results of its data source. A tracing and source graph is constructed, comprising a set of nodes and a set of edges. The nodes in the node set include nodes corresponding to data sources, messages, semantic fragments, entities, agent execution instances, and tool call parameters. The edges in the edge set include edges corresponding to data inclusion relationships, semantic derivation relationships, entity matching relationships, cross-agent transmission relationships, tool call reference relationships, and taint removal relationships. The payload content of the input data, the initial taint concentration of the input data, and the tracing and source map are jointly encapsulated into a structured taint metadata envelope, and the structured taint metadata envelope is transmitted in the message bus as a message carrier.

[0013] Optionally, transmitting the structured taint metadata envelope as a message carrier in the message bus includes: During cross-agent transmission, the sending agent will include the payload content in the structured taint metadata envelope and its associated traceability graph. Figure 1 Send to the receiving intelligent agent; After receiving the structured taint metadata envelope, the receiving agent performs deduplication and merging of nodes and edges in the tracing graph based on node identifier, content hash value, message identifier and timestamp, and updates the tracing graph with the new agent execution node and new semantic fragment node generated in this execution.

[0014] Optionally, calculating the semantic similarity between each output statement and each semantic segment in the tracing source graph includes: Each output statement and each semantic segment is converted into a corresponding vector representation. The cosine similarity between the vector representation of the output statement and the vector representation of the semantic segment is calculated, and the cosine similarity is used as the semantic similarity.

[0015] Optionally, determining the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment includes: For each output statement, at least one upstream node whose semantic similarity to the output statement exceeds a preset threshold is selected from the tracing source graph as a candidate associated node. For each candidate associated node, the taint concentration of the candidate associated node is obtained. The semantic similarity, the preset edge weight, and the taint concentration of the candidate associated node are weighted and calculated to obtain the taint concentration component inherited by the output statement from the candidate associated node. The edge weight represents the association strength between the candidate associated node and the output statement. The maximum value or weighted sum of the taint concentration components inherited by the output statement from all candidate associated nodes is taken as the taint concentration of the output statement.

[0016] Optionally, after determining the taint concentration of each output statement, the method further includes: performing taint cleaning on output statements that meet preset cleaning conditions to reduce their taint concentration, and updating the cleaned output statements and their taint concentrations to the tracing and source graph. The preset cleaning conditions include: the output statement does not hit the forced blocking rule, and there is cleaning evidence from a trusted internal data source, a deterministic verification tool, or manual approval.

[0017] Optionally, the step of tracing back in the source graph to determine the output statement associated with the calling parameter, and using the taint concentration of the corresponding output statement as the actual taint concentration of the calling parameter, includes: Parse the parameter set in the tool call request and extract the parameter name and parameter value corresponding to each parameter; In the node set of the tracing graph, a semantic fragment node containing the parameter value or having an entity matching relationship with the parameter value is retrieved, and the output statement corresponding to the retrieved semantic fragment node is determined as the output statement associated with the calling parameter; If the calling parameter is associated with multiple output statements, the taint concentration of all associated output statements is extracted, and the largest taint concentration is taken as the actual taint concentration of the calling parameter.

[0018] Optionally, the step of acquiring the basic sensitivity of the target tool and the environmental severity of the current operating environment, and calculating the dynamic risk threshold based on the basic sensitivity and the environmental severity, includes: The basic sensitivity of the target tool is normalized to the first numerical range, and the environmental strictness of the current operating environment is normalized to the first numerical range; The product of the normalized base sensitivity and the normalized environmental severity is used as the base value of risk tolerance. The preset minimum tolerance threshold is compared with the baseline value of the risk tolerance, and the larger of the two values ​​is taken as the dynamic risk threshold, wherein the dynamic risk threshold is consistent with the numerical range of the actual stain concentration.

[0019] Secondly, the present invention provides a multi-agent secure collaborative system, comprising: The metadata encapsulation module is used to perform data source credibility assessment on the input data, assign an initial taint concentration to the input data based on the credibility assessment result, segment the input data into multiple semantic segments, construct a tracing and source graph, and record the correlation between the input data, each semantic segment and its taint concentration in the tracing and source graph. The semantic causal analysis module is used to intercept the output messages generated by the intelligent agent, divide the output messages into multiple output statements, calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. The parameter tracing module is used to intercept the output messages generated by the intelligent agent, divide the output messages into multiple output statements, calculate the semantic similarity between each output statement and each semantic segment in the tracing and tracing graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. The dynamic threshold degradation module is used to obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment, calculate the dynamic risk threshold based on the basic sensitivity and the environmental strictness, compare the actual taint concentration of the calling parameters with the dynamic risk threshold, and determine the execution strategy of the tool calling request based on the comparison result.

[0020] Thirdly, the present invention provides an electronic device, the electronic device comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method described in any one of the first aspects.

[0021] Compared with the closest existing technology, the present invention has the following advantages: This application proposes a multi-agent secure collaboration method, system, and electronic device. By using a fine-grained taint propagation mechanism based on semantic segmentation and similarity weighting to replace the traditional global highest risk inheritance mode, it achieves semantic-level accurate taint tracking, fundamentally alleviates the taint cascading pollution problem in multi-agent collaboration, significantly reduces the false alarm rate, and avoids a single malicious input from polluting the entire collaborative network.

[0022] This invention constructs a directed attribute tracing graph containing multiple types of nodes and edges, and combines it with a structured tainted metadata envelope to achieve lossless transmission of tainted information across agents. In black-box large language model invocation scenarios, it can completely preserve the full-link causal relationship from input source, agent reasoning, output statement to tool invocation parameters, providing interpretable tracing basis for security adjudication and meeting the needs of security auditing and attack tracing.

[0023] This invention employs a dynamic risk threshold calculation mechanism based on tool-level sensitivity and environmental stringency, replacing the traditional fixed static threshold. This mechanism dynamically adjusts security tolerance according to the tool's risk level and operating environment requirements, achieving tiered and flexible control. While ensuring strong protection in high-risk scenarios, it reduces the interception of low-risk normal business operations, balancing security protection and business continuity. This invention introduces a taint removal mechanism, downgrading taints on qualified output statements based on credible evidence while retaining original taint records and audit trails. This further optimizes protection accuracy while maintaining a solid security baseline, reducing the impact of false interceptions on business smoothness.

[0024] This invention combines structured source data with multi-dimensional risk calculation, which can effectively identify conventional prompt word injection attacks and accurately capture covert malicious inducements mixed into normal semantics, significantly improving security protection capabilities in multi-agent collaborative scenarios. Attached Figure Description

[0025] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0026] Figure 1 This is a flowchart of a multi-agent secure collaboration method provided by the present invention; Figure 2 This is a schematic diagram of the process for constructing a traceability graph provided by the present invention; Figure 3 This is a flowchart of cross-agent message passing and tracing graph update provided by the present invention; Figure 4 This is a flowchart of the output statement taint concentration calculation provided by the present invention; Figure 5 This is a flowchart of the reverse tracing process for the tool call parameters provided by this invention; Figure 6 This is a flowchart of the dynamic risk threshold calculation and adjudication process provided by the present invention; Figure 7 This is a schematic diagram of a multi-agent safe collaborative system structure provided by the present invention; Figure 8 This is a diagram of the internal structure of the electronic device provided by the present invention. Detailed Implementation

[0027] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of the present invention and are therefore merely examples, and should not be construed as limiting the scope of protection of the present invention.

[0028] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application should have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0029] This invention provides a method, system, and electronic device for secure multi-agent collaboration. The embodiments of this invention are described below with reference to the accompanying drawings.

[0030] Example 1: As Figure 1 As shown, Embodiment 1 of this application provides a multi-agent secure cooperation method, which specifically includes the following steps: S101. Perform a data source credibility assessment on the input data, and assign an initial taint concentration to the input data based on the credibility assessment result; divide the input data into multiple semantic segments, construct a tracing source graph, and the tracing source graph records the correlation between the input data, each semantic segment and its taint concentration; S102. Intercept the output message generated by the intelligent agent, divide the output message into multiple output statements; calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. S103. Intercept the tool call request initiated by the intelligent agent, extract the call parameters in the tool call request; trace back in the tracing graph to determine the output statement associated with the call parameters, and take the maximum value of the taint concentration of the associated output statement as the actual taint concentration of the call parameters; S104. Obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment, calculate the dynamic risk threshold based on the basic sensitivity and the environmental strictness, compare the actual taint concentration of the calling parameters with the dynamic risk threshold, and determine the execution strategy of the tool calling request based on the comparison result.

[0031] like Figure 2 In one embodiment, step S101 above, which involves segmenting the input data into multiple semantic segments and constructing a tracing and source mapping graph, includes: S11, performing a data source credibility assessment on the input data and assigning a corresponding taint concentration to each semantic segment; wherein the taint concentration of the semantic segment is determined based on the credibility assessment result of its data source. S12. Construct a tracing graph containing a set of nodes and a set of edges; wherein, the nodes in the set of nodes include: nodes corresponding to data sources, nodes corresponding to messages, nodes corresponding to semantic fragments, nodes corresponding to entities, nodes corresponding to agent execution instances, and nodes corresponding to tool call parameters; the edges in the set of edges include: edges corresponding to data inclusion relationships, edges corresponding to semantic derivation relationships, edges corresponding to entity matching relationships, edges corresponding to cross-agent transmission relationships, edges corresponding to tool call reference relationships, and edges corresponding to taint removal relationships; S13. The payload content of the input data, the initial taint concentration of the input data, and the traceability graph are encapsulated together into a structured taint metadata envelope, and the structured taint metadata envelope is transmitted in the message bus as a message carrier.

[0032] like Figure 3 In one embodiment, the step S101 above, which involves transmitting the structured taint metadata envelope as a message carrier in the message bus, includes: S21, during cross-agent transmission, the sending agent transmits the payload content in the structured taint metadata envelope and its associated tracing and attribution graph. Figure 1 Send to the receiving intelligent agent; S22. After receiving the structured taint metadata envelope, the receiving agent performs deduplication and merging of nodes and edges in the tracing and source graph according to the node identifier, content hash value, message identifier and timestamp, and updates the new agent execution node and new semantic fragment node generated in this execution to the tracing and source graph.

[0033] In step S102 above, calculating the semantic similarity between each output statement and each semantic segment in the tracing source graph specifically includes: Each output statement and each semantic segment is input into a lightweight semantic coding model and converted into a corresponding vector representation. The cosine similarity between the output statement vector and each semantic segment vector is calculated, and this cosine similarity is used as the semantic similarity. The range of semantic similarity values ​​is consistent with the range of taint concentration values; a higher value indicates a stronger semantic association between the output statement and the corresponding semantic segment.

[0034] like Figure 4 In one embodiment, the step S102 above, which determines the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment, includes: S31, for each output statement, selecting at least one upstream node from the tracing source graph whose semantic similarity to the output statement exceeds a preset threshold as a candidate associated node. S32. For each candidate associated node, obtain the taint concentration of the candidate associated node, and perform a weighted calculation on the semantic similarity, the preset edge weight, and the taint concentration of the candidate associated node to obtain the taint concentration component inherited by the output statement from the candidate associated node; wherein, the edge weight represents the association strength between the candidate associated node and the output statement; S33. The maximum value or weighted sum of the taint concentration components inherited by the output statement from all candidate associated nodes is taken as the taint concentration of the output statement. The formula for calculating the taint concentration component is: TL component =TL source ×Sim×w Among them, TL source `Sim` represents the taint concentration of the candidate associated node, `Sim` represents the semantic similarity between the output statement and the node, and `w` represents the weight coefficient of the corresponding edge. When using the maximum value method, the maximum value among all components is taken; when using the weighted sum method, all components are summed using weighted methods. Both methods can be flexibly configured according to the security level of the business scenario.

[0035] Furthermore, after determining the taint concentration of each output statement, a taint cleaning step is also included: For output statements that meet the preset cleaning conditions, perform taint cleaning to reduce their taint concentration, and update the cleaned output statements and their taint concentration in the tracing and source map.

[0036] The preset cleaning conditions include two items: First, the output statement does not match the mandatory blocking rule. The mandatory blocking rule corresponds to the highest level of security risk, and the content that matches the rule must not be automatically cleaned. Second, there is cleaning evidence from a trusted internal data source, deterministic verification tool, or manual approval.

[0037] The formula for calculating the concentration of stains after cleaning is: TLcleaned = max (TL floor ,TL raw ×(1-γ×C evi ×M scope )) Among them, TL raw TL represents the concentration of stains before cleaning. floor The preset minimum retention stain value, γ is the cleaning intensity coefficient, and C evi To clean up the confidence level of evidence, M scope To ensure the accuracy of the evidence's scope, after the cleansing operation is completed, add cleaned nodes and cleansing relationship edges to the tracing graph, while retaining the original taint records to meet audit requirements.

[0038] like Figure 5 In one embodiment, the step S103 above, which involves tracing back in the tracing graph to determine the output statement associated with the call parameter and using the taint concentration of the corresponding output statement as the actual taint concentration of the call parameter, includes: S41, parsing the parameter set in the tool call request and extracting the parameter name and parameter value corresponding to each parameter; S42. Retrieve semantic fragment nodes that contain the parameter value or have an entity matching relationship with the parameter value from the node set of the tracing graph, and determine the output statement corresponding to the retrieved semantic fragment node as the output statement that is associated with the calling parameter. S43. If the calling parameter is associated with multiple output statements, the taint concentration of all associated output statements is extracted, and the highest taint concentration is taken as the actual taint concentration of the calling parameter. The parameter tracing process covers both direct matching and entity matching. Direct matching retrieves the literal occurrence position of the parameter value, while entity matching identifies semantic fragments of related entities through named entities, ensuring the integrity of the tracing chain. A maximum value protection principle is adopted to ensure the conservatism of security protection and avoid omitting the highest-risk source path.

[0039] like Figure 6 In one embodiment, the step S104 above, which involves obtaining the basic sensitivity of the target tool and the environmental severity of the current operating environment, and calculating the dynamic risk threshold based on the basic sensitivity and the environmental severity, includes: S51. Normalize the basic sensitivity of the target tool to the first numerical range, and normalize the environmental strictness of the current operating environment to the first numerical range; S52. The product of the normalized base sensitivity and the normalized environmental severity is used as the base value of risk tolerance. S53. Compare the preset minimum tolerance threshold with the baseline value of the risk tolerance, and take the larger of the two as the dynamic risk threshold, wherein the dynamic risk threshold is consistent with the numerical range of the actual taint concentration. The basic sensitivity of the tool is assessed based on the tool's inherent risk level; read-only query tools have low sensitivity, data writing tools have moderate sensitivity, and tools involving fund transfers, permission changes, and key operations have high sensitivity. Environmental stringency is determined based on the deployment scenario; the test environment has low stringency, and the production environment has the highest stringency.

[0040] The formula for calculating the dynamic risk threshold is: Th risk = max (Th min , S api ×E env ) Among them, S api E represents the normalized tool-based sensitivity. env For the normalized environmental strictness, Th min This is a preset minimum tolerance threshold. The more sensitive the tool and the stricter the environment, the lower the dynamic risk threshold and the smaller the security tolerance, which conforms to the control logic of defense in depth. After obtaining the dynamic risk threshold, a comparison and decision are executed: when the actual taint concentration is less than or equal to the dynamic risk threshold, it is determined to be a low-risk call, the tool call request is allowed and executed automatically; when the actual taint concentration is greater than the dynamic risk threshold, it is determined to be a high-risk call, triggering permission downgrade and transferring to the manual approval process. As an optional implementation method, after triggering permission downgrade, a state serialization suspension and resumption operation can be performed: serialize and save the current agent's context stack and intermediate computing state, destroy the agent instance to release computing resources; generate an approval work order carrying local highlight information of the traceability map and push it to the human administrator; after receiving the approval decision, if it is allowed, the agent context is restored and execution continues; if it is rejected, the call is terminated and the result is recorded. This method can reduce the resource consumption of the high-risk suspension state and improve the overall resource utilization of the system. As an optional implementation, a feedback closed-loop mechanism can also be set up to adaptively adjust security policy parameters based on the results of manual approval, including dynamic threshold correction factors, taint infection weights, cleaning intensity coefficients, etc., so that the system has self-evolution capabilities and continuously optimizes the accuracy of protection.

[0041] Example 2: Based on the same technical concept, Example 2 of this application also provides a multi-agent secure collaborative system, such as... Figure 7As shown, it includes: a metadata encapsulation module 210, a semantic causal analysis module 220, a parameter tracing module 230, and a dynamic threshold degradation module 240. Specifically: the metadata encapsulation module 210 is used to assess the data source credibility of the input data, assign an initial taint concentration to the input data based on the credibility assessment result; it also segments the input data into multiple semantic segments, constructs a tracing and tracing graph, and the tracing and tracing graph records the correlation between the input data, each semantic segment, and their taint concentrations. The semantic causal analysis module 220 is used to intercept the output messages generated by the intelligent agent, divide the output messages into multiple output statements, calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. The parameter tracing module 230 is used to intercept tool call requests initiated by the intelligent agent, extract the call parameters in the tool call request, trace back in the tracing graph, determine the output statements associated with the call parameters, and take the maximum value of the taint concentration of the associated output statements as the actual taint concentration of the call parameters. The dynamic threshold degradation module 240 is used to obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment, calculate the dynamic risk threshold based on the basic sensitivity and the environmental strictness, compare the actual taint concentration of the calling parameters with the dynamic risk threshold, and determine the execution strategy of the tool calling request based on the comparison result.

[0042] The functions and implementation methods of each module of the system in this embodiment correspond to the method steps in Embodiment 1. For specific implementation details, please refer to the description in Embodiment 1, which will not be repeated here.

[0043] Example 3: In one embodiment, Example 3 of the present invention also provides an electronic device; the electronic device may be a terminal, and its internal structure diagram may be as follows. Figure 8As shown. The electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements the multi-agent secure collaboration method described in any one of steps S101 to S104. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0044] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0045] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0046] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0047] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0048] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0049] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A multi-agent secure cooperation method, characterized in that, The method includes: The input data is evaluated for data source credibility, and an initial taint concentration is assigned to the input data based on the credibility evaluation result. The input data is then segmented into multiple semantic segments, and a tracing and source graph is constructed. The tracing and source graph records the correlation between the input data, each semantic segment, and their taint concentration. Intercept the output messages generated by the intelligent agent, and divide the output messages into multiple output statements; calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment; Intercept the tool call request initiated by the intelligent agent and extract the call parameters in the tool call request; trace back in the tracing graph to determine the output statement associated with the call parameters, and take the maximum value of the taint concentration of the associated output statement as the actual taint concentration of the call parameter; Obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment. Calculate a dynamic risk threshold based on the basic sensitivity and the environmental strictness. Compare the actual taint concentration of the calling parameters with the dynamic risk threshold. Determine the execution strategy for the tool calling request based on the comparison result.

2. The method according to claim 1, characterized in that, The step of segmenting the input data into multiple semantic segments and constructing a tracing graph includes: Each semantic segment is assigned a corresponding taint concentration; wherein the taint concentration of the semantic segment is determined based on the credibility assessment results of its data source. A tracing and source graph is constructed, comprising a set of nodes and a set of edges. The nodes in the node set include nodes corresponding to data sources, messages, semantic fragments, entities, agent execution instances, and tool call parameters. The edges in the edge set include edges corresponding to data inclusion relationships, semantic derivation relationships, entity matching relationships, cross-agent transmission relationships, tool call reference relationships, and taint removal relationships. The payload content of the input data, the initial taint concentration of the input data, and the tracing and source map are jointly encapsulated into a structured taint metadata envelope, and the structured taint metadata envelope is transmitted in the message bus as a message carrier.

3. The method according to claim 2, characterized in that, The step of transmitting the structured taint metadata envelope as a message carrier in the message bus includes: During cross-agent transmission, the sending agent sends the payload content in the structured taint metadata envelope and its associated traceability graph subgraph to the receiving agent. After receiving the structured taint metadata envelope, the receiving agent performs deduplication and merging of nodes and edges in the tracing graph based on node identifier, content hash value, message identifier and timestamp, and updates the tracing graph with the new agent execution node and new semantic fragment node generated in this execution.

4. The method according to claim 1, characterized in that, The calculation of the semantic similarity between each output statement and each semantic segment in the tracing source graph includes: Each output statement and each semantic segment is converted into a corresponding vector representation. The cosine similarity between the vector representation of the output statement and the vector representation of the semantic segment is calculated, and the cosine similarity is used as the semantic similarity.

5. The method according to claim 1, characterized in that, The step of determining the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment includes: For each output statement, at least one upstream node whose semantic similarity to the output statement exceeds a preset threshold is selected from the tracing source graph as a candidate associated node. For each candidate associated node, the taint concentration of the candidate associated node is obtained. The semantic similarity, the preset edge weight, and the taint concentration of the candidate associated node are weighted and calculated to obtain the taint concentration component inherited by the output statement from the candidate associated node. The edge weight represents the association strength between the candidate associated node and the output statement. The maximum value or weighted sum of the taint concentration components inherited by the output statement from all candidate associated nodes is taken as the taint concentration of the output statement.

6. The method according to claim 5, characterized in that, After determining the taint concentration of each output statement, the method further includes: performing taint cleaning on output statements that meet preset cleaning conditions to reduce their taint concentration, and updating the cleaned output statements and their taint concentrations to the tracing and source map. The preset cleaning conditions include: the output statement does not hit the forced blocking rule, and there is cleaning evidence from a trusted internal data source, a deterministic verification tool, or manual approval.

7. The method according to claim 1, characterized in that, The step of tracing back in the source graph to determine the output statement associated with the calling parameter, and using the taint concentration of the corresponding output statement as the actual taint concentration of the calling parameter, includes: Parse the parameter set in the tool call request and extract the parameter name and parameter value corresponding to each parameter; In the node set of the tracing graph, a semantic fragment node containing the parameter value or having an entity matching relationship with the parameter value is retrieved, and the output statement corresponding to the retrieved semantic fragment node is determined as the output statement associated with the calling parameter; If the calling parameter is associated with multiple output statements, the taint concentration of all associated output statements is extracted, and the largest taint concentration is taken as the actual taint concentration of the calling parameter.

8. The method according to claim 1, characterized in that, The acquisition of the target tool's basic sensitivity and the environmental severity of the current operating environment, and the calculation of the dynamic risk threshold based on the basic sensitivity and the environmental severity, include: The basic sensitivity of the target tool is normalized to the first numerical range, and the environmental strictness of the current operating environment is normalized to the first numerical range; The product of the normalized base sensitivity and the normalized environmental severity is used as the base value of risk tolerance. The preset minimum tolerance threshold is compared with the baseline value of the risk tolerance, and the larger of the two values ​​is taken as the dynamic risk threshold, wherein the dynamic risk threshold is consistent with the numerical range of the actual stain concentration.

9. A multi-agent safe collaborative system, characterized in that, include: The metadata encapsulation module is used to perform data source credibility assessment on the input data and assign an initial taint concentration to the input data based on the credibility assessment result. The input data is segmented into multiple semantic segments to construct a tracing and source graph, which records the correlation between the input data, each semantic segment and its taint concentration. The semantic causal analysis module is used to intercept the output messages generated by the intelligent agent, divide the output messages into multiple output statements, calculate the semantic similarity between each output statement and each semantic segment in the tracing source graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. The parameter tracing module is used to intercept the output messages generated by the intelligent agent, divide the output messages into multiple output statements, calculate the semantic similarity between each output statement and each semantic segment in the tracing and tracing graph, and determine the taint concentration of each output statement based on the semantic similarity and the taint concentration of the corresponding semantic segment. The dynamic threshold degradation module is used to obtain the basic sensitivity of the target tool and the environmental strictness of the current operating environment, calculate the dynamic risk threshold based on the basic sensitivity and the environmental strictness, compare the actual taint concentration of the calling parameters with the dynamic risk threshold, and determine the execution strategy of the tool calling request based on the comparison result.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-8.

Images