AI 代理被授予对工具, API, 和其他基础设施, 的访问权限，使它们成为这些系统中的活跃主体。主要方法将控件放在代理的自己的运行时:系统提示,输出过滤器,和护栏库内。代理的 地址空间中的任何控制都可以通过影响它的输入来访问;，这可以推广到任何能够充分触及其自身运行时的 AI 系统,，我们将其称为可逃逸的 AI 系统。我们确定了授权机制必须满足体系结构控制而非协作请求的四个属性: 流程分离, 在结构上唯一的路径上执行预操作, 在请求和系统级别均进行故障关闭, 以及可在受控系统的 信任边界之外验证的外部化签名证据。我们将该层定位为执行时 AI 对齐,，补充训练时间对齐 (RLHF, 宪法 AI) 和推理时间对齐。我们提出了 Unfireable Safety Kernel,，这是一个实现所有四个功能的 Rust 参考实现。其故障关闭不变量在两个级别:、SMT 定理(Z3) 和生产决策函数(Kani, 4/4 线束) 的详尽有界模型检查证明上进行了机器检查。 Python 到 Rust 的迁移是在字节等效 (1000/1000 固定装置; 17/17 对抗类) 上进行的。我们评估管理实时,可逃逸AI系统,的内核，确定性,自我改进的世界模型,，以对抗寻求逃避的对手，在1,000个自我修改,上驱动其真正的自我修改接缝:，对安全关键核心的所有704次尝试都被拒绝,，没有逃逸;在操作员终止开关下的进一步300,也是拒绝了。 6,240 授权往返的单独活动没有成功绕过。针对 3 个声称代理控制平面, 的当代系统，代理在此处调用控制;,，它缺乏该选择。
AI agents are granted access to tools, APIs, and other infrastructure, making them active principals in those systems. The dominant approach places controls inside the agent的 own runtime: system prompts, output filters, and guardrail libraries. Any control in the agent的 address space is reachable by inputs that influence it; this generalizes to any AI system with sufficient reach into its own runtime, a class we term escapable AI systems. We identify four properties that an authorization mechanism must satisfy for architectural control rather than for cooperative requests: process separation, pre-action enforcement on a structurally only path, fail-closed at both the request and system levels, and externalized signed evidence verifiable outside the controlled system的 trust boundary. We position this layer as execution-time AI alignment, complementing training-time alignment (RLHF, Constitutional AI) and inference-time alignment. We present the Unfireable Safety Kernel, a Rust reference implementation realizing all four. Its fail-closed invariant is machine-checked at two levels: an SMT theorem (Z3) and an exhaustive bounded-model-checking proof of the production decision function (Kani, 4/4 harnesses). A Python-to-Rust migration was gated on byte-equivalence (1000/1000 fixtures; 17/17 adversarial classes). We evaluate the kernel governing a live, escapable AI system, a deterministic, self-improving world model, against an escape-seeking adversary driving its real self-modification seam: across 1,000 self-modifications, all 704 attempts on the safety-critical core are refused, with no escape; a further 300, under the operator kill switch, are also refused. A separate campaign of 6,240 authorization round-trips had no successful bypass. Against 3 contemporary systems claiming the agent control plane, the agent invokes control; here, it lacks that choice.
科目: 人工智能 (cs.AI); 密码学和安全 (cs.CR); 机器学习 (cs.LG)
Subjects: Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (cs.LG)