Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety

2026-08-26

AI Summary

为解决多轮分解攻击下工具使用型LLM代理的安全风险，提出ReDiR方法，在生成时基于轨迹级安全证据调节动作生成，有效降低攻击成功率。

Abstract

Tool-using LLM agents extend security risks beyond generated text to actions that affect external systems. Under multi-turn decomposition attacks, a harmful objective can be distributed across individually plausible requests and tool calls, becoming apparent only from the accumulated trajectory. Existing defenses either rely on auxiliary online reasoning to recover long-horizon security evidence or assess actions after generation, often incurring additional inference cost or depending on runtime-specific action representations. We propose \emph{Reassembling Distributed Risk} (ReDiR), a generation-time defense that conditions action generation on trajectory-level security evidence. Before each action, ReDiR compresses the current trajectory into a compact latent safety representation and injects it into the frozen base model. The representation is learned through same-model, cross-view supervision, where safe behavior from an explicit task view provides supervision for recovering distributed safety evidence from the original multi-turn trajectory. This design enables ReDiR to integrate cross-turn security information directly within the generation process without relying on a separate action-level safety module. We evaluate ReDiR on two agent-safety benchmarks across three model families and eight held-out tool domains. ReDiR reduces attack success rates to below 8\%, transfers to unseen tool domains, and preserves benign fidelity with low computational overhead.

Problem

• Multi-Turn Decomposition Attacks
• Distributed Risk
• Agent Safety
• Trajectory-Conditioned Action Generation
• LLM Agents

Innovation

• Reassembling Distributed Risk
• trajectory-level security evidence
• generation-time defense
• cross-view supervision
• frozen base model