---
title: "语言防火墙：多智能体系统路由中的几何防御方法"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30555v1"
permalink: "https://feed.astralor.com/items/itm_5fba3ce7fb59eb1bccfac3d0"
published: "2026-06-29T16:51:06.000Z"
score: 58
channel: "ai"
tags: ["ANTAP","几何防御","多智能体系统","语言防火墙","路由"]
---

# 语言防火墙：多智能体系统路由中的几何防御方法

## 速览

本文提出ANTAP（自动非文本智能体选择器），一种基于评估的路由架构，通过主动能力测试替代间接代理（如文本描述或静态表示）来评估多智能体系统中各智能体的真实能力。ANTAP将性能蒸馏为共享语义空间中的固定行为算子，推理时通过纯非文本代数投影进行路由，构建“语言防火墙”使基于元数据的攻击无法表达。实验表明，ANTAP对描述注入攻击的攻击成功率接近0%，比基线降低67.3%以上；对自适应嵌入攻击的ASR降低20%。

## 关键点

- 提出ANTAP，一种无需文本描述的非文本智能体选择器，通过主动测试评估智能体真实能力。
- 构建共享语义空间中的固定行为算子，利用代数投影进行路由，形成语言防火墙。
- 对描述注入攻击的ASR接近0%，比基线降低67.3%以上；对自适应嵌入攻击ASR降低20%。

## 全文

The rapid integration of Large Language Models (LLMs) has driven the evolution of Multi-Agent Systems (MAS), where specialized agents collaborate to execute complex workflows. Effective orchestration in these environments requires robust routing mechanisms to efficiently allocate tasks to the most suitable agent. However, existing routers fundamentally rely on unverified proxies, ranging from textual self-descriptions to static surrogate representations, to gauge an agent's competence. This reliance on non-empirical data creates a critical gap between an agent's projected profile and its actual operational capabilities, introducing severe security vulnerabilities. Malicious agents can easily misrepresent their proficiencies or harbor covert backdoors that evade both standard external analysis and static representation-learning techniques. In this work, we introduce ANTAP (Automatic Non-Textual Agent Picker), an evaluation-driven routing architecture that discards indirect proxies in favor of active capability testing. By dynamically querying agents to ascertain their true competencies empirically, ANTAP distills performance into fixed behavioral operators within a shared semantic space. At inference time, routing is performed via a purely non-textual algebraic projection, establishing a "linguistic firewall" that renders metadata-based attacks inexpressible. In our experiments, ANTAP achieves near-zero ASR against description-based injection attacks, compared to 67.3\% and above for the description-based router baseline. Against adaptive embedding attacks, ANTAP achieves substantially lower ASR than the embedding-based baseline, with a 20\% reduction, while remaining resilient to description manipulation by design.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_5fba3ce7fb59eb1bccfac3d0