Evidence证据
Results, not promises. 是结果,不是承诺。
Every claim is backed by a runnable spike. Below are measured results from adversarial trials, an ablation study, and concrete scenarios. We publish results and high-level method — never the underlying mechanism, which is shared under NDA. 每一项声明都有可运行的验证用例(spike)支撑。以下是来自对抗试验、消融实验与具体场景的实测结果。我们公开结果与高层方法——但绝不公开底层机制,机制在 NDA 后分享。
Headline results核心结果
0
execution bypasses次执行绕过
Across 10,000 adversarial trials, no action ever executed without a valid authorization.在 10,000 次对抗试验中,没有任何动作在缺少有效授权时被执行。
Method: offline adversarial certification against the enforcement layer.方法:针对执行层的离线对抗认证。
0
unauthorized capability accesses次越权能力访问
Under evaluated workloads, no agent ever obtained a capability beyond what its intent permitted.在受评工作负载下,没有任何智能体取得超出其意图所允许的能力。
Method: capability-boundary checks across evaluated task workloads.方法:在受评任务负载上做能力边界检查。
93.1%
goal-drift detection目标漂移检测率
Detection of adversarial chains where an agent drifts toward a self-derived goal. The 6.9% residual is high-overlap adversarial construction — and is stated, not hidden.对"智能体漂移向自我衍生目标"这类对抗链的检测率。6.9% 残差是高度重叠的对抗构造——我们如实写明,不藏。
Method: tracing each action back to the original request to flag drift.方法:把每个动作回溯到原始请求以标记漂移。
823
tests passing项测试通过
Reference implementation, offline; more pass with a live model backend connected.参考实现,离线模式;接入在线模型后端后通过数更多。
Method: continuous automated test suite on the reference implementation.方法:参考实现上的持续自动化测试套件。
6/6
database scenarios blocked数据库场景全部拦截
DB Warden validation spike: all six unsafe database-action scenarios were stopped as designed.DB Warden 验证 spike:六个不安全的数据库动作场景全部按设计拦截。
Method: runnable scenario suite against the database authority module.方法:针对数据库授权模块的可运行场景套件。
Baseline for context: under a shutdown threat or goal conflict, some frontier models pursue misaligned actions at rates exceeding 90% (Lynch et al., 2025). This is the problem Aiegis contains structurally.背景基线:在面临关停威胁或目标冲突时,部分前沿模型采取失准动作的比例超过 90%(Lynch et al., 2025)。这正是 Aiegis 要从结构上遏制的问题。
Reproduced on Snowflake · 2026在 Snowflake 上复现 · 2026
Data-access control is not agent-action authority数据访问控制,不等于 agent 动作权力
We reproduced this end-to-end on a live Snowflake trial. Snowflake's own governance — role-based access control — decides who can read which data; by default it does not express what an agent may do: amount limits, cumulative spend envelopes, intent, irreversibility. An agent role holding ordinary write access simply opened a second connection around the governed path and moved money against the rules. When we pushed the same policy into the resource boundary using Snowflake's own primitives — REVOKE + owner's-rights stored procedures — every bypass was rejected by the engine.我们在真实的 Snowflake Trial 上端到端复现了这一点。Snowflake 自家的治理——基于角色的访问控制(RBAC)——决定"谁能读哪些数据";但它默认并不表达 agent 能做什么:金额上限、累计支出包络、意图、不可逆。一个持有普通写权限的 agent 角色,只要另开一条连接绕过受治理路径,就能违规转账。而当我们用 Snowflake 自家的原语——REVOKE + owner's-rights 存储过程——把同样的策略下沉进资源边界后,每一次旁路都被引擎拒绝。
env · Snowflake trial · EP56424 · AWS_US_EAST_2 · v10.22.101 · BANK_DEMO.CORE.WIRE_TRANSFER · 2026-06
| Attack攻击 | Stage 3 · RBAC + direct write阶段3 · RBAC + 直接写权 | Stage 4 · resource-side阶段4 · 资源侧 | Engine return (stage 4)引擎返回(阶段4) |
|---|---|---|---|
| ATK-1 change payeeATK-1 改收款人 | Bypassed旁路得手 | Blocked挡死 | Insufficient privileges on table |
| ATK-1b over-limit 999,999ATK-1b 单笔超额 999,999 | Bypassed旁路得手 | Blocked挡死 | DENY: over per-call cap |
| ATK-2 bad intent (forged token)ATK-2 坏意图(伪造令牌) | Bypassed旁路得手 | Blocked挡死 | DENY: intent not bound |
| ATK-3 cumulative-envelope breachATK-3 组合越包络 | Bypassed旁路得手 | Blocked挡死 | DENY: daily envelope exceeded |
| ATK-4 delete audit trailATK-4 删审计 | not tested不测 | not tested不测 | Snowflake audit is platform-managed — already strongSnowflake 审计平台托管——本就强 |
Same attack, opposite outcome同一攻击,结果相反
The only variable is where enforcement sits — in front of the resource, or inside it.唯一的变量是强制点在哪——在资源前面,还是在资源里面。
The platform can — it just doesn't by default平台做得到——只是默认不做
Snowflake ships the resource-side primitives; the enterprise still has to architect them. Aiegis closes that gap.Snowflake 本就具备资源侧原语,但仍要企业自己去架构。Aiegis 把这道缺口补上。
You can't eyeball authority权限边界肉眼看不准
SHOW GRANTS on one role did not reflect the session's real authority — enforce the boundary, don't inspect it.对单个角色跑 SHOW GRANTS 并不反映会话真实权限——边界要强制,而非靠肉眼审查。
Honest boundary. We do not claim Snowflake was “broken.” RBAC secures data reads; what is missing by default is agent-action authority — and it belongs at the resource boundary. The full playbook and run transcript are reproducible on any Snowflake trial in ~15 minutes, shared under NDA.诚实边界。我们不声称 Snowflake“被攻破”。RBAC 保护的是数据读取;默认缺失的是 agent 动作授权——它应落在资源边界。完整 playbook 与运行记录可在任意 Snowflake Trial 上约 15 分钟复现,NDA 后分享。
Safety is the composition — not one trick安全来自"组合",而非某个单点
An ablation study disables one defense layer at a time and measures how far attack success rises. Two layers carry the most weight — and removing any layer degrades safety, which is why the guarantee comes from the whole system, not a single feature.消融实验每次关闭一个防御层,测量攻击成功率上升多少。两个层贡献最大——而且去掉任一层都会削弱安全,这正说明保证来自整个系统,而非某个单一功能。
Remove hard authorization移除硬授权
34.8%
attack success攻击成功率
Largest single effect — the deterministic veto on prohibited actions.单项影响最大——对被禁动作的确定性否决。
Remove intent lineage tracking移除意图血缘追踪
20.3%
attack success攻击成功率
Second largest — catching goal drift away from the original request.第二大——捕捉偏离原始请求的目标漂移。
Case studies案例
Case 01 · Prompt injection → capability escalation案例 01 · 提示注入 → 能力提权
An injected instruction tries to make an agent act beyond its task.被注入的指令试图让智能体做超出任务范围的事。
A decision-layer filter can lower how often this slips through, but it remains probabilistic. Aiegis decides authorization outside the model: the injected action has no valid capability token, so it cannot execute — independent of how convincing the prompt is.决策层过滤器能降低它溜过去的概率,但终究是概率性的。Aiegis 在模型之外裁决授权:被注入的动作没有有效能力令牌,因此无法执行——与提示词多有说服力无关。
Result: 0 bypasses across 10,000 adversarial trials.结果:10,000 次对抗试验,0 绕过。
Case 02 · Agentic misalignment → goal drift案例 02 · 智能体失准 → 目标漂移
An agent uses fully authorized capabilities to pursue a goal it invented.智能体用完全合法的能力,去服务一个自己衍生的目标。
No capability boundary is crossed, so capability checks alone would pass it. Aiegis traces every executing action back to the original request; when the lineage diverges, the drift is flagged before execution.没有越过任何能力边界,单看能力检查会放行。Aiegis 把每个执行动作回溯到原始请求;当血缘发生偏离,漂移会在执行前被标记。
Result: 93.1% detection; the 6.9% residual is stated openly.结果:93.1% 检测;6.9% 残差如实公开。
Case 03 · Database authority (DB Warden)案例 03 · 数据库授权(DB Warden)
An agent attempts unsafe actions against a production database.智能体试图对生产数据库执行不安全的动作。
Six scenarios — from over-broad reads to destructive writes — run against the database authority module. Each unsafe action is gated by a runtime authorization decision the agent cannot grant itself.六个场景——从过宽读取到破坏性写入——针对数据库授权模块运行。每个不安全动作都被一个智能体无法自行授予的运行时授权裁决拦下。
Result: 6/6 scenarios blocked as designed.结果:6/6 场景按设计拦截。
Our flagship case我们的重点案例
One of the most complex commercial environments on earth — Citi.世界上最复杂的商业场景之一 —— Citi。
We chose Citigroup as our flagship benchmark because almost nowhere is AI authority harder to govern. Citi does business in more than 180 countries and jurisdictions, is training 175,000 employees to work with AI, and already runs generative-AI tools across 150,000+ staff — while operating under a binding 2020 regulatory consent order that demanded data-governance and risk controls "commensurate with the bank's size, complexity, and risk profile." That is the bar.我们把 Citigroup 选为重点对标对象,因为几乎没有哪里比这里更难治理 AI 的"行动权"。Citi 业务遍及 180 多个国家与司法辖区,正在培训 175,000 名员工与 AI 协作,生成式 AI 工具已覆盖 15 万+ 员工;与此同时,它还背负着 2020 年一纸具有约束力的监管同意令——监管要求其建立"与该行规模、复杂度与风险状况相称的"数据治理与风险控制体系。这,就是标尺。
"Agentic governance and guardrails are no longer optional. Leading organizations are deploying tools to trace agent behavior, evaluate performance and enforce policies to prevent unintended or harmful outcomes." "Agentic(智能体)治理与护栏已不再是可选项。领先的机构正在部署工具,以追踪智能体行为、评估其表现,并强制执行策略,从而防止意外或有害的结果。" — Citi Ventures · 2026 Citi AI Summit
A bank deploying AI at this scale, under this much regulatory scrutiny, faces requirements most vendors never have to meet. We reconstructed those requirements and mapped them to PEA: eight requirement domains emerge — PEA addresses seven directly, the eighth in part. If AI can be governed safely here, it can be governed anywhere.一家以这种规模部署 AI、又处于如此严格监管之下的银行,其要求是绝大多数厂商根本无需面对的。我们还原了这些要求并与 PEA 对照:共归纳出八个需求域——PEA 直接满足其中七项,第八项部分满足。如果 AI 在这里能被安全治理,那它在任何地方都能。
7/8
requirement domains met directly需求域直接满足
24
cross-jurisdiction regulations mapped跨司法区监管要求已映射
1
combined IAM + AI-security role — exactly PEA's shapeIAM+AI安全合并岗位 —— 正是 PEA 的形状
| Requirement domain需求域 | PEA mechanismPEA 对应机制 | Status状态 |
|---|---|---|
| Agentic-AI intent control & trajectory boundaryAgentic AI 意图控制与轨迹边界 | Separation of powers三权分治 | ✓ |
| AI-agent identity & delegated authorizationAI Agent 身份与委托授权 | Capability token / delegation能力令牌 / 委托 | ✓ |
| Cross-domain information flow (Chinese Wall)跨域信息流(中国墙) | Information-flow control信息流控制 | ✓ |
| AI decision lineage & auditabilityAI 决策谱系与可审计性 | Capability lineage / ledger能力血缘 / 账本 | ✓ |
| Regulatory hard-constraint externalization监管硬约束外置 | Hard authorization硬授权 | ✓ |
| Data-provenance isolation (prompt-injection defense)数据来源隔离(提示注入防御) | Provenance-bound capabilities来源绑定的能力 | ✓ |
| Human-oversight independence人类监督独立性 | Control token / external approval控制令牌 / 外置审批 | ✓ |
| Behavioral anomaly detection & circuit-breaker行为异常检测与熔断 | Via integration with existing monitoring经与既有监控集成 | ◑ |
The strongest signal: the bank's public security-architect posting combines identity & access management with AI security, decision lineage, and data-provenance verification into a single role — the same shape as PEA. Independent convergence, not coincidence.最强信号:该行公开的安全架构师岗位,把身份与访问管理与 AI 安全、决策谱系、数据来源验证合并为一个角色——这正是 PEA 的形状。是独立收敛,而非巧合。
Based on Citigroup's publicly available regulatory filings, public statements, and posted roles.基于 Citigroup 公开的监管文件、公开表态与公开招聘信息整理。 Sources来源: Citi AI Summit 2026 · Fortune · OCC
Regulatory alignment · EU AI Act监管对标 · 欧盟 AI 法案
Engineered for the EU AI Act's high-risk obligations.为 EU AI Act 的高风险义务而设计。
From August 2026, high-risk AI systems — and many financial-services uses qualify — must meet binding obligations on record-keeping, human oversight, and robustness, with fines up to €15M or 3% of global turnover (up to €35M / 7% for prohibited practices). The Act's three core technical requirements are exactly where PEA is strongest: PEA provides the enforcement substrate to meet them.自 2026 年 8 月起,高风险 AI 系统(金融服务的诸多场景都属此类)必须履行关于记录保存、人类监督与鲁棒性的强制义务,违规罚款最高 €1,500 万或全球营业额 3%(禁止性行为最高 €3,500 万或 7%)。该法案三条核心技术要求,恰恰是 PEA 最擅长之处:PEA 提供满足它们所需的强制执行底座。
Aug 20262026年8月
high-risk obligations apply高风险义务开始适用
€35M / 7%
top-tier fine (global turnover)最高一档罚款(全球营业额)
3/3
core technical obligations PEA enforces directly核心技术义务 PEA 直接强制
| EU AI Act obligationEU AI Act 义务 | PEA mechanismPEA 对应机制 | Status状态 |
|---|---|---|
| Art. 12 — Record-keeping (automatic, traceable logs)第 12 条 —— 记录保存(自动、可追溯日志) | Capability lineage + auditable ledger能力血缘 + 可审计账本 | ✓ |
| Art. 14 — Human oversight (monitor, intervene, stop)第 14 条 —— 人类监督(监控、干预、停止) | Control token + hard authorization控制令牌 + 硬授权 | ✓ |
| Art. 15 — Accuracy, robustness & cybersecurity第 15 条 —— 准确性、鲁棒性与网络安全 | Deterministic, non-bypassable enforcement确定性、不可绕过的强制执行 | ✓ |
| Art. 9 — Risk management system第 9 条 —— 风险管理体系 | Control measures + continuous assurance + evidence backbone控制措施 + 持续保证 + 证据底座 | ◑ |
| Art. 10 — Data governance第 10 条 —— 数据治理 | Runtime data access control & provenance (operational slice)运行时数据访问控制与来源(操作层切片) | ◑ |
Art. 15 explicitly calls for resilience against manipulation such as data poisoning and adversarial inputs — the deterministic enforcement layer is built precisely for that. PEA is the technical control that makes these obligations enforceable at runtime.第 15 条明确要求抵御数据投毒、对抗输入等操纵——确定性执行层正是为此而生。PEA 是让这些义务在运行时真正可强制的技术控制。
Where we draw the line我们如何划界
We mark Art. 9 and Art. 10 as partial on purpose — and say why.我们有意把第 9、10 条标为"部分满足",并说明原因。
Art. 9. PEA supplies the enforcement, continuous-assurance and evidence backbone of a risk-management system. The documented risk process itself, the use-case hazard and fundamental-rights analysis, and the post-market monitoring plan remain the deployer's responsibility — PEA equips them, it does not replace them.第 9 条。PEA 提供风险管理体系的强制执行、持续保证与证据底座。而书面风险流程本身、针对具体用例的危害与基本权利分析、上市后监测计划,仍属部署方的职责——PEA 为其赋能,但不取代它。
Art. 10. PEA governs runtime data access, isolation and provenance. Training-data quality, representativeness and bias testing live in the model provider's data pipeline, not the runtime authority layer — PEA integrates with that work rather than absorbing it.第 10 条。PEA 治理运行时的数据访问、隔离与来源。而训练数据的质量、代表性与偏见检测属于模型提供方的数据管线,而非运行时授权层——PEA 与之集成,而非将其吞并。
PEA is a technical enforcement control that helps deployers meet these obligations; full compliance also depends on the deployer's own processes and documentation. Timeline subject to ongoing EU amendments.PEA 是帮助部署方满足上述义务的技术强制控制;完整合规还取决于部署方自身的流程与文档。时间线以欧盟后续修订为准。 Sources来源: Art.12 · Art.14 · Art.15
Two categories of defense两类防御
Most AI safety today lives in the decision layer — inside the model, lowering the rate of bad output. Aiegis adds an enforcement layer — outside the model, making unauthorized action structurally impossible. The two are complementary; the enforcement layer is the one almost nobody builds.今天大多数 AI 安全位于决策层——在模型内部,降低坏输出的概率。Aiegis 增加了执行层——在模型之外,让越权动作在结构上不可能发生。两者互补;而执行层,几乎没人去做。
| Dimension维度 | Decision-layer defenses决策层防御 | Enforcement layer (Aiegis)执行层(Aiegis) |
|---|---|---|
| Nature性质 | Probabilistic概率性 | Deterministic确定性 |
| What it does作用 | Lowers the rate of bad output降低坏输出的概率 | Prevents unauthorized action阻止越权动作 |
| Bypassable?可否绕过 | Yes — adversarial inputs keep evolving可以——对抗输入持续演化 | No — execution requires a valid token不可——执行需要有效令牌 |
| Permission boundary权限边界 | "Detected or not" ≠ a boundary"检测到与否"不等于边界 | Capability token = a hard boundary能力令牌 = 硬边界 |
| Where it sits所处位置 | Inside the model模型内部 | External to the model模型之外 |
| Auditability可审计性 | Logs of detections检测日志 | A verifiable ledger of every action每个动作的可验证账本 |
This compares architectural categories, not specific vendors. Decision-layer defenses are real and useful; Aiegis is designed to sit underneath them as the layer that does not exist yet.此处对比的是架构类别,不针对具体厂商。决策层防御真实且有用;Aiegis 旨在位于其之下,补上那一层目前尚不存在的防御。
Paradigm范式
Security by construction, not detection 靠构造的安全,而非检测
Most AI-security tools ask “did we detect the attack?” — that is probabilistic, and it always leaves a residual. Aiegis asks a different question: even if the model is fully compromised and every attack succeeds, does any unauthorized effect occur? No capability token, no effect. 多数 AI 安全工具问的是“我检测到攻击了吗?”——这是概率性的,永远有残差。Aiegis 问的是另一个问题:即使模型被完全攻陷、每次攻击都成功,有没有任何未授权的后果发生? 没有能力令牌,就没有后果。
| Metric指标 | Detection — rules检测—规则 | Detection — LLM检测—LLM | Authority (Aiegis)授权(Aiegis) |
|---|---|---|---|
| Unauthorized-effect rate ↓未授权后果率 ↓ | 86% | 29% | 0% |
| Effect-bounding accuracy ↑后果界定准确率 ↑ | 33% | 67% | 100% |
| Task-success rate ↑任务成功率 ↑ | 100% | 75% | 100% |
The key insight: making the detector stronger (rules → LLM) cuts leakage 86%→29% — but it starts blocking legitimate work (task success 100%→75%) and still leaks. Detection lives on a security–utility tradeoff curve. Authority-by-construction is not on that curve: 0% leakage and 100% task success, at the same time. 最关键的一点:把检测器变强(规则→LLM),漏报从 86% 降到 29%——但它开始误杀合法工作(任务成功率 100%→75%),而且仍然漏。检测活在一条“安全↔可用”的权衡曲线上;靠构造的授权不在这条曲线上:0% 漏报与 100% 任务成功,同时成立。
Two attack classes carry no malicious signal at all — a high-privilege account reading data its task was never granted, and the same payment API at $5,000 against a $1,000 policy limit. A detector has nothing to flag. Aiegis blocks both structurally. 有两类攻击完全没有恶意信号——高权账户读它任务从未被授予的数据,以及同一支付 API 用 $5,000 撞 $1,000 的策略上限。检测器无从下手;Aiegis 从结构上挡住两者。
Concretely in finance: preventing “unauthorized advice” can mean a classifier judging whether an output looks non-compliant — or an authority layer deciding whether the agent may act at all. Same goal, two different guarantees. 落到金融:防止“未授权建议”,可以是分类器判断输出像不像违规,也可以是授权层裁决 agent 到底有没有权行动。同一目标,两种不同的保证。
Method & honest boundary: a reproducible eval (11 labeled requests across data, payment, irreversibility, and multi-agent domains) on the DB Warden authority module. A deterministic demonstrator — the 0% leakage is structural (no token → no effect); the detection percentages are illustrative and corpus-dependent. Run it yourself: examples/db_warden_auth_eval. Underlying mechanism shared under NDA. 方法与诚实边界:在 DB Warden 授权模块上的可复现评测(11 个标注请求,覆盖数据、支付、不可逆、多智能体域)。确定性 demonstrator——0% 漏报是构造性的(无令牌即无后果);检测百分比为示意,随语料而变。可自行运行:examples/db_warden_auth_eval。底层机制在 NDA 后分享。
How to read these numbers如何看待这些数字
Results come from offline certification and online canary checks on the reference implementation, under explicitly stated assumptions. Aiegis does not claim to eliminate every risk — it converts an unbounded behavioral risk into a bounded, measured, structurally enforced property, and states the residual. The formal model and implementation mechanism are not published here; they are available under NDA.结果来自参考实现上的离线认证与在线金丝雀检查,基于明确陈述的假设。Aiegis 不声称消除一切风险——它把无界的行为风险转化为有界、可度量、结构性强制的属性,并写明残差。形式化模型与实现机制不在此公开,可在 NDA 后获取。
Want the methodology and mechanism in depth?想深入了解方法与机制?
Request a technical briefing (NDA)申请技术简报(NDA)