A Lifecycle Supervision Framework for Robustly Aligned AI Agents

View PDF of the article “Cognitive Control Architecture (CCA): A Framework for Lifecycle Stewardship of Powerfully Allied AI Agents,” by Zhibo Liang and co-authors

View PDF HTML (beta)

a summary:Autonomous Large Language Model (LLM) agents show significant vulnerability to indirect immediate injection (IPI) attacks. These attacks hijack customer behavior by contaminating external information sources and exploiting fundamental trade-offs between security and functionality in existing defense mechanisms. This leads to unauthorized, malicious tool calls, diverting agents from their original goals. The success of complex defense infrastructures reveals deeper systemic fragility: while current defenses show some effectiveness, most defense architectures are inherently fragmented. Consequently, they fail to provide complete integrity assurance across the entire task execution pipeline, forcing unacceptable multidimensional compromises between security, functionality, and efficiency. Our method is based on a fundamental insight: No matter how precise an IPI attack is, its pursuit of a malicious goal will eventually manifest as a detectable deviation in the course of action, different from the expected legitimate plan. Accordingly, we propose the Cognitive Control Architecture (CCA), a comprehensive framework that achieves full lifecycle cognitive stewardship. CCA builds an effective dual-layered defense system through two synergistic pillars: (1) proactive and preventive control flow control and data flow integrity enforcement via a pre-established “objective graph”; and (2) an innovative “gradient arbitrator” that, upon detecting an anomaly, initiates deep reasoning based on multi-dimensional scoring, specifically designed to counter complex conditional attacks. Experiments conducted on the AgentDojo benchmark demonstrate that CCA not only effectively withstands sophisticated attacks that challenge other advanced defense methods, but also achieves uncompromised security with remarkable efficiency and robustness, thus reconciling the multi-dimensional trade-off mentioned above.