arXiv cs.MA· Zhonghao Zhan, Javad Forough, Yefan Zhang, Krinos Li, Xiao Ma, Hamed Haddadi·· 11 小时前AI 评分39
Airlock：通过选择性在线隔离限制多智能体故障爆炸半径
Airlock: Bounding the Multi-Agent Blast Radius via Selective Online Containment
AI 导读
Airlock 是一个多智能体运行时与护栏，通过树状运行时 EdgeCitadel 的权限边界和只追加溯源 DAG，在告警后选择性隔离受污染执行并回溯根因。在 1,832 次测试台运行、161 次物理智能家居 LLM 运行和 24,266 条仿真记录中，Airlock 在主测试台与智能家居网格上阻断全部告警后故障动作，零收敛后泄漏。
正文 · 原文
Abstract:When multi-agent systems act on the external world, a single agent's faulty output can spread across tasks before detection, creating a system-wide blast radius. Single-agent guardrails are confined to individual harnesses, while existing multi-agent controls either cancel only the faulty source and miss downstream consumers or halt and roll back the entire workflow at the cost of healthy work. We present Airlock, a multi-agent runtime and guardrail for selective post-alert fault containment. Its tree-structured runtime, EdgeCitadel, narrows permissions vertically from parent to child agents to establish node boundaries and control switches. Meanwhile, an append-only provenance DAG records cross-agent data consumption horizontally. Upon an alert, Airlock traces forward on this DAG to isolate tainted executions and pending actions, and backward to narrow root causes. At the site switches, a default full quarantine tier freezes affected branches without a solver, while an assured optimized cut tier uses fence-then-prune to enforce a deadline-aware minimum cut minimizing collateral disruption. Across 1,832 testbed runs, 161 physical smart-home LLM runs, and 24,266 simulation records, Airlock blocks all post-alert faulty actuations on our main testbed and smart-home grids with zero post-convergence leaks. Whereas native controls in A2A and LangGraph either contain at most 33.3% of faults or retain at most 16% of work without redo, Airlock retains +68 pp to +96 pp more healthy work, and its optimized cut retains +46 pp more than full quarantine under dense spread. These results show that co-designing runtime authority boundaries with online provenance enables surgical fault containment without sacrificing healthy work (code: this https URL).
| Subjects: | Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2611.06727 [cs.MA] |
| (or arXiv:2611.06727v1 [cs.MA] for this version) | |
| https://doi.org/10.48550/arXiv.2611.06727 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Zhonghao Zhan [view email]
[v1]
Wed, 4 Nov 2026 16:16:03 UTC (1,574 KB)
来源：arXiv cs.MA · arxiv.org