arXiv cs.AI· Weidi Luo, Qiming Zhang, Yihao Quan, Mingyu Jin, Jie Cai, Chaowei Xiao, Jingcheng Niu, Zhen Xiang·· 1 天前AI 评分33
Agent MechSuits：面向多轮 CLI 智能体的机制子空间安全引导
Agent MechSuits: Mechanistic Subspace Safety Steering for Multi-Turn CLI Agents
AI 导读
研究者提出 Agent MechSuits，一个白盒防御框架，通过单层内 10 维子空间的干预，对多轮 CLI 智能体做运行时安全检测与表征层缓解。团队同时发布 MAS 基准，覆盖 LLaMA-3.1-8B、Qwen-2.5-7B 和 Gemma-2-9B 在 194 个任务上的多轮执行轨迹。实验显示该框架安全检测表现强劲，并初步展现出前瞻性风险预判能力，显著减少智能体的有害动作。
正文 · 原文
Abstract:Command-Line Interface (CLI) agents based on large language models (LLMs) demonstrate remarkable autonomous capabilities, but they also introduce significant safety and misuse risks during multi-turn interactions with external environments. Existing safety mechanisms mainly rely on external guardrails, which have a limited ability to perform fine-grained behavioral control during execution. Meanwhile, recent mechanistic interpretability methods for LLM safety are mostly confined to single-turn or jailbreak-style QA settings, limiting their ability to capture the evolving risk dynamics of multi-turn agent execution. In this paper, we investigate the safety of multi-turn CLI agents from an internal perspective. We propose Agent MechSuits (Mechanistic Subspace Intervention and Steering), a white-box defense framework that performs runtime safety detection and representation-level mitigation for CLI agents. Unlike conventional agent guardrails, Agent MechSuits detects harmful execution states from step-level hidden representations and mitigates unsafe behavior by intervening in a 10-dimensional subspace within a single layer. To support this research, we introduce the Mechanistic Agent Safety (MAS) benchmark, comprising comprehensively annotated multi-turn execution trajectories across 194 tasks using LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B. Extensive experiments show that Agent MechSuits achieves strong safety detection performance, provides preliminary evidence for lookahead risk anticipation, and substantially reduces harmful actions of the CLI agent, establishing a foundation for applying mechanistic interpretability to dynamic LLM agent safety.
| Comments: | Accepted by NeurIPS'2026 |
| Subjects: | Artificial Intelligence (cs.AI); Software Engineering (cs.SE) |
| Cite as: | arXiv:2606.22673 [cs.AI] |
| (or arXiv:2606.22673v3 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2606.22673 arXiv-issued DOI via DataCite |
Submission history
From: Weidi Luo [view email]
[v1]
Sun, 21 Jun 2026 21:13:55 UTC (15,088 KB)
[v2]
Mon, 5 Oct 2026 17:21:29 UTC (15,081 KB)
[v3]
Thu, 12 Nov 2026 01:46:14 UTC (15,082 KB)
来源：arXiv cs.AI · arxiv.org