================================================================
Mapping the Threats: A Top-Journal Survey of AI Agent Security and Privacy
一篇顶刊综述如何给 AI Agent 的安全威胁分类
----------------------------------------------------------------
vertciti Data Room · Public Document
Date: 2026-10-20 | Version: v1
Sources: arXiv:2409.14457; published version DOI 10.1109/COMST.2025.3576176
  (IEEE Communications Surveys & Tutorials). See source notes inline.
Classification: Public — contains no confidential information.
================================================================

----------------------------------------------------------------
ENGLISH
----------------------------------------------------------------

Introduction

"Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trends" — written by researchers at Xi'an Jiaotong University and partner institutions and published in IEEE Communications Surveys & Tutorials (DOI: 10.1109/COMST.2025.3576176) — surveys how large-model agents are built, how they cooperate, and how they can be attacked. For anyone putting agents to real work, its value is not a new technique. It is a complete map of the threat landscape.

Source-checked points

1. Five modules, with security as a peer. The paper decomposes an LM agent into planning, memory, action, interaction — and security, defined as a first-class component that cuts across the other four rather than a bolt-on. Memory is split into short-term, long-term and hybrid forms.
2. A four-way threat taxonomy. Authentication threats, denial of service, adversarial attacks, and poisoning/backdoors. Authentication is further broken down by surface — user–agent, agent–agent, and agent–third-party-service — so every channel an agent connects through maps to an authentication surface.
3. Prompt injection, formally catalogued. Including indirect prompt injection: malicious instructions hidden in data the agent retrieves at inference time, capable of steering it into unintended actions and external API calls. In this taxonomy, prompt injection is not an anecdote; it is a numbered attack class.
4. Memory poisoning has a name. Attackers can contaminate an agent's long-term memory or knowledge base through prompt loopholes (memory poisoning, RAG poisoning), and one agent's misleading advice can cascade — "chained poisoned instructions" — degrading the final decision step by step.
5. Privacy on two fronts. Memorization risks (verbatim training-data extraction, membership inference) and prompt stealing: the paper explicitly treats high-quality system and orchestration prompts as commercial assets that can be extracted from closed services.
6. Cascading hallucination — and the counter-patterns. One agent's hallucination, accepted by peers, amplifies across the collaboration network. The authors' remedies pair individual correction with inter-agent verification, including cooperative authentication: several agents independently verify the same output, and a threshold of confirmations is required before it enters the workflow.

A note on sourcing: several claims circulating on social media in this paper's name do not appear anywhere in the paper, and we repeat none of them. As a survey, the paper relays experimental numbers from the works it cites; we cite only its taxonomy and its directions, never those second-hand figures.

The vertciti view

We run a multi-agent operation, and this taxonomy is one of the reference frames for our own asset inventory and channel governance. Two of its lessons are already engineering discipline for us: every memory write carries a source and a trust level, and load-bearing handoffs take effect only after independent verification.

Sources

- Paper (arXiv:2409.14457): https://arxiv.org/abs/2409.14457
- Published version, DOI: https://doi.org/10.1109/COMST.2025.3576176

----------------------------------------------------------------
中文
----------------------------------------------------------------

导语

《Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trends》是西安交通大学等机构研究者撰写的综述，发表于 IEEE Communications Surveys & Tutorials（DOI: 10.1109/COMST.2025.3576176)，系统梳理了大模型 agent 的架构、协作范式与安全隐私威胁。对正在把 agent 投入真实业务的人，它的价值不在某个新方法，而在一张完整的威胁地图。

核源要点

1. 五模块，安全是一等组件：论文把 LM agent 拆为规划、记忆、行动、交互、安全五个模块，其中安全被定义为横切其余四模块的一等组件，而非事后外挂；记忆分短期、长期、混合三类。
2. 安全威胁四分法：认证威胁、拒绝服务（DoS)、对抗攻击、投毒与后门。其中认证威胁按交互面再分三层：用户–agent、agent–agent、agent–第三方服务——每个 agent 对外连接的通道，都对应一个认证面。
3. 提示注入有正式条目：包括「间接提示注入」——把恶意指令藏进 agent 在推理时检索到的数据里，可诱导其执行非预期动作、接管外部接口。提示注入不是段子，是分类法里有编号的攻击类。
4. 「记忆投毒」被学术命名：攻击者可经提示漏洞污染 agent 的长期记忆与知识库（memory poisoning、RAG poisoning)；还有「链式毒性指令」——一个 agent 的误导建议逐级劣化最终决策。往记忆里下毒，在论文中有正式条目与攻击路径。
5. 隐私两条线：一是模型记忆（memorization）带来的数据提取与成员推断风险；二是「提示窃取」——论文明确把高质量的系统提示与编排提示当作有商业价值、可被闭盒抽取的资产。
6. 级联幻觉与对策方向：单个 agent 的幻觉被同伴接受后会在协作网络中放大。作者给出的药方是个体纠偏＋agent 间验证机制双管齐下，其中包括「多 agent 协同认证」：多个 agent 独立核验同一输出，达到阈值确认数才并入工作流。

核源注：社交媒体上若干以本文名义流传的说法，经全文核源在论文中并不存在，本篇不予转述；本文为学术综述，只引其分类与方法方向，不引其转述的实验数字。

vertciti 视角

我们运营着多 agent 协作的业务系统，这张威胁地图是我们做资产清单与通道治理时的对照框架之一。其中两条已经进入我们自己的工程纪律：记忆写入必须带来源与可信等级；承重的交接动作必须经独立核验才生效。

来源

- 论文（arXiv:2409.14457)：https://arxiv.org/abs/2409.14457
- 发表版 DOI: https://doi.org/10.1109/COMST.2025.3576176

---