DROS 4‑Layer Defense‑in‑Depth Architecture for Autonomous AI Workloads

Abstract

Abstract—In 2026, autonomous AI agents capable ofmulti‑step tool execution are deployed across critical enterprise domains—financial compliance, supplychain routing, and infrastructure management. However, existing security primitives face severe architecturalboundaries: application‑level prompt firewalls (e.g., NVIDIA NeMo Guardrails) remain fundamentally probabilistic and vulnerable to Indirect Prompt Injection(IPI), while kernel‑level OS sandboxes (e.g., eBPF, Seccomp) suffer from execution “context‑blindness,” unable to map user‑space agent roles to low‑level process streams. To bridge this “Attribution Gap,” we present the DROS 4‑Layer Defense‑in‑Depth Architecture, a zero‑trust runtime execution control plane purpose‑built for the Agentic Web era. The architecture decouples Control Plane Provisioning (via OpenAI Terraform Provider & OpenShip) from Runtime Physical Execution Defense. By enforcing immutable O(1) capability bitmaps at the binary C‑ABI / FFI boundary, DROSachieves sub‑microsecond decision latency (26.1 μs median, <500 ns panic latency). Coupled with a 3‑tier PKI Certificate Authority (Root CA -> AIA -> BEC Leaf Token) issuing signed DrosIdentityTokens (DIT), DROS provides court‑admissible, non‑repudiable audit logs signed via Ed25519 for regulatory compliance (EU AI Act Sec. 50). Benchmark evaluations demonstrate 100% containment against zero‑day prompt injection, Goal Hijacking, and cross‑enterprise supply chain attacks.Abstract—2026 年具備多步驟工具調用能力(Tool-Calling)的自主型AI Agent 快速部署於金融合規、供應鏈調度與關鍵基礎設施等高風險領域。然而,現有資安機制面臨嚴重的架構邊界:應用層語意防火牆(如NVIDIA NeMo Guardrails)本質上仍屬機率性過濾,極易遭間接提示詞注入(IPI)越獄;而核心層作業系統沙盒(如eBPF、Seccomp)則存在「上下文失明(Context Blindness)」,無法將使用者空間的Agent 角色對映至低階進程流。為解決此「歸責缺口(Attribution Gap)」,我們提出DROS 四層防禦縱深架構——一個專為Agentic Web 時代設計的零信任執行治理控制面。本架構將控制面開通(透過OpenAI Terraform Provider與OpenShip)與運行期二進位實體防禦解耦,於二進位CABI/ FFI 邊界執行不可變的O(1) 能力點陣圖(Bitmap),實現亞微秒級決策延遲(中位數26.1 s,熔斷延遲<500 ns)。配合三階PKI 憑證授權鏈(Root CA -> AIA -> BEC Leaf Token)簽發之DrosIdentityToken (DIT),提供具備法庭級不可否認性(Non-repudiation)且合規歐盟EU AI ActSec. 50 的Ed25519 簽章日誌。基準測試顯示,本架構對零日提示詞注入、目標劫持與跨企業供應鏈毒化攻擊(如OpenAI工作負載存取遭投毒之Hugging Face 數據庫)達100% 確定性物理阻斷。