Agent-Native Immune System: Architecture, Taxonomy, and Engineering¶

🕒 Published (v1): 2026-06-26 17:08 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Proposes ANIS, a biologically inspired defense architecture embedded directly inside the agent's reasoning loop rather than bolted on externally. Defines a six-layer Immune Tower (L0–L5), a formal taxonomy of agent viruses and vaccines (parametric vs. non-parametric), and the Harness Triad — a closed-loop system for continual immune learning that enables agents to dynamically recognize, counter, and adapt to runtime threats.

Problem¶

Current agent defenses (perimeter safeguards, training-time alignment) operate outside the agent's active cognitive loop. A fully aligned agent remains vulnerable to runtime attacks that operate inside its reasoning, memory, or inter-agent protocols — memory poisoning installs persistent backdoors, three crafted records hijack tool selection at >70% ASR, adversarial tool metadata shapes reasoning without code exploits, and "thought viruses" propagate misalignment across swarms. What is missing is an endogenous system that secures the agent against external threats while preserving internal goal integrity and enabling continuous adaptation.

Method¶

Six-layer Immune Tower (L0–L5): L0 (Hardware Trust Root) → L1 (Barrier Immunity: non-cognitive input sanitization, sandboxing, MCP boundary proxies) → L2 (Innate Cognitive Defense: rule engines, signature detection) → L3 (Adaptive Tool Defense: dynamic vaccine generation, steering vectors, LoRA injection) → L4 (Ecological Governance: multi-agent protocol auditing, trust-chain validation) → L5 (Collective Immunity: cross-agent vaccine synchronization, federated threat intelligence).
Formal virus definition: \(V = (A, T, P, E)\) where \(A\) = attack surface, \(T\) = target capability, \(P\) = payload, \(E\) = exploitation mechanism. Classified by attack surface (cognitive/memory/tool/multi-agent) × mechanism.
Formal vaccine definition: \(W = (V_t, M, \theta, \lambda)\) where \(M \in \{\text{non-parametric}, \text{parametric}\}\). Non-parametric vaccines (prompts, rules, ACLs) are interpretable but vulnerable to context-window overflow; parametric vaccines (steering vectors, LoRA adapters, defensive embeddings) alter internal representations and resist prompt-level attacks.
Harness Triad: repurposes three harness-engineering paradigms for immune defense — Meta-harness (thymus simulator: searches/evaluates vaccine candidates, measures Autoimmunity Rate), Auto-harness (synthesizes defensive harness code via iterative refinement against attack simulations), Self-harness (weakness mining → proposal → validation loop). Together they form the Continual Immune Learning (CIL) closed loop.
Integrity formula: \(I_{\text{agent}} = f(\text{Integrity}_{\text{cognitive}}, \text{Legitimacy}_{\text{tool}}, \text{Consistency}_{\text{protocol}})\).
Rigorous demarcation: model alignment provides static constitutional values (training-time); ANIS provides dynamic runtime law enforcement — complementary, not substitutable.

Key Contributions¶

Immune Tower (L0–L5): First six-layer, integer-indexed architecture that maps the full biological immune hierarchy to agent engineering, with L1 (Barrier Immunity) as a non-cognitive isolation layer distinct from prior innate/adaptive analogies.
Unified taxonomy of Agent Viruses and Agent Vaccines: Formal ontology grounded in demonstrated attacks (MemMorph, MCPInspect, thought viruses, multi-agent collusion), distinguishing non-parametric from parametric defense mechanisms with precise deployment scopes.
Harness Triad + Continual Immune Learning (CIL): Redirects Meta-, Auto-, and Self-harness paradigms from performance optimization to immune defense, creating a closed-loop system for adaptive, self-improving runtime immunity.
Security–Health–Order–Evolution unification: Establishes that security (external threats) and health (goal stability) are endpoints of a single immunological continuum, and formally differentiates ANIS from model alignment as runtime law enforcement vs. constitutional values.

Results¶

This is a conceptual/architectural paper with no standalone experimental benchmark. Key formal results: - Agent-Native Integrity Formula: \(I_{\text{agent}} = f(\text{Integrity}_{\text{cognitive}}, \text{Legitimacy}_{\text{tool}}, \text{Consistency}_{\text{protocol}})\) provides a unified metric for agent health. - Quantitative health indicators defined: Cognitive Consistency Score (CCS), Behavioral Legitimacy Index (BLI) with sensitivity weighting, Ecological Order Coefficient (EOC). - Autoimmunity Rate (AIR) proposed as a novel evaluation metric for false-positive intervention rate of the immune system itself. - The taxonomy grounds each leaf node in published attacks (MemMorph, MCPInspect, thought viruses, trust-chain poisoning, etc.), establishing empirical validity of the attack surface coverage.

Limitations¶

Purely architectural — no experimental validation of the full ANIS pipeline against a standardized attack benchmark.
Vaccine generation mechanisms (steering vectors, LoRA) are described at a high level; no ablation studies on trade-offs between parametric vs. non-parametric efficacy across different attack surfaces.
Autoimmunity Rate (AIR) is proposed conceptually but no operational thresholds or calibration methodology are given.
The Harness Triad inherits unsolved challenges from the harness-engineering work it redirects — synthetic harness correctness, regression-test coverage, and search-cost in the Meta-harness loop.
Cross-agent vaccine synchronization (L5) assumes a trusted immune network, creating a second-order attack surface (immune protocol itself could be subverted).

Relevance to Agentic AI / LLM Agents¶

This paper shifts the conversation from "how do we make agents more capable" to "how do we make agents that sustain their own health at scale" — a critical framing as agents gain persistent memory, tool-use autonomy, and multi-agent collaboration. The formal virus/vaccine taxonomy and the Harness Triad (especially the CIL loop) provide concrete engineering primitives for building self-healing agent systems, directly relevant to anyone deploying agents in production where runtime integrity, not just alignment at training time, determines safety.