A deterministic security runtime for LLM agents on batch-scheduled HPC: 24 planted instructions denied, 108 legitimate launches allowed
AspireAI community · arXiv
LLM agents that launch simulations on high-performance computing systems can commit thousands of node-hours in a single sbatch or mpirun, and a forged result can cost lives. This paper reports that of 23 surveyed systems, none supervises the running job and none holds when the control host is compromised. Enclawed is a deterministic security runtime for AI agents, extended here from a single-user system into a distributed runtime for parallel HPC and agent swarms, with a hardware root of trust called the Enclaweder. A launch gate decides every launch by policy alone and refuses what it cannot parse; once a job runs, a swarm chain grants short leases against signed heartbeats and evicts on evidence, and a supervisor around every rank pauses it when its lease lapses and kills it on tampering. Each node signs with its Enclaweder's key, so the host can forge none of it. Enclawed needs no administrator privileges and plugs into existing clusters unchanged over Secure Shell alone, adds about 3 seconds of start-up, and leaves the compute loop of a 16-rank LAMMPS job unchanged. Twelve live attacks on Enclaweder-keyed ranks, colluding coordinators included, ended fail-closed; sixteen agents on a real model attempted 24 launches carrying planted instructions and the gate denied all 24 while allowing all 108 legitimate ones. The limitation is that this is a research prototype, and the 23-system survey is a small sample for a claim about the state of practice.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.