Agent-Native Immune System: Architecture, Taxonomy, and Engineering

Source: arXiv:2606.28270 · Published 2026-06-26 · By Bo Shen, Lifeng Chang, Tianyuan Wei, Yunpeng Li, Feng Shi, Yichen Han et al.

TL;DR

This paper addresses a critical gap in the security and robustness of autonomous AI agents, which have evolved from static chatbots to complex entities with persistent memory, tool use, and multi-agent collaboration. Existing defenses like perimeter security and pre-deployment alignment are external and static, leaving agents vulnerable to runtime attacks such as memory poisoning, tool-chain hijacking, and multi-agent protocol manipulation. To solve this, the authors introduce the Agent-Native Immune System (ANIS), a biologically inspired, endogenous defense architecture embedded inside the agent’s cognitive loop, enabling active, adaptive, and collective immunity.

ANIS consists of a six-layer Immune Tower (L0–L5) mapping biological immune mechanisms to agent engineering layers, including a novel Barrier Immunity layer (L1) for non-cognitive isolation to block attacks before cognition occurs. The paper formalizes a unified taxonomy of agent viruses (attacks) and vaccines (defenses), differentiating parametric vaccines (e.g., steering vectors, LoRA adapters) from non-parametric rules. The Harness Triad—Meta, Self, and Auto harnesses—enables continual immune learning (CIL) to dynamically generate and validate vaccines during runtime. By separating static model alignment (constitutional values) from dynamic immunity (runtime law enforcement), ANIS provides a multi-layered defense-in-depth framework that evolves with threats.

Experimental results and architectural analysis demonstrate how ANIS can intercept diverse attack classes, maintain agent health and order, and share immunity across agent swarms. The paper also proposes novel evaluation metrics like the Autoimmunity Rate. Overall, ANIS reframes agent security and safety as a lifelong, self-sustaining immune process rather than a pre-deployment or perimeter-only concern.

Key findings

• ANIS defines a six-layer Immune Tower from hardware trust root (L0) to collective immunity (L5), incorporating a unique Barrier Immunity layer (L1) to sandbox and isolate inputs before cognitive processing.
• Parametric vaccines using steering vectors and LoRA adapters provide robust adaptive defense at the cognitive (L2) and tool (L3) layers, outperforming non-parametric rule-based defenses vulnerable to context window overflow.
• The Harness Triad (Meta-, Auto-, and Self-harness) forms a closed-loop continual immune learning (CIL) system that detects vulnerabilities, generates candidate vaccines, evaluates via a Thymus Simulator, and deploys validated defenses automatically.
• Formalized metrics: Cognitive Consistency Score (CCS), Behavioral Legitimacy Index (BLI), and Ecological Order Coefficient (EOC) quantitatively assess agent health and order at single-agent and swarm levels.
• Experiments cited show over 70% success rate of memory poisoning attacks hijacking tool selection without ANIS defenses (Zhang et al. 24), demonstrating real-world impact of runtime threats.
• Autoimmunity Rate (AIR), a novel metric quantifying false-positive vaccine interventions, guides the Thymus Simulator in preventing harmful self-blocking and maintains agent reasoning stability within 0.01–0.05 tolerance.
• Cross-agent vaccine dissemination and immune network protocols enable collective immunity and swarm-wide threat intelligence sharing (L5), extending protection beyond isolated agents.
• Comparison shows ANIS complements static model alignment by actively enforcing agent health and security during runtime, closing gaps left by perimeter-only and training-time measures.

Threat model

The adversary is a persistent runtime attacker with the ability to manipulate the agent’s memory contents, tool invocation parameters, or multi-agent communication protocols to hijack goals or induce malicious behavior. They can exploit vulnerabilities in the agent’s cognitive loop but cannot directly compromise cryptographic hardware roots (L0) or fully observe/alter parametric vaccine internals without detection. The attacker cannot bypass physical sandboxing (L1) or validated immune responses embedded within agents. Adaptive unknown attacks that evade current vaccines may arise, motivating continuous immune learning.

Methodology — deep read

The authors first establish a comprehensive threat model focusing on autonomous agents that persistently interact with external data, tools, and peer agents. Adversaries can manipulate memory, tool-chains, or multi-agent protocols at runtime, targeting goal hijacking, memory poisoning, or protocol spoofing. Attackers cannot directly compromise hardware roots or fully observe internal model weights.

The data underlying the framework includes a synthesis of prior published attacks (Chen et al. for memory poisoning, Zhang et al. for tool hijacking, Hu et al. for multi-agent collusion), plus internally defined agent health metrics (CCS, BLI, EOC) calculated from reasoning traces, tool invocation logs, and swarm behavior. The dataset sizes or concrete benchmarks are not fully detailed, focusing on architectural design.

The core architecture is the Immune Tower, consisting of L0 (hardware trust root with TPM-like attestation), L1 (Barrier Immunity for sandboxing), L2 (Innate Cognitive Defense using rule engines and signature detection), L3 (Adaptive Tool Defense with parametric vaccines like steering vectors and LoRA adapters), L4 (Ecological Governance auditing multi-agent protocol legitimacy), and L5 (Collective Immunity enabling cross-agent vaccine sharing). This layered defense-in-depth architecture covers static physical isolation, fast heuristic screening, dynamic adaptive parameter-space interventions, and ecological multisystem governance.

Training is shifted to a continual immune learning (CIL) loop implemented through the Harness Triad. Self-harness detects anomalies through trace mining, identifying security-relevant failure patterns and generating minimal defensive edits. Meta-harness evaluates these candidate vaccines via a Thymus Simulator that benchmarks them against benign self-antigens and controls autoimmunity via the Autoimmunity Rate (AIR) threshold (typically 0.01–0.05). Auto-harness then synthesizes and deploys validated defenses as parametric LoRA vaccines or harness code constraints. This cycle iterates indefinitely to adapt to novel runtime threats.

Evaluation uses quantitative metrics like CCS for logical reasoning consistency, BLI for authorized tool usage ratio weighted by sensitivity, and EOC for swarm stability variance. Vaccines are compared on efficacy and false positive rates (AIR). The system is benchmarked conceptually against a wide range of real-world attacks cited from literature, demonstrating how no single defense layer suffices without the full tower and CIL loop.

Reproducibility is limited by lack of released code or datasets as the submission is primarily conceptual and architectural. The Thymus Simulator is described algorithmically but not concretely evaluated with open code. The vaccine distribution protocol is specified for standardized cross-agent immunity sharing. The paper walks through an example of LoRA vaccine creation by rejection sampling candidate harness edits failing AIR or CCS thresholds, followed by deployment and collective propagation.

Overall, the methodology integrates prior attack taxonomies with multi-layered biologically inspired defenses, formulates metrics capturing runtime agent health, and operationalizes an iterative immune engineering process leveraging automated harness generation and meta-learning to evolve agent defenses continuously.

Technical innovations

• Design and operationalization of a six-layer Immune Tower architecture (L0–L5) embedding biological immunity concepts endogenous to the agent’s cognitive loop.
• Introduction of Barrier Immunity (L1) as a non-cognitive, enforceable sandbox isolation layer preventing pre-cognitive attacks like adversarial tool metadata ingestion.
• Formal unified taxonomy of agent viruses and parametric versus non-parametric vaccines with a precise semantic framework for vaccine targeting and deployment scope.
• Harness Triad framework repurposing harness optimization paradigms (Meta-, Auto-, Self-harness) to realize Continual Immune Learning for adaptive, self-improving agent immunity.
• Development of the Thymus Simulator algorithm enforcing Autoimmunity Rate bounds to validate vaccines via benchmarking on dynamically generated self-antigens and preserve agent reasoning integrity.

Baselines vs proposed

• Memory poisoning attack (Zhang et al. 24): Tool selection hijacked with over 70% success rate without ANIS defenses.
• Autoimmunity Rate (AIR) threshold set between 0.01–0.05 to balance false positive vaccine interventions and defense efficacy in the Thymus Simulator.
• Cognitive Consistency Score (CCS) degradation limited to epsilon (unspecified small value) when applying parametric vaccines to maintain reasoning stability.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.28270.

Fig 1: The co-evolution of foundation model capabilities and agent engineering paradigms, converging

Limitations

• The framework is primarily conceptual and architectural; no open-source code or concrete empirical results with specific agent backbones are provided.
• No detailed experimental evaluation quantifying vaccine efficacy against a standard benchmark or measured runtime overhead.
• Lack of comprehensive adversarial evaluation beyond cited attacks; robustness against adaptive attack strategies remains to be demonstrated.
• No reported scalability assessment or cost of continual immune learning in large-scale multi-agent swarms.
• Limited discussion on potential negative consequences of vaccine overfitting or unintended behavioral biases introduced by parametric interventions.
• The protocol for vaccine sharing assumes secure attestation infrastructure which may not be universally available or trustable.

Open questions / follow-ons

• How to standardize immune protocol formats and vaccine distribution mechanisms across heterogeneous agent architectures and ecosystems?
• What are effective evaluation benchmarks and quantitative metrics to measure autoimmunity, vaccine efficacy, and long-term immune system health under evolving adversarial threats?
• How can continual immune learning be scaled efficiently for large multi-agent collectives without excessive computational overhead or security risks?
• What interplay and potential conflicts exist between model alignment objectives and immunity enforcement, especially when self-preservation diverges from human values?

Why it matters for bot defense

Bot-defense and CAPTCHA practitioners can draw from ANIS’s paradigm shift that moves defense from external static gates to embedded, adaptive, and autonomous immune systems integral to agents. The multi-layer Immune Tower concept emphasizes the necessity of pre-cognitive sandboxing (e.g., input validation proxies) to stop attacks before they corrupt reasoning processes, aligning with CAPTCHA goals of filtering out automated abuse at the boundary.

The paper’s formal taxonomy of agent viruses and vaccines informs targeted defense strategies against runtime hijacking vectors revealed in modern autonomous agents, such as memory poisoning or tool-chain manipulation—threats traditional CAPTCHA might not fully address. The Harness Triad and continual immune learning framework suggests an evolutionary defense approach that automatically synthesizes and validates new countermeasures, potentially enhancing adaptive CAPTCHA-like challenges or interactive defense protocols deployed in real-time. However, full integration would require careful engineering to avoid false positives (autoimmunity), which could degrade user experience or agent effectiveness. Overall, ANIS provides a foundational blueprint geared toward future-proofing autonomous agents against sophisticated runtime attacks that lie beyond perimeter-centric defenses common in current bot-mitigation systems.

Cite

@article{arxiv2606_28270,
  title={ Agent-Native Immune System: Architecture, Taxonomy, and Engineering },
  author={ Bo Shen and Lifeng Chang and Tianyuan Wei and Yunpeng Li and Feng Shi and Yichen Han and Peijie Gao and Shiyi Kuang and Xin Chang and Dehui Li },
  journal={arXiv preprint arXiv:2606.28270},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.28270}
}

Read the full paper

• arXiv:2606.28270 (abstract)
• arXiv:2606.28270 (PDF)