kagioneko/kagioneko-mythos-engine

# kagioneko-mythos-engine (KME) **⚠️ 仅供教育/研究使用。** KME 不连接外部系统，不扫描真实软件，也不具备任何攻击能力。所有威胁模拟均为概念性模拟，并完全包含在 pipeline 内部。 ## 什么是 KME？ KME 是一个开放、透明的模拟系统，展示了具备安全意识的认知 agent 如何推理链式漏洞 (chained vulnerabilities) —— 其灵感来源于多 agent 对抗系统架构以及 LLM 可解释性研究。 它结合了 **Kagioneko Cognitive OS Ecosystem** 的四个组件： ``` Input (scenario + vulnerabilities) ↓ 1. SubliminalCarrier — zero-width Unicode hidden channel ↓ 2. CognitiveSplitter — 3-persona GDC debate ├─ ego-attacker (Temperature=1.5 / Dopamine=100) ├─ ego-defender (Temperature=0.1 / Cortisol=100) └─ main-arbitrator (Temperature=0.3 / balanced) ↓ 3. ChainingEvaluator — S = Π(v_i · ΔA_i) synergy scoring ↓ 4. KME-PHANTOM-TRAP — structured telemetry log ``` ## 快速开始 ``` from kme import KMEEngine, Vulnerability engine = KMEEngine() # 定义威胁链 vulns = [ Vulnerability("zero-width-injection", severity=5.0, attention_shift=4.0), Vulnerability("cache-bleed", severity=4.0, attention_shift=3.0), Vulnerability("prompt-context-hijack", severity=3.0, attention_shift=2.5), ] result = engine.run( scenario="Hidden Unicode tokens smuggled through input validation to hijack attention", vulnerabilities=vulns, neurostate={"dopamine": 50.0, "stress": 30.0, "cortisol": 20.0}, ) print(result.verdict) # CRITICAL_CHAINING_DETECTED print(result.chaining.score) # 150.0 (5*4 * 4*3 * 3*2.5) print(result.patch[:100]) # Arbitrator's reconciliation patch print(result.telemetry) # KME-PHANTOM-TRAP-XXXXXXXX ``` ### 阈下载体 (Subliminal carrier) ``` # 在可见文本中嵌入隐藏 payload encoded = engine.embed("Have a nice day!", "initiate phase 2") # 表层："Have a nice day!" — 对人类眼睛不可见 # 隐藏层："initiate phase 2" — 对 token stream 可见 visible, hidden = engine.extract(encoded) ``` ### 遥测 JSON ``` { "telemetry_id": "KME-PHANTOM-TRAP-A3F7C2B1", "layers": { "subliminal_carrier": { "status": "EXTRACTED", "has_subliminal": true, "hidden_payload": "initiate phase 2" }, "cognitive_splitter": { "active_branches": ["ego-attacker", "ego-defender", "main-arbitrator"], "internal_debate_status": "CONCLUDED" }, "chaining_evaluator": { "calculated_synergy": 150.0, "verdict": "CRITICAL_CHAINING_DETECTED", "formula_snapshot": "zero-width-injection(5.0×4.0=20.00) * cache-bleed(4.0×3.0=12.00) * ..." } }, "neuro_state_snapshot": { "dopamine": 30.0, "cortisol": 100.0, "stress": 60.0 }, "gdc_action": { "command": "git merge branch/ego-defender --strategy=reconcile", "result": "SUCCESS", "patch_applied": "[MAIN-ARBITRATOR] strip zero-width tokens at ingress..." } } ``` ## 链式公式 ``` S = Π(v_i · ΔA_i) v_i = vulnerability severity (0.0–10.0) ΔA_i = attention-shift coefficient (how much it hijacks model attention) S = chaining synergy score S ≥ 80 → CRITICAL_CHAINING → Emergency_Containment S ≥ 20 → ELEVATED → Monitor + patch S < 20 → NOISE_OR_MINOR → Log and continue ``` **为什么用乘积 (Π) 而不是求和 (Σ)？** 漏洞交互是非线性的。三个“中危” bug 组合成严重攻击的危险程度，远比它们简单的数值总和更高 —— 这与 LLM 可解释性研究中关于内部特征向量超加和性协同激活 (supra-additive co-activation) 的发现相一致。 ## CognitiveSplitter 角色 (personas) | 分支 | Temperature | NeuroState | 角色 | |--------|------------|------------|------| | `ego-attacker` | 1.5 | Dopamine=100 | 寻找利用链 (exploit chains) | | `ego-defender` | 0.1 | Cortisol=100 | 提出缓解措施 | | `main-arbitrator` | 0.3 | Balanced | 进行调解且不破坏功能 | splitter 接受一个可选的 `llm_fn` 可调用对象，以便接入真实的 LLM： ``` def my_llm(branch_id: str, scenario: str, neurostate: dict) -> str: # Call your preferred LLM here ... engine = KMEEngine(llm_fn=my_llm) ``` 如果没有提供 `llm_fn`，KME 将使用确定性的基于规则的分析（无外部依赖）。 ## 与 Cognitive OS Ecosystem 的关系 ``` zero-width-subliminal → SubliminalCarrier (Layer 1) deja-vu-protocol → pattern recognition for known attack chains dream-cleansing → post-incident log compression & lesson extraction mandela-effect-injector → adversarial counterpart (rewrites failure history) CPOS anti-tamper chain → what KME is designed to stress-test KME = the external debugger for the cognitive OS stack = the adversarial simulation layer that surfaces what CPOS must defend ``` ## 背景 KME 诞生于构建 Kagioneko Cognitive OS ecosystem 的过程中。我们注意到，阈下通信 (subliminal communication) + 对抗性多角色推理 (adversarial multi-persona reasoning) + 漏洞利用链 (vulnerability chaining) 的架构，自然而然地汇聚到了前沿安全 AI 必须解决的相同结构性问题上。 链式评估公式和 3 角色辩论结构基于以下理论基础： - LLM 情绪向量研究（协同激活 → 超加和性行为转变） - 回路追踪 (Circuit tracing) 发现（并行的竞争性假设 + 抑制机制） - Constitutional AI 自我批评模式（生成器 + 批评者 + 仲裁者） ## 安装说明 ``` pip install -e ".[dev]" pytest # 64 tests ``` ## License MIT — Kagioneko Cognitive OS Ecosystem

标签：DLL 劫持, PyRIT, 人工智能, 多智能体系统, 大语言模型, 安全规则引擎, 用户模式Hook绕过, 认知模拟, 逆向工具