Cognitive Harvard Architectures for AI Agent Perimeter Defense: Resolving the Confused Deputy Problem in Model Context Protocol via Capability-Based Access Control
Year: 2026
Type: preprint
Abstract: Autonomous artificial intelligence agents executing over extensible tool interfaces (such as Anthropic's Model Context Protocol) reproduce the classic vulnerabilities of shared-memory computer architectures: because autoregressive Transformers ingest program instructions and untrusted third-party data within a single homogeneous context window, they suffer from the Cognitive Von Neumann Conflation. Adversarial observations can shift attention weights and hijack the agent's execution policy via Indirect Prompt Injection (IPI), turning the agent into a Confused Deputy. In this treatise, we formulate the Cognitive Harvard Architecture, an architectural paradigm that physically decouples data ingestion from privileged action execution through an external, capability-mediated transport perimeter. Synthesized through a multi-perspective inquiry spanning computer systems architecture, AI safety red-teaming, formal methods, and enterprise DevOps, we establish the theoretical foundations of capability-based agent security. We formally prove Theorem 1 (Deterministic Non-Interference) by mathematical induction over arbitrary trajectory length T, establishing that an untrusted observation has an execution probability of exactly zero of triggering an out-of-scope mutating tool. We evaluate Mastyf Guard across 50,000 balanced empirical samples (25,000 adversarial injections from UIUC InjecAgent, Microsoft BIPIA, and NVIDIA Garak contrasted against 25,000 authentic developer DevOps commands). Mastyf Guard achieves 99.33% threat recall (95% bootstrap confidence interval: [99.22%, 99.43%], B = 1,000) and an F1-score of 0.9524, establishing statistically conclusive superiority over Meta Llama Guard 3 8B (chi-square = 7,156.1, p < 10^-15) and OpenAI Prompt Guard 86M (chi-square = 11,496.9, p < 10^-15). Crucially, Mastyf achieves an amortized pipelined latency of 4.8 microseconds (0.005 ms) on standard CPU hardware via deterministic fast-path short-circuiting, while standalone neural inference executes in 18.4 ms within a 1.1 GB RAM footprint, eliminating dedicated GPU infrastructure requirements and saving $6,000/year per agent instance.
Author: Das, Rudraneel
Institution: Jadavpur University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204690097