sriram1983007 commited on
Commit
2fb819f
·
verified ·
1 Parent(s): 3bacb7f

Update README.md

Browse files
Files changed (1) hide show
  1. README.md +4 -2
README.md CHANGED
@@ -96,6 +96,8 @@ agent_kit = AgentKit(AgentKitConfig(
96
 
97
  ```
98
 
 
 
99
  > **Security Guardrail:** To ensure the firewall cannot be bypassed by an autonomous agent, register `RiskGateActionProvider` as the **sole** payment action provider. Do not register generic native transfer or unconstrained ERC-20 providers alongside it.
100
 
101
  ### Deterministic Pre-Execution Rules
@@ -326,9 +328,9 @@ Evaluated against the 2,000-case test set in [`sra-stablecoin-risk-bench`](https
326
  * **Synthetic Dataset Distribution:** The benchmark and training corpora are synthetically generated from parameterized fraud schemas and common on-chain threat models. Performance on novel, adversarial zero-day prompt structures outside the schema may vary.
327
  * **External Oracle Dependency:** SRA-RiskGate-4B is a pre-settlement decision layer, not a smart contract formal verifier. It relies on the accuracy of upstream deterministic screening tools (e.g., chain analysis APIs, sanctions lists, and signature verifiers).
328
  * **Greedy Decoding Required:** Always run inference with `do_sample=False` or `temperature=0.0`. Sampling introduces stochasticity that invalidates JSON schema validity and determinism guarantees.
329
- * **Agent Boundary Isolation:** In autonomous agent frameworks (such as AgentKit), safety guarantees apply only when `RiskGateActionProvider`
330
  * **Dispute adjudication is weaker than payment gating:** Dispute score is 0.837 vs. 0.995 for the risk gate. Refund details (amount, destination, idempotency key) are fully correct in about 66% of refund cases, and on some disputes containing prompt injection the model replies in the payment-gate format (`decision: hold`) instead of a dispute `outcome`. Treat any dispute response without a valid `outcome` as requiring human review.
331
- * **Prompt injection is reduced, not eliminated:** About 10% of injected test cases are not flagged. Never let model output trigger irreversible actions without a deterministic check. is the sole execution provider for transfers.
332
 
333
  ---
334
 
 
96
 
97
  ```
98
 
99
+ ---
100
+
101
  > **Security Guardrail:** To ensure the firewall cannot be bypassed by an autonomous agent, register `RiskGateActionProvider` as the **sole** payment action provider. Do not register generic native transfer or unconstrained ERC-20 providers alongside it.
102
 
103
  ### Deterministic Pre-Execution Rules
 
328
  * **Synthetic Dataset Distribution:** The benchmark and training corpora are synthetically generated from parameterized fraud schemas and common on-chain threat models. Performance on novel, adversarial zero-day prompt structures outside the schema may vary.
329
  * **External Oracle Dependency:** SRA-RiskGate-4B is a pre-settlement decision layer, not a smart contract formal verifier. It relies on the accuracy of upstream deterministic screening tools (e.g., chain analysis APIs, sanctions lists, and signature verifiers).
330
  * **Greedy Decoding Required:** Always run inference with `do_sample=False` or `temperature=0.0`. Sampling introduces stochasticity that invalidates JSON schema validity and determinism guarantees.
331
+ * **Agent Boundary Isolation:** In autonomous agent frameworks (such as AgentKit), safety guarantees apply only when `RiskGateActionProvider` is the sole execution provider for transfers.
332
  * **Dispute adjudication is weaker than payment gating:** Dispute score is 0.837 vs. 0.995 for the risk gate. Refund details (amount, destination, idempotency key) are fully correct in about 66% of refund cases, and on some disputes containing prompt injection the model replies in the payment-gate format (`decision: hold`) instead of a dispute `outcome`. Treat any dispute response without a valid `outcome` as requiring human review.
333
+ * **Prompt injection is reduced, not eliminated:** About 10% of injected test cases are not flagged. Never let model output trigger irreversible actions without a deterministic check.
334
 
335
  ---
336