ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore

• URL: http://arxiv.org/abs/2603.20625v1
• Date: Sat, 21 Mar 2026 03:39:36 GMT
• Title: ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
• Abstract summary: LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration.<n>This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents.<n>Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects.<n>We propose ACRFence, a framework-a mitigation that records irreversible tool effects and enforces replay-or-gnostic semantics upon restoration.
• Score: 3.0122754959023115
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects; we term these semantic rollback attacks. We identify two attack classes, Action Replay and Authority Resurrection, validate them in a proof of concept experiment, and confirm that the problem has been independently acknowledged by framework maintainers. We propose ACRFence, a framework-agnostic mitigation that records irreversible tool effects and enforces replay-or-fork semantics upon restoration

Related papers

• Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems [1.3891530345631953]
  We measure five agent-memory systems and find no system enforces revocation by default.<n>We develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
  arXiv  Detail & Related papers  (2026-09-08T05:03:09Z)
• Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback [18.855582025155268]
  Checkpoint and rollback (C/R) are becoming essential for recovery, yet their security implications remain largely unexplored.<n>We present the first systematic security study of checkpoint and rollback in existing agent systems.
  arXiv  Detail & Related papers  (2026-08-29T17:40:13Z)
• Finding Where the Buck Stops: An Automated Failure Attribution-Based Reflection Framework for Multi-Agent Collaboration [14.41671360589919]
  DoCtOR (Diagnose-then-Correct PPO-enhanced Reflection) is a novel reflection framework that enhances multi-agent collaboration.<n>DoCtOR achieves 22%, 26%, and 27% improvements over initial success rates on HotPotQA, ChartQAPro, and Mind2Web datasets.
  arXiv  Detail & Related papers  (2026-08-28T12:26:03Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• Where Do Deep-Research Agents Go Wrong? Span-Level Error Localization in Agent Trajectories [51.22051230894794]
  Evaluation based on final answers shows whether an agent succeeds, but not which parts of the trajectory make the answer unreliable.<n>We collect 2,790 real trajectories from two agent frameworks, three backbone models, and three benchmarks, convert raw logs into semantic spans, and annotate harmful error spans through expert review.<n>We propose DRIFT, a claim-centric auditing framework that tracks agent claims, checks their support in trajectory evidence, and marks spans where unsupported or conflicting claims affect the answer path.
  arXiv  Detail & Related papers  (2026-06-01T10:50:26Z)
• MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair [10.709112246848058]
  Modern software ecosystems face a rapidly growing number of disclosed vulnerabilities.<n>Most existing systems treat vulnerability repair as a single generation step over the currently visible code context.<n>We present MemRepair, a memoryaugmented agentic framework that formulates vulnerability repair as an iterative, experience-driven process.
  arXiv  Detail & Related papers  (2026-05-17T13:29:46Z)
• Learning from Trials and Errors: Reflective Test-Time Planning for Embodied LLMs [63.88783817420284]
  Embodied robots cannot reflect on what went wrong or why, turning deployment into a sequence of independent trials.<n>We introduce Reflective Test-Time Planning, which integrates two modes of reflection: textitreflection-in-action and textitreflection-on-action<n>We also include retrospective reflection, allowing the agent to re-evaluate earlier decisions and perform model updates with hindsight.
  arXiv  Detail & Related papers  (2026-02-24T18:55:18Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• PreFlect: From Retrospective to Prospective Reflection in Large Language Model Agents [30.225072803272273]
  We introduce PreFlect, a prospective reflection mechanism that shifts the paradigm from post hoc correction to pre-execution foresight.<n>We distill planning errors from historical agent trajectories, capturing recurring success and failure patterns observed across past executions.
  arXiv  Detail & Related papers  (2026-02-06T20:42:44Z)
• RE-TRAC: REcursive TRAjectory Compression for Deep Search Agents [144.5598958575922]
  Re-TRAC is an agentic framework that performs cross-trajectory exploration.<n>We show that Re-TRAC consistently outperforms ReAct by 15-20% on BrowseComp with frontier LLMs.
  arXiv  Detail & Related papers  (2026-02-02T18:58:07Z)
• DoVer: Intervention-Driven Auto Debugging for LLM Multi-Agent Systems [48.971606069204825]
  DoVer is an intervention-driven debug framework for large language model (LLM)-based multi-agent systems.<n>It augments hypothesis generation with active verification through targeted interventions.<n>DoVer flips 18-28% of failed trials into successes, achieves up to 16% milestone progress, and validates or refutes 30-60% of failure hypotheses.
  arXiv  Detail & Related papers  (2025-12-07T09:23:48Z)
• It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications [3.903754621026016]
  Rebound is a general-purpose security framework that preserves rollback protection while enabling policy-authorized legitimate rollbacks of application binaries, configuration, and data.<n>Key to Rebound is a reference monitor that mediates state transitions, enforces authorization policy, guarantees atomicity of state updates and rollbacks, and emits a tamper-evident log that provides transparency to applications and auditors.
  arXiv  Detail & Related papers  (2025-11-17T17:53:47Z)
• ReSeek: A Self-Correcting Framework for Search Agents with Instructive Rewards [18.92867715736209]
  We propose ReSeek, a novel self-correcting framework for training search agents.<n>Our framework introduces a self-correction mechanism that empowers the agent to dynamically identify and recover from erroneous search paths.<n>To mitigate the risk of data contamination in existing datasets, we introduce FictionalHot.
  arXiv  Detail & Related papers  (2025-10-01T06:44:28Z)
• Retrieval-Augmented Generation by Evidence Retroactivity in LLMs [19.122314663040726]
  Retroactive Retrieval-Augmented Generation (RetroRAG) is a novel framework to build a retroactive reasoning paradigm.<n>RetroRAG revises and updates the evidence, redirecting the reasoning chain to the correct direction.<n> Empirical evaluations show that RetroRAG significantly outperforms existing methods.
  arXiv  Detail & Related papers  (2025-01-07T08:57:42Z)
• Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection [74.51523859064802]
  We introduce a new framework called Self-Reflective Retrieval-Augmented Generation (Self-RAG) Self-RAG enhances an LM's quality and factuality through retrieval and self-reflection. It significantly outperforms state-of-the-art LLMs and retrieval-augmented models on a diverse set of tasks.
  arXiv  Detail & Related papers  (2023-10-17T18:18:32Z)
• ReFIT: Relevance Feedback from a Reranker during Inference [109.33278799999582]
  Retrieve-and-rerank is a prevalent framework in neural information retrieval. We propose to leverage the reranker to improve recall by making it provide relevance feedback to the retriever at inference time.
  arXiv  Detail & Related papers  (2023-05-19T15:30:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.