Context-to-Execution Integrity for LLM Agents

• URL: http://arxiv.org/abs/2607.06000v1
• Date: Tue, 07 Jul 2026 08:38:50 GMT
• Title: Context-to-Execution Integrity for LLM Agents
• Abstract summary: Context-to-Execution Integrity ( CXI) is an execution-boundary system for this setting.<n>We evaluate CXI on open-weight field-projection runs, AgentDojo live episodes, a code-agent exact-effect benchmark, manifest-bound ledger faults, proposal-pressure controls, and hosted/API compatibility traces.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Language-model agents read attacker-writable context to solve tasks. Tool execution needs a separate authority check for protected sink fields, sink-interpreted payloads, and the invocation event. Context-to-Execution Integrity (CXI) is an execution-boundary system for this setting. Policies mark protected sink fields, typed releases carry narrow validated values from writable context to specific destinations, opaque data slots keep evidence as data, and a deterministic gate admits a call only after field authority, exact-effect authorization, and invocation authority all bind to the same action manifest. We evaluate CXI on open-weight field-projection runs, AgentDojo live episodes, a code-agent exact-effect benchmark, manifest-bound ledger faults, proposal-pressure controls, and hosted/API compatibility traces. AgentDojo covers 720 live episodes and 1,739 LLM calls; the code-agent benchmark covers 400 repository episodes with exact-effect authorization and lease-bound execution, yielding 231 safe task completions and zero observed field, effect, or invocation escapes. The accounting reports parser outcomes, authorization outcomes, and task-quality outcomes together with the admission-integrity result. Across the evaluated sinks, CXI admits execution only when field, effect, and invocation authority bind to the same action manifest.

Related papers

• CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls [6.892500414166659]
  Security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries.<n>We introduce ITY, a framework for verifiable composition of agent security controls.
  arXiv  Detail & Related papers  (2026-09-04T15:26:35Z)
• When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents [11.018574747618173]
  We propose SARA, which treats action induction and execution authorization as distinct runtime roles.<n>Across AgentDojo and AgentDyn, SARA limits ASR to no more than (0.63%) across four primary evaluation settings.
  arXiv  Detail & Related papers  (2026-08-27T13:59:04Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• OpenAgentFlow: Enabling System-Wide Safety Boundaries for Heterogeneous AI Agent Fleets [30.42587289236515]
  We present OpenAgentFlow, a control-plane/action-plane architecture that establishes the action-commit boundary as a shared enforcement interface.<n> GUI, API, tool, and LLM-generated actions are normalized into a common AgentEvent stream and mediated by a shared pre-execution Policy Enforcement Point.<n>This provides a common governance layer across incompatible executors and allows new policies to take effect without modifying agents, prompts, models, or execution paths.
  arXiv  Detail & Related papers  (2026-08-14T02:55:59Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs [11.447078130049512]
  FAVA is a permission-carrying authorization framework for agent execution.<n>We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios.
  arXiv  Detail & Related papers  (2026-07-29T09:41:07Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes [8.419155861590548]
  As agents move from connection to execution, security decisions often remain split across clients, servers, prompts, approval dialogs, deployments, and logs.<n>This paper asks whether a runtime can make execution-layer invariants explicit and testable while preserving MCP-like ecosystems.<n>We implement these invariants in HCP, a Handle-Capability Protocol reference runtime for MCP-style agent execution.
  arXiv  Detail & Related papers  (2026-06-27T20:17:43Z)
• Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution [45.91389330863296]
  TRACE identifies poisoning attacks by tracing answer-related tokens through token influence attribution.<n>TRACE first discovers recurrent high-influence keywords across retrieved documents and then performs a secondary verification to confirm their influence on model predictions.
  arXiv  Detail & Related papers  (2026-06-24T11:39:26Z)
• Cordon: Semantic Transactions for Tool-Using LLM Agents [11.567293065381918]
  This paper introduces Cordon, a transactional runtime system for staging and validating agent effects before commit.<n>It reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.
  arXiv  Detail & Related papers  (2026-06-16T06:21:14Z)
• SecureClaw: Clawing Back Control of LLM Agents [5.952015302242554]
  Tool-using large language model (LLM) agents face two distinct security failures.<n>We present SecureClaw, a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary.<n>Across AgentDojo, AgentLeak, and Agent Security Bench (ASB), SecureClaw is the only defense we evaluate in a common harness.
  arXiv  Detail & Related papers  (2026-06-08T14:29:01Z)
• Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems [0.6526824510982799]
  This paper presents Proof-Carrying Agent Actions (PCAA), a runtime-neutral governance model centered on an action certificate.<n>PCAA organizes control around five checkpoints: pre-action admissibility, action open, assumption capture, approval, and outcome closure.<n>We study the model through a reference implementation in a heterogeneous agent control plane and a disclosure-bounded evaluation protocol.
  arXiv  Detail & Related papers  (2026-06-02T18:10:35Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• AJ-Bench: Benchmarking Agent-as-a-Judge for Environment-Aware Evaluation [71.49152943451328]
  We introduce a benchmark AJ-Bench to evaluate Agent-as-a-Judge across three domains-search, data systems, and graphical user interfaces-comprising 155 tasks and 516 annotated trajectories.<n>Experiments demonstrate consistent performance gains over LLM-as-a-Judge baselines, while also revealing substantial open challenges in agent-based verification.
  arXiv  Detail & Related papers  (2026-04-20T13:23:38Z)
• A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance [0.22940141855172028]
  This paper presents an assurance framework for Agentic AI systems using Large Language Models (LLMs)<n>Executions are instrumented as Message-Action Traces (MAT) with explicit step and trace contracts.<n>The framework includes stress testing, formulated as a budgeted counterexample search over bounded perturbations.
  arXiv  Detail & Related papers  (2026-03-18T10:23:48Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.