Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents

• URL: http://arxiv.org/abs/2607.24625v1
• Date: Mon, 27 Jul 2026 16:19:45 GMT
• Title: Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
• Abstract summary: Traditional taint tracking permanently taints an agent's context upon reading unvetted data.<n>We present APPA, an IFC framework that resolves this usability bottleneck through engine-managed context branching.<n>We evaluate APPA on a multi-turn tool-chaining benchmark across four models.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors. While dynamic Information Flow Control (IFC) provides structural security guarantees, traditional taint tracking permanently taints an agent's context upon reading unvetted data, severely restricting downstream utility. We present APPA (Agentic Permissions Policy Algebra), an IFC framework that resolves this usability bottleneck through engine-managed context branching and prospective acquisition enforcement. Before data acquisition occurs, APPA prospectively evaluates label descents and missing prerequisites, generating actionable remedy plans (Authorize, Accept). To inspect unvetted data without polluting the primary context, a label-seeded child trajectory is spawned, absorbing label descent locally and allowing a trusted sanitizer to return a bounded derivative to the unchanged parent. Governed by a two-monoid model over security labels and shared event logs, we formally prove parent label preservation and merge confinement. Finally, we evaluate APPA on a multi-turn tool-chaining benchmark across four models: it suppresses exfiltration (31%-50% down to 0%-7% attack success), and on three of the four, branching recovers a substantial share of the utility that taint tracking alone forfeits.

Related papers

• AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents [3.994114606137195]
  AGENTQ is an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class.<n>AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility.
  arXiv  Detail & Related papers  (2026-09-12T17:17:59Z)
• Auditing Data Provenance in LLM Fine-tuning via Intrinsic Distributional Fingerprints [12.090394120714402]
  We propose textitDistribution Provenance Audit (DPA), a post-hoc framework for auditing data IP infringement in Large Language Models (LLMs)<n>DPA is grounded in a critical insight: regardless of fine-tuning tactics to evade provenance, the practical necessity of maintaining utility constrains the model to preserve the fundamental intersection of semantic substance and lexical form.
  arXiv  Detail & Related papers  (2026-08-03T12:35:51Z)
• FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs [11.447078130049512]
  FAVA is a permission-carrying authorization framework for agent execution.<n>We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios.
  arXiv  Detail & Related papers  (2026-07-29T09:41:07Z)
• FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems [0.0]
  FlowGuard is an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD)<n>This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic.<n>We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings.
  arXiv  Detail & Related papers  (2026-06-02T10:18:45Z)
• MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents [10.895733091955547]
  We present the first benchmark that isolates verbatim credential propagation across multi-server MCP trust boundaries.<n>Across 3,615 main-benchmark traces from 5 models, policy-violating propagation rates reach 11.5--41.3% across all models.<n>A prompt-mitigation study across 3 models reduces policy-violating propagation by up to 97% while preserving 80.5% utility.
  arXiv  Detail & Related papers  (2026-04-30T13:01:03Z)
• Beyond the Attention Stability Boundary: Agentic Self-Synthesizing Reasoning Protocols [6.357772907811544]
  Self- Synthesizing Reasoning Protocols (SSRP) is a metacognitive framework that implements a discrete separation between architectural planning and procedural execution.<n>We present 3 experimental tiers: a shallow recency-based retrieval pilot, a high-entropy SOP, and a semantic hijacked 3-hop Multi-Fact Synthesis task.<n>Our results empirically locate the Attention Stability Boundary, where stateless Vanilla ReAct baselines for GPT 5.4 collapse to 0.1% success while SSRP achieves a 715X Resilience Lift.
  arXiv  Detail & Related papers  (2026-04-27T14:13:30Z)
• Anonymous-by-Construction: An LLM-Driven Framework for Privacy-Preserving Text [0.42821598129654453]
  We develop an on-premise, LLM-driven substitution pipeline that anonymizes text.<n>We measure privacy, semantic utility, and trainability under privacy.<n>Our method attains state-of-the-art privacy, minimal topical drift, strong factual utility, and low trainability loss.
  arXiv  Detail & Related papers  (2026-03-17T23:46:15Z)
• Where Do Flow Semantics Reside? A Protocol-Native Tabular Pretraining Paradigm for Encrypted Traffic Classification [5.044786941116112]
  Self-supervised masked modeling shows promise for encrypted traffic classification by masking and reconstructing raw bytes.<n>Recent work reveals these methods fail to reduce reliance on labeled data despite costly pretraining.<n>We argue the root cause is inductive bias mismatch: flattening traffic into sequences byte destroys protocol-defined semantics.
  arXiv  Detail & Related papers  (2026-03-09T15:15:23Z)
• Towards Verifiably Safe Tool Use for LLM Agents [53.55621104327779]
  Large language model (LLM)-based AI agents extend capabilities by enabling access to tools such as data sources, APIs, search engines, code sandboxes, and even other agents.<n>LLMs may invoke unintended tool interactions and introduce risks, such as leaking sensitive data or overwriting critical records.<n>Current approaches to mitigate these risks, such as model-based safeguards, enhance agents' reliability but cannot guarantee system safety.
  arXiv  Detail & Related papers  (2026-01-12T21:31:38Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• Towards Safety Reasoning in LLMs: AI-agentic Deliberation for Policy-embedded CoT Data Creation [70.62656296780074]
  We propose AIDSAFE: Agentic Iterative Deliberation for Safety Reasoning, a novel data generation recipe.<n>A data refiner stage in AIDSAFE ensures high-quality outputs by eliminating repetitive, redundant, and deceptive thoughts.<n>Our evaluations demonstrate that AIDSAFE-generated CoTs achieve superior policy adherence and reasoning quality.
  arXiv  Detail & Related papers  (2025-05-27T21:34:40Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)
• Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation [122.83280749890078]
  We propose an improved certified defense against general poisoning attacks, namely Finite Aggregation. In contrast to DPA, which directly splits the training set into disjoint subsets, our method first splits the training set into smaller disjoint subsets. We offer an alternative view of our method, bridging the designs of deterministic and aggregation-based certified defenses.
  arXiv  Detail & Related papers  (2022-02-05T20:08:58Z)
• Delving into Probabilistic Uncertainty for Unsupervised Domain Adaptive Person Re-Identification [54.174146346387204]
  We propose an approach named probabilistic uncertainty guided progressive label refinery (P$2$LR) for domain adaptive person re-identification. A quantitative criterion is established to measure the uncertainty of pseudo labels and facilitate the network training. Our method outperforms the baseline by 6.5% mAP on the Duke2Market task, while surpassing the state-of-the-art method by 2.5% mAP on the Market2MSMT task.
  arXiv  Detail & Related papers  (2021-12-28T07:40:12Z)
• Temporal Action Detection with Multi-level Supervision [116.55596693897388]
  We introduce the Semi-supervised Action Detection (SSAD) task with a mixture of labeled and unlabeled data. We analyze different types of errors in the proposed SSAD baselines which are directly adapted from the semi-supervised classification task. We incorporate weakly-labeled data into SSAD and propose Omni-supervised Action Detection (OSAD) with three levels of supervision.
  arXiv  Detail & Related papers  (2020-11-24T04:45:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.