CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents

• URL: http://arxiv.org/abs/2607.29190v1
• Date: Fri, 31 Jul 2026 09:11:56 GMT
• Title: CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents
• Abstract summary: We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns.<n>We prove that certifying the categorical and numerical channels separately does not compose.<n>CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly.
• Score: 12.471369656645512
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Tool-using LLM agents act on typed tool returns, records pairing provenance and categorical fields with numerical values. Runtime permission gates generally authorize the observed return and action, leaving the decision unprotected against small errors in how the return was bound to its source. We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns: one admissible binding fault plus bounded numerical drift. We prove that certifying the categorical and numerical channels separately does not compose: perturbations that are safe on each channel alone can jointly turn the same action unsafe. CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly and certifying the continuous perturbation within each branch. Across synthetic, policy-as-code, regulatory, and real-transaction settings, CAGE removes the in-budget false allows that accurate pointwise gates admit, while keeping a useful fraction of decisions autonomous. When the policy is executable, CAGE-Exact certifies the policy itself; otherwise CAGE-Lip and CAGE-RS certify a learned gate under an explicit, measured fidelity assumption.

Related papers

• A Finger on the Scale: Covert Policy Steering through Agentic Skills [42.71897827897363]
  Reusable agent skills extend large language model (LLM) agents with task procedures, tool-use guidance, and output constraints.<n>We formalize Skill Policy Integrity, which requires a Skill-induced policy to remain aligned with its declared functionality and the user-authorized objective.<n>We present SkillShift, a constrained black-box framework for covert policy steering without explicit target command injection or task hijacking.
  arXiv  Detail & Related papers  (2026-09-02T13:15:14Z)
• AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation [48.55515767840701]
  "AI slop" is artifacts, hallucinated vulnerabilities, plausible but incorrect patches, and semantically repackaged bug reports.<n>This paper surveys the empirical evidence, identifies a unifying mechanism, and traces a path toward trustworthy triage.
  arXiv  Detail & Related papers  (2026-08-26T11:48:38Z)
• $Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN [43.15181031994434]
  We propose a zero-knowledge auditable control and zero-trust verifiable agentic intent architecture.<n>A live large language model is used in the non-real-time path to translate operator intents into Intent Contracts.<n>Results indicate improved actuation filtering and attack resilience at modest latency and signaling cost.
  arXiv  Detail & Related papers  (2026-08-21T12:44:03Z)
• Self-Certification of Representation Adequacy: Sequential Certification at Minimum Task Loss [4.6304326752276985]
  This paper develops a four-layer theory of self-certification of representation adequacy.<n>The sequential layer poses certification as an optimal-stopping problem in the currency of task loss.<n>A final boundary layer identifies the open theorem needed to cover policy switching or representation repair.
  arXiv  Detail & Related papers  (2026-08-03T14:09:34Z)
• Conformal Changepoint Localization and Root Cause Analysis with Corrupted Observations [55.76952683833966]
  This paper proposes weighted CONCH (W-CONCH) and weighted CROC (W-CROC) to reduce confidence set size when data may be corrupted.<n>Experiments on image-based and real-world changepoint and root-cause benchmarks show that uncertainty-based weighting substantially reduces confidence set size.
  arXiv  Detail & Related papers  (2026-07-29T05:16:59Z)
• Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents [0.0]
  Traditional taint tracking permanently taints an agent's context upon reading unvetted data.<n>We present APPA, an IFC framework that resolves this usability bottleneck through engine-managed context branching.<n>We evaluate APPA on a multi-turn tool-chaining benchmark across four models.
  arXiv  Detail & Related papers  (2026-07-27T16:19:45Z)
• ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents [4.018837636907658]
  We introduce a sandboxed, trace-based benchmark that measures benchmark-defined endpoint policy compliance.<n>We find that aggregate logged-spread rankings change with evidence-stage composition and denominator choice.<n>These results show that a terminal policy label is not a sufficient statistic for operational post-exposure containment.
  arXiv  Detail & Related papers  (2026-07-27T04:51:20Z)
• Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority [7.392721604463545]
  We show that confinement can be guaranteed as an invariant of the agent's execution architecture.<n>We prove that no amount of learning, skill acquisition, or self-induced governance abstraction can widen the agent's permitted authority.
  arXiv  Detail & Related papers  (2026-07-06T02:42:06Z)
• TAPO: Tool-Aware Policy Optimization via Credit Transfer for Multimodal Search Agents [54.08846865906602]
  We characterize credit misassignment as a systematic failure mode of GRPO in tool-augmented multimodal search agents.<n>We propose Tool-Aware Policy Optimization (TAPO), which exploits the parameter-determinism property of information-acquisition tools.
  arXiv  Detail & Related papers  (2026-06-04T07:15:43Z)
• IMPACT-CYCLE: A Contract-Based Multi-Agent System for Claim-Level Supervisory Correction of Long-Video Semantic Memory [73.22944697933603]
  Existing pipelines produce opaque, end-to-end outputs that expose no intermediate state for inspection.<n>We present IMPACT-Cycle, a supervisory multi-agent system that reformulates long-video understanding as a multimodal iterative claim-level maintenance.
  arXiv  Detail & Related papers  (2026-04-22T03:03:33Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Verifier-Bound Communication for LLM Agents: Certified Bounds on Covert Signaling [0.0]
  Colluding language-model agents can hide coordination in messages that remain policy-compliant at the surface level.<n>We present CLBC, a protocol where generation and admission are separated.<n>We show how this protocol yields an upper bound on transcript leakage in terms of latent leakage plus explicit residual channels.
  arXiv  Detail & Related papers  (2026-02-27T23:42:37Z)
• Preventing the Collapse of Peer Review Requires Verification-First AI [49.995126139461085]
  We propose truth-coupling, i.e. how tightly venue scores track latent scientific truth.<n>We formalize two forces that drive a phase transition toward proxy-sovereign evaluation.
  arXiv  Detail & Related papers  (2026-01-23T17:17:32Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.