Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback

• URL: http://arxiv.org/abs/2608.29381v1
• Date: Sat, 29 Aug 2026 17:40:13 GMT
• Title: Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback
• Abstract summary: Checkpoint and rollback (C/R) are becoming essential for recovery, yet their security implications remain largely unexplored.<n>We present the first systematic security study of checkpoint and rollback in existing agent systems.
• Score: 18.855582025155268
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: AI agents are moving toward persistent, stateful execution across various applications, accumulating execution state and external effects that are costly to reconstruct after failures. Checkpoint and rollback (C/R) are becoming essential for recovery, yet their security implications remain largely unexplored. Correct rollback does not imply secure recovery: a faithfully restored checkpoint may resume an execution whose states, assumptions, and external effects never coexisted in any valid history. In this paper, we present the first systematic security study of checkpoint and rollback in existing agent systems. By examining representative agent C/R systems, we characterize the design space of existing C/R mechanisms and develop a general execution model that captures their recovery boundaries and state dependencies. From this model, we identify five fundamental failure modes spanning incomplete or inconsistent internal state, stale external dependencies, nondeterministic replay, and unrecorded external effects. We further demonstrate their security impact through three end-to-end attacks on Hermes, Cline, and LangGraph, enabling malware-verification bypass, unauthorized mail forwarding, and double payment. To systematically study these failures in practice, we develop a multi-agent analysis pipeline that reconstructs execution semantics, identifies violations of the five failure conditions, and validates them through actual rollback. Across five representative frameworks, our evaluation shows that these failures recur across heterogeneous C/R designs and stem from a common gap between the state restored by a checkpoint and the dependencies required for secure continuation.

Related papers

• Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle [65.6642776933861]
  This survey examines the protective paradigm that has grown around this intervention point.<n>We find that most protections are still validated mainly against static or weakly adaptive adversaries.<n>We close by consolidating cross-stage countermeasures and open problems for robust, composable, and deployable owner-side protection.
  arXiv  Detail & Related papers  (2026-08-05T00:46:50Z)
• DART: Semantic Recoverability for Structured Tool Agents [17.458285666498337]
  We introduce DART, a modular runtime that localizes a failed instance and certifies semantically recoverable boundaries.<n>We show that DART correctly recovers all evaluated commitment-sensitive cases where baseline local recovery fails.<n>These results show that controller legality does not imply semantic validity, and that sound local recovery requires an explicit admissibility check.
  arXiv  Detail & Related papers  (2026-05-22T07:30:43Z)
• On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
  Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
  arXiv  Detail & Related papers  (2026-05-12T09:56:28Z)
• Rewind-IL: Online Failure Detection and State Respawning for Imitation Learning [7.445072780282545]
  We present Rewind-IL, a training-free online safeguard framework for generative action-chunked imitation policies.<n> Rewind-IL combines a zero-shot failure detector based on Temporal Inter-chunk Discrepancy Estimate (TIDE), with split conformal prediction, with a state-respawning mechanism.<n>Online, Rewind-IL monitors self-consistency in overlapping action chunks, tracks similarity to the checkpoint library, and, upon failure, rewinds execution to the latest verified safe state.
  arXiv  Detail & Related papers  (2026-04-17T20:41:14Z)
• SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment [19.947119280467934]
  safeharness is a security architecture in which four proposed defense layers are woven directly into the agent lifecycle.<n>We evaluate safeharness on benchmark datasets across diverse harness configurations.
  arXiv  Detail & Related papers  (2026-04-15T08:59:00Z)
• ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore [3.0122754959023115]
  LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration.<n>This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents.<n>Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects.<n>We propose ACRFence, a framework-a mitigation that records irreversible tool effects and enforces replay-or-gnostic semantics upon restoration.
  arXiv  Detail & Related papers  (2026-03-21T03:39:36Z)
• RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic [56.38397499463889]
  Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks.<n>However, they remain vulnerable to hazardous instructions that may trigger unsafe behaviors.<n>We propose RoboSafe, a runtime safeguard for embodied agents through executable predicate-based safety logic.
  arXiv  Detail & Related papers  (2025-12-24T15:01:26Z)
• It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications [3.903754621026016]
  Rebound is a general-purpose security framework that preserves rollback protection while enabling policy-authorized legitimate rollbacks of application binaries, configuration, and data.<n>Key to Rebound is a reference monitor that mediates state transitions, enforces authorization policy, guarantees atomicity of state updates and rollbacks, and emits a tamper-evident log that provides transparency to applications and auditors.
  arXiv  Detail & Related papers  (2025-11-17T17:53:47Z)
• Making LLMs Reliable When It Matters Most: A Five-Layer Architecture for High-Stakes Decisions [51.56484100374058]
  Current large language models (LLMs) excel in verifiable domains where outputs can be checked before action but prove less reliable for high-stakes strategic decisions with uncertain outcomes.<n>This gap, driven by mutually cognitive biases in both humans and artificial intelligence (AI) systems, threatens the defensibility of valuations and sustainability of investments in the sector.<n>This report describes a framework emerging from systematic qualitative assessment across 7 frontier-grade LLMs and 3 market-facing venture vignettes under time pressure.
  arXiv  Detail & Related papers  (2025-11-10T22:24:21Z)
• When Models Outthink Their Safety: Mitigating Self-Jailbreak in Large Reasoning Models with Chain-of-Guardrails [74.63933201261595]
  Large Reasoning Models (LRMs) demonstrate remarkable capabilities on complex reasoning tasks.<n>LRMs remain vulnerable to severe safety risks, including harmful content generation and jailbreak attacks.<n>We propose the Chain-of-Guardrail (CoG), a training framework that recomposes or backtracks unsafe reasoning steps.
  arXiv  Detail & Related papers  (2025-10-24T09:32:25Z)
• CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention [68.95008546581339]
  Existing decoding-time interventions, such as Contrastive Decoding, often force a severe trade-off between safety and response quality.<n>We propose CARE, a novel framework for decoding-time safety alignment that integrates three key components.<n>The framework achieves a superior balance of safety, quality, and efficiency, attaining a low harmful response rate and minimal disruption to the user experience.
  arXiv  Detail & Related papers  (2025-09-01T04:50:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.