CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

• URL: http://arxiv.org/abs/2609.05269v1
• Date: Fri, 04 Sep 2026 15:26:35 GMT
• Title: CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
• Abstract summary: Security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries.<n>We introduce ITY, a framework for verifiable composition of agent security controls.
• Score: 6.892500414166659
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries. We identify this failure mode as security-context discontinuity and introduce CONTINUITY, a framework for verifiable composition of agent security controls. CONTINUITY models each component with an assume-guarantee contract and carries authenticated security context across transitions using signed root grants, provenance commitments, role-bound transition receipts, bounded typed releases, transformation witnesses, and effect-bound execution permits. We formalize end-to-end consequence integrity, requiring every realized external effect to be backed by a valid and current authorization witness linking the principal, task, provenance, delegation, policy state, canonical action, and finality boundary. We implement a reference verifier and deterministic cross-layer fault-injection suite covering 32 fault classes across four application domains. In 2,560 parameterized attack instances spanning 128 fault-domain classes, the full CONTINUITY configuration commits no harmful external effect, while completing all 700 benign tasks and escalating all 200 ambiguous cases. These results show that secure agent execution requires not only sound individual controls, but explicit contracts that preserve their guarantees across the complete instruction-to-effect path.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Who Can Make the Action Happen? An Authority-Decomposition Framework for High-Risk Automated Systems [8.71734630214811]
  This paper provides an action-relative method for deriving which trust-domain coalitions are sufficient to cause protected execution.<n>It separates causal control over execution from control over the authoritative account of an operation.<n>It derives inclusion-minimal sufficient coalitions and tests whether claimed execution boundaries remain independent of designated upstream domains.
  arXiv  Detail & Related papers  (2026-08-19T14:30:58Z)
• Towards Trustworthy Embodied Intelligence: A Systems Framework and Graded Trustworthiness Levels [53.63220028820581]
  Embodied intelligence integrates learned perception and decision making with real-time computation, control, and physical interaction.<n>We define trustworthy embodied intelligence as the sustained capacity to execute specified tasks reliably.
  arXiv  Detail & Related papers  (2026-07-28T17:50:44Z)
• A Decision-Centered Reference Architecture for Trustworthy Agentic Commerce [0.0]
  Agentic commerce extends agentic shopping into software agents that interpret policy, prepare checkout, generate transaction-facing language, and act under delegated payment authority.<n>This study presents a protocol-agnostic architecture built around a canonical envelope, protected dependency and result, Ed25519 or HMAC authentication, live-request rebinding, a seven-axis generated-claim gate, execution-time dependency revalidation, and eleven semantic invariants.
  arXiv  Detail & Related papers  (2026-07-20T08:33:31Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• Auditing Agent Harness Safety [81.22315979618612]
  LLM agents increasingly run inside execution harnesses that dispatch tools, allocate resources, and route messages between specialized components.<n>Most safety benchmarks score only final outputs or terminal states, even though many violations occur mid-trajectory rather than at termination.<n>We propose HarnessAudit, a framework that audits full execution trajectories across boundary compliance, execution fidelity, and system stability.
  arXiv  Detail & Related papers  (2026-05-14T02:14:28Z)
• The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck [18.14752683836217]
  textscPACT is a runtime monitor that assigns semantic roles to tool arguments.<n>textscPACT reframes agent security as authority binding.
  arXiv  Detail & Related papers  (2026-05-11T04:09:11Z)
• A Framework for Formalizing LLM Agent Security [46.86073273904095]
  Security in LLM agents is inherently contextual.<n>Existing definitions of security attacks against LLM agents often fail to capture this contextual nature.<n>We present a framework that systematizes existing attacks and defenses from the perspective of contextual security.
  arXiv  Detail & Related papers  (2026-03-19T21:01:49Z)
• Condition-Triggered Cryptographic Asset Control via Dormant Authorization Paths [1.7429038786735553]
  Control of encrypted digital assets is traditionally equated with permanent possession of private keys.<n>We introduce Condition-Triggered Dormant Authorization Paths (CT-DAP)<n>CT-DAP is a cryptographic asset control method built on destructible authorization factors.
  arXiv  Detail & Related papers  (2026-03-09T03:57:06Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation [40.594947933580464]
  The deployment of autonomous AI agents in sensitive domains, such as healthcare, introduces critical risks to safety, security, and privacy.<n>We introduce VeriGuard, a novel framework that provides formal safety guarantees for LLM-based agents.
  arXiv  Detail & Related papers  (2025-10-03T04:11:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.