{"id":"0d75aa1c-6022-4f74-baf7-c4f7018cf58e","arxiv_id":"2512.06716","paper_version":3,"verdict":"REJECT","confidence":"LOW","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A precomputed Intent Graph plus tiered semantic adjudication cuts indirect prompt-injection attack success to 0.34% on AgentDojo while keeping 87.63% benign task utility, as reported in the full text.","lead":"The full text describes CCA, a two-layer defense for LLM agents against indirect prompt injection that checks tool calls against a precomputed Intent Graph and escalates only deviations to a semantic adjudicator. The arXiv record's title and abstract, however, describe a different system called SIEVE evaluated on different benchmarks and baselines.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Data-flow check trusts content from approved upstream nodes, so value-substitution IPIs can bypass Layer 1 and never reach the Tiered Adjudicator, undermining the central universal-deviation claim.","rationale":"The reader's weakest assumption identified the same origin-trust flaw in §3.2, so I agree. My read of the full text and appendices reinforces this concern as the most load-bearing. The central claim is universal: 'no matter how subtle an IPI attack, its malicious objective will ultimately manifest as a detectable deviation in the action trajectory.' The architecture detects deviations structurally—control-flow and data-flow origin—and only then invokes deep semantic adjudication. The missing case is value substitution through an already-approved edge: the attacker does not change the sequence of tools and the tainted value is not 'ambient'; it is the output of a node the graph explicitly approves. This is not a minor edge case; it is a core attack surface for IPI, since injected content is precisely attacker-controlled data read by legitimate tools. The paper's own motivating example shows that read_document can ingest poison, yet §3.2 treats any value originating from that node as trustworthy. The empirical evaluation in §4 and D.1 uses attacks that deviate in tool choice (send a link), which the control-flow check can catch, so the reported 0.34% ASR does not validate the universal claim. In addition, B.1 reveals that S_prov was simplified to a static score and S_risk is parameter-agnostic, so neither Layer-2 component would catch a value-based substitution even if escalation occurred. Therefore the paper does not support the strongest security claim as written. Since the reader already recommended REJECT on reproducibility/mismatch grounds, my analysis does not change that verdict; it independently supports it and gives a specific technical reason to expect the architecture to fail on a defined attack class.","tokens_in":17456,"tokens_out":4670,"duration_ms":48812,"concrete_test":"Run a targeted AgentDojo-style task: user instruction is 'read notes.txt and email the summary to alice@example.com'; construct the Intent Graph so that send_email is a planned node whose recipient is sourced from read_document.output. Place a malicious instruction in notes.txt changing the recipient to attacker@example.com. Execute CCA with DeepSeek-V3.1. If the email is sent without triggering the Tiered Adjudicator and the attacker goal is achieved, the central claim is falsified. If it is escalated, inspect what control-flow condition triggered the escalation, since this would indicate the graph generation did not treat send_email as planned or the provenance check was value-aware beyond the paper's description.","verdict_should_be":"UNCHANGED","load_bearing_attack":"CCA's core assertion in §3.1—that every IPI necessarily produces a detectable control-flow or data-flow deviation—is unsupported. The only data-flow check in §3.2 verifies parameter origin against (i) the user instruction or (ii) an approved upstream node; it does not inspect the value itself. But an approved upstream node can itself return attacker-controlled content, exactly as in the paper's own notes.txt example. Therefore an attack that (a) uses a tool already present in the Intent Graph and (b) draws the malicious parameter value from an approved upstream output is structurally indistinguishable from a legitimate action: the control-flow check passes because the tool is planned, the data-flow check passes because the parameter source is an approved node, and Tier 2 is never invoked because escalation is deviation-gated. Concretely, if the user asks to email meeting notes to Alice and the graph plans send_email with recipient sourced from read_document.output, an injection in the notes changing the recipient to an attacker email will be executed without semantic adjudication. The AgentDojo evaluation does not isolate this class: attacks in D.1 cause the agent to perform a different tool call, so they are caught by the control-flow check. The limitations section admits S_risk is static and parameter-agnostic, and B.1 states S_prov was made static, but neither admission addresses this provenance-trust bypass. Thus the weakest assumption is not merely a sub-component concern; it breaks the universal-deviation premise that the entire two-layer design depends on.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper (body title and content) presents the Cognitive Control Architecture (CCA), a two-layer defense for LLM agents against indirect prompt injection (IPI). Pillar I pre-generates an Intent Graph of legitimate tool calls and validates each proposed action's control-flow and data-flow provenance. Actions that fail this deterministic check are escalated to Pillar II, a Tiered Adjudicator that computes a weighted alignment score from semantic, causal, provenance, and inherent-risk sub-scores. The paper reports on AgentDojo that CCA achieves 0.34% ASR, 87.63% benign utility, and 86.43% utility under attack, with lower token consumption than MELON, plus a model-agnostic study on Kimi K2 and further experiments on Qwen3-Next-80B and GPT-4.1-mini. The abstract, however, refers to a different system name (SIEVE), a different benchmark (AgentLure), and additional baselines (DRIFT, ARGUS, IPIGuard) that do not appear in the body.","tokens_in":1679,"tokens_out":1674,"duration_ms":57801,"significance":"If the central invariant were established, CCA would offer a practical security–functionality–efficiency trade-off for IPI defense: a deterministic first layer for cheap filtering and a semantic adjudicator only for deviations. The paper is also honest in stating some limitations (static risk scores, open-ended task constraints). The layered design and the efficiency measurements are useful contributions. However, the load-bearing claim that every IPI manifests as a detectable control-flow or data-flow deviation is not supported by the implemented checks, and the evaluation apparatus (single runs, hand-set weights, missing baselines, no released code) is too thin to back the reported trade-off numbers.","major_comments":[{"comment":"The central security claim is not established. Section 3.1 states that any IPI attack must cause a detectable deviation in control flow or data flow. But the data-flow check in Section 3.2 and Algorithm 1 only verifies that a parameter's value originates from the user instruction or an approved upstream node; it does not inspect the value itself. An upstream node can return attacker-controlled content, exactly as in the paper's motivating example (Figure 1, poisoned notes.txt). If the Intent Graph already contains a tool such as send_email whose recipient parameter is sourced from nodes.<read_document>.output, an injection that changes the recipient to an attacker-controlled address will pass both the control-flow and data-flow checks, so the Tiered Adjudicator is never triggered. The evaluation's attack strings in D.1 are framed as causing a different tool call or following an injected","section":"§3.1–3.2, Fig. 1, Algorithm 1"},{"comment":"The abstract describes a different system (SIEVE) evaluated on AgentLure and AgentDojo against MELON, DRIFT, IPIGuard, and ARGUS, with reported numbers such as 5.94% ASR on AgentLure. The body is entirely about CCA, evaluates only AgentDojo, and Table 1 lists only No Defense, DeBERTa, Spotlight, Repeat Prompt, and MELON as baselines. IPIGuard is discussed in Section 2 as related work but is never evaluated, and DRIFT and ARGUS appear nowhere in the body's experiments. The claimed state-of-the-art comparison and benchmark results are therefore not verifiable from the manuscript.","section":"Abstract vs. body; §4.1, Table 1"},{"comment":"The empirical support for the headline numbers rests on hand-set weights (w_sem=0.1, w_causal=0.7, w_prov=0.1, w_risk=0.1) and a fixed threshold of 0.5, with no sensitivity analysis. The main tables report a single run; error bars are only provided in E.2 for one attack and one model. The ablation study in Table 4 renormalizes the remaining weights after removing a component, so the observed ASR changes (e.g., w/o S_causal jumping to 4.95%) may be partly an artifact of the weight renormalization rather than a clean measure of the component's contribution. In addition, B.1 states that S_prov was made static, so the dynamic provenance mechanism in Eq. (4) is not tested. These issues do not prove the approach is ineffective, but they substantially weaken the paper's quantitative claims.","section":"§4.1, B.1, E.2, Table 4"}],"minor_comments":[{"comment":"The body uses 'Cognitive Control Architecture (CCA)' and the title says 'SIEVE'. The paper should be internally consistent about the system name and the claims in the abstract.","section":"Abstract/Title"},{"comment":"The formula for S_sem is written as 'cos(...) + 1 / 2', which is ambiguous. Presumably it means (cos(...) + 1) / 2, but the parentheses should be shown explicitly.","section":"Eq. (2)"},{"comment":"The pseudocode handles APPROVE and BLOCK outcomes of the TieredAdjudicator but not the ASK_USER outcome that is described in Section 3.3 and Figure 2.","section":"Algorithm 1"},{"comment":"The entry 'Melon0' appears to be a formatting error; it should be 'MELON' with the reported 0 ASR for the Direct and Ignore-Prev columns.","section":"Table 1"},{"comment":"The reference list contains typos and inconsistent formatting, e.g., 'OW ASP Foundation' should be 'OWASP', and arXiv identifiers are not uniformly formatted.","section":"References"},{"comment":"The DSR–TSR trade-off plot in Figure 4(a) uses abbreviations defined only in the caption; the reader has to infer that DSR = 100% − ASR and TSR = UA from the caption text. A direct definition in the main text would help.","section":"Figure 4"}],"recommendation":"reject","confidential_remarks":"The abstract/body mismatch and the missing AgentLure/DRIFT/ARGUS/IPIGuard results suggest the manuscript may have been assembled from two different drafts. Beyond the presentation issue, the data-flow provenance check has a genuine value-substitution bypass that invalidates the core universal-deviation argument. I do not see a fix within the current scope: adding value checks would require semantic adjudication on all approved upstream outputs, which would undermine the claimed efficiency gains and alter the architecture's fundamental design."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a more interesting architecture than the title/abstract suggests, but it is not the paper the abstract describes, and the load-bearing security claim has a hole that the evaluation never probes.\n\nWhat's new: the CCA design in the full text—pre-generating an Intent Graph, enforcing control-flow and data-flow checks with parameter provenance placeholders, and escalating only deviations to a tiered adjudicator with a weighted alignment score—is a coherent and reasonably original combination. The ablation study and efficiency numbers (3.3x token reduction vs MELON) give some evidence that the two-layer strategy can work, and the graph-update ablation is a nice touch. The risk-score tables and prompts are included, which helps reproducibility.\n\nWhere it gets soft: first, the submission is internally incoherent. The title, abstract, and results in the abstract describe SIEVE (with AgentLure and AgentDojo, baselines MELON, DRIFT, IPIGuard, ARGUS). The full text is CCA, evaluated only on AgentDojo against a different baseline set, and IPIGuard is never evaluated. That's not a name typo; the claims in the abstract are unsupported by the body. Second, the central claim in §3.1—that every IPI produces a detectable deviation in control flow or data flow—is false as stated. The data-flow check in §3.2 verifies parameter origin, not value. If an upstream node (like read_document) returns attacker-controlled content, a parameter sourced from that node passes the check, and the malicious value is executed without reaching the adjudicator. The paper's own notes.txt example poisons exactly that upstream node. The stress-test note is right: this isn't a sub-component bug, it breaks the universal-deviation premise. The paper's limitations section admits the risk score is static and provenance is static, but never acknowledges this bypass.\n\nThird, the empirical support is thinner than it looks: hand-set weights, fixed threshold, single runs for most results (the DeepSeek-V3.2 error bars help), no code release, and the most relevant graph-based baseline (IPIGuard) is missing. So the numbers in Table 1 are suggestive, not conclusive.\n\nWho this is for: people working on agent security, specifically on plan-based defenses. They'll find the architecture worth engaging with even if the current claims don't hold.\n\nRecommendation: as submitted, I would not accept the claims. The abstract/body mismatch alone would need fixing before any serious review. But the architectural idea is real and the evaluation effort is substantial, so I'd send it to peer review with a request for major revision: make the title/abstract match the full text, address the provenance bypass (either by adding value inspection or narrowing the guarantee), and add IPIGuard and repeated runs. My verdict would be revise—not reject the underlying approach.","headline":"The two-layer intent-graph/adjudicator design is a real idea, but the submitted paper is internally inconsistent and the provenance check has a bypass that breaks its central universal-deviation claim.","tokens_in":18297,"tokens_out":4663,"would_cite":false,"duration_ms":37687,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A two-tier defense blocks indirect prompt injection in AI agents with a 0.34% attack success rate.","keywords":["indirect prompt injection","LLM agents","intent graph","control-flow integrity","data-flow integrity","tiered adjudication","selective verification","agent security"],"falsifier":"Take a task whose intent graph includes a read-file step, plant a malicious instruction inside that file, and have the file's output supply a parameter for a later on-graph action; if the reported near-zero attack success rate rises substantially, the provenance layer's blind spot is confirmed.","tokens_in":17373,"feed_emoji":"🛡️","tokens_out":4955,"duration_ms":44442,"temperature":0.7,"pith_summary":"The paper argues that every indirect prompt injection, however disguised, must eventually move the agent's actions off the plan a legitimate user would have wanted. It therefore builds a defense from two parts: a pre-generated Intent Graph that cheaply checks whether each tool call and each argument's origin fits that plan, and a deeper adjudicator that reviews only the actions the graph flags. The claim is that this selective split keeps attack success near zero while preserving the agent's usefulness and spending far fewer tokens than methods that re-check every step semantically. A sympathetic reader should care because it points to a practical way of securing autonomous agents without disabling them.","feed_headline":"AI agent defense cuts prompt-injection success to 0.34%","feed_subtitle":"Prebuilt intent graph filters normal tool calls; only suspicious steps go to deep review, keeping cost and utility in balance.","key_machinery":"The Intent Graph—a pre-generated DAG whose nodes are planned tool calls and whose edges are valid transitions, with parameter provenance placeholders such as 'nodes.node_2.output'—carries the first layer by deterministically verifying both control flow and data flow. The Tiered Adjudicator carries the second layer: for any deviation it computes the Intent Alignment Score, a weighted sum of semantic alignment (cosine similarity of embeddings), causal contribution (LLM judgment of necessity), source provenance (a trust score for the triggering external source), and inherent action risk (a static per-tool hazard value). The work these two mechanisms do is to reserve expensive semantic reasoning","core_discovery":"The paper's central claim is that any IPI attack, no matter how subtle, must produce a detectable deviation in the action trajectory—either in control flow (unexpected tool calls or ordering) or in data flow (parameter values that come from the wrong source). CCA operationalizes this by generating, before execution, a directed acyclic graph of legitimate tool calls with placeholders for where each parameter may come from. Every proposed action is checked against this graph; only deviations escalate to a tiered adjudicator that computes a weighted Intent Alignment Score from four signals: semantic similarity to the user goal, causal necessity, source trustworthiness, and inherent action risk.","pith_inferences":["The provenance guarantee is only as strong as its definition of 'approved upstream node': if a tool reads attacker-controlled content, its output is tainted yet still counts as an approved source, so a stealthy injection could ride through Layer 1 to the adjudicator.","The ablation results suggest the causal-contribution score carries most of the security weight; if an attacker can craft an action whose causal justification is coherent to an LLM, the other three scores may only add marginal protection.","A testable extension would vary the static inherent-risk table and the score threshold to measure how much security comes from the risk prior versus the semantic layer.","For open-ended or exploratory tasks where a complete intent graph cannot be drawn in advance, the framework would likely need to relax Layer 1 or fall back to continuous adjudication, trading away its main efficiency gain."],"forward_implications":["Deterministic structural checks can catch most IPI attempts, so defenses no longer need to run an LLM judge on every proposed action.","Because benign deviations can be approved and the graph updated, the agent retains flexibility and high utility under attack rather than being locked into a rigid plan.","The provenance placeholders shift the defense from semantic suspicion of values to structural enforcement of where values came from.","Token and latency overhead fall proportionally to how often deviations occur, making full-lifecycle supervision practical for deployed agents.","The framework's reported balance reverses the usual security–functionality trade-off: attack success drops while utility stays near the undefended level."],"fun_headline_variants":["Selective verification fends off prompt injection with 99.66% success","Intent graph filters tool calls to cut injection attacks","SIEVE: only suspicious actions get deep AI review","Low-cost AI agent defense: 0.34% attack success"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The data-flow check treats any value coming from the user's instruction or an already-approved tool output as trustworthy, without checking whether that approved tool itself read attacker-controlled content.","fun_headline_variants_meta":{"raw":{"variants":["Selective verification fends off prompt injection with 99.66% success","Intent graph filters tool calls to cut injection attacks","SIEVE: only suspicious actions get deep AI review","Low-cost AI agent defense: 0.34% attack success"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000716,"raw_usage":{"total_tokens":3090,"prompt_tokens":816,"completion_tokens":2274,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":560,"completion_tokens_details":{"reasoning_tokens":2203}},"tokens_in":560,"tokens_out":2274,"duration_ms":16656,"temperature":1.0,"reasoning_tokens":2203,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T06:37:27.920620+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a task whose intent graph includes a read-file step, plant a malicious instruction inside that file, and have the file's output supply a parameter for a later on-graph action; if the reported near-zero attack success rate rises substantially, the provenance layer's blind spot is confirmed.","supporting_citations":[],"review_version":1}