{"id":"44a018fd-7513-4a77-8581-6e0da2658ff4","arxiv_id":"2605.26269","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"AgentSecBench instantiates a formal security framework with three games (instruction-integrity, retrieval-confidentiality, capability-integrity) to empirically evaluate defenses in LLM agents on small Qwen models.","lead":"The paper introduces AgentSecBench, a benchmark using a formal noninterference framework to measure prompt injection, privacy leakage, and tool-use integrity in LLM agents via three security games. A smart generalist might read it to understand structured ways to test whether AI agents can be tricked into unauthorized actions or data leaks.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Exact-marker experiments may not sufficiently instantiate the three games to support the noninterference claims","rationale":"The reader's weakest assumption correctly isolates the point where the empirical instantiation must carry the formal framework; the abstract's own qualification that these are 'one observable instantiation' rather than complete semantic security makes this the load-bearing link. No other internal inconsistency appears from the given description.","tokens_in":1741,"tokens_out":302,"duration_ms":16981,"concrete_test":"Re-run the six defense classes on the Qwen3 models but replace exact markers with semantically equivalent paraphrases or indirect references in both adversarial and benign-control prompts; if the reported risk reduction or remaining exploitable capability changes by more than 20% relative to the original tables, the markers do not instantiate the distinguishers adequately.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The framework defines instruction-integrity, retrieval-confidentiality, and capability-integrity games under intent-to-execution noninterference with permitted leakage, using provenance projection, capability restriction, and output validation as enforcers. The exact-marker experiments are presented as testing disclosure and forbidden-action distinguishers with unambiguous ground truth, yet they instantiate the games only via exact string matches rather than semantic or model-visible channels. If models can still produce equivalent disclosures or actions through paraphrases, indirect references, or non-exact generations, the measured adversarial advantage and channel-closure results would not establish the claimed security properties.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript introduces AgentSecBench, an empirical benchmark instantiating a formal security framework for LLM agents. The framework defines three games—instruction-integrity, retrieval-confidentiality, and capability-integrity—under intent-to-execution noninterference with permitted leakage. Application policies are represented as projections onto authorized observations and capabilities; the work distinguishes prompt annotations from enforcing mechanisms (provenance projection, capability restriction, output validation) and measures adversarial advantage plus channel closure. It evaluates six defense classes on Qwen3-0.6B and Qwen3-1.7B via paired adversarial and benign-control executions using exact-marker experiments that test disclosure and forbidden-action distinguishers with unambiguous ground truth.","tokens_in":1821,"tokens_out":384,"duration_ms":15649,"significance":"If the measurements hold, the work supplies a security-oriented evaluation method that separates descriptive boundaries in prompts from enforceable projections, with explicit reporting of when risk reduction tracks channel closure versus residual model-visible exploitability. The formal game definitions and paired execution design are strengths that enable reproducible assessment of noninterference properties in agent systems.","major_comments":[{"comment":"Abstract and experiments section: the central claim that the exact-marker experiments instantiate the three games sufficiently to measure 'whether a defense closes the relevant model-visible channel' rests on exact string matches for disclosure and forbidden-action distinguishers. The manuscript acknowledges this is 'one observable instantiation rather than a complete semantic security claim,' yet the reported results on adversarial advantage and channel closure are presented as evidence for the noninterference properties; without additional semantic or model-visible channel tests (e.g., paraphrase or indirect-reference distinguishers), the measurements do not establish the claimed security properties when models can produce equivalent outputs outside exact matches.","section":"Abstract / experiments"}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback. We address the major comment on the scope of the exact-marker experiments below.","responses":[{"response":"The manuscript already qualifies the experiments as 'one observable instantiation rather than a complete semantic security claim' precisely to avoid overclaiming semantic noninterference. The formal games are defined with respect to observable distinguishers that admit unambiguous ground truth; the exact-marker design is an intentional choice to enable reproducible measurement of adversarial advantage and channel closure for those distinguishers. Results are presented as evidence only for the scoped properties (when risk reduction tracks closure versus residual model-visible exploitability), not as a complete semantic security argument. We therefore maintain that the reported measurements align with the stated claims. No revision is needed.","revision_made":"no","referee_comment":"[Abstract / experiments] Abstract and experiments section: the central claim that the exact-marker experiments instantiate the three games sufficiently to measure 'whether a defense closes the relevant model-visible channel' rests on exact string matches for disclosure and forbidden-action distinguishers. The manuscript acknowledges this is 'one observable instantiation rather than a complete semantic security claim,' yet the reported results on adversarial advantage and channel closure are presented as evidence for the noninterference properties; without additional semantic or model-visible channel tests (e.g., paraphrase or indirect-reference distinguishers), the measurements do not establish the claimed security properties when models can produce equivalent outputs outside exact matches."}],"tokens_in":1409,"tokens_out":312,"duration_ms":20123,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's core offering is AgentSecBench, which turns prompt injection, privacy leakage, and tool misuse into three explicit games under an intent-to-execution noninterference definition. It separates what a prompt can describe from what provenance projection, capability restriction, and output validation actually enforce, then measures adversarial advantage and whether a defense closes the visible channel.\n\nThe new piece is the structured framework itself. Most prior work on agent attacks stays at the level of individual exploits; here the authors try to make the security properties testable across instruction integrity, retrieval confidentiality, and capability integrity. They run the same setup on paired adversarial and benign cases with six defense classes and two small Qwen models, which at least gives a consistent comparison point.\n\nThe experiments use exact string markers for disclosures and forbidden actions. The abstract is clear that this is only one observable instantiation rather than a full semantic claim. That choice keeps ground truth unambiguous, but it also means the results do not rule out models leaking or acting through paraphrases, indirect references, or other non-exact generations. If those paths remain open, the reported risk reductions do not fully establish the noninterference properties.\n\nThe work stays narrow: small models only, exact-match tests, and no broader semantic or larger-model checks. That keeps the evaluation tractable but limits how far the measurements can be read as evidence for the framework.\n\nPeople building or auditing LLM agent systems would get the most from this. Anyone looking for a reusable way to compare defenses against the three properties could use the games as a starting template.\n\nThe paper is coherent enough on its own terms to go to referees. The framework is a step beyond ad-hoc testing even if the current instantiation needs tightening on the semantic side. I would send it to peer review.","headline":"AgentSecBench sets up three noninterference games for LLM agent security and tests defenses on small models, but the exact-marker approach leaves the channel-closure claims under-supported.","tokens_in":2288,"tokens_out":443,"would_cite":false,"duration_ms":25311,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Prompt text can describe security boundaries for LLM agents, but only provenance projections, capability restrictions, and output validation enforce them.","keywords":["LLM agents","prompt injection","privacy leakage","tool-use integrity","security evaluation","noninterference","provenance projection","AgentSecBench"],"falsifier":"An experiment in which a defense closes the model-visible channel yet the adversarial marker still triggers the forbidden disclosure or action with high probability, or in which the markers fail to distinguish authorized from unauthorized behavior on the benign-control set.","tokens_in":2617,"feed_emoji":"🛡️","tokens_out":756,"duration_ms":14683,"temperature":0.7,"pith_summary":"The paper introduces AgentSecBench to evaluate LLM agent security through three formal games that test whether untrusted inputs can improperly influence trusted instructions, secret retrieval, or tool actions. It formalizes the problem as intent-to-execution noninterference with permitted leakage and treats an application policy as a projection onto authorized observations and capabilities. The work distinguishes mere prompt annotations from actual enforcing mechanisms and measures both adversarial success and whether defenses close model-visible channels. Experiments on small Qwen3 models with six defense classes show when risk drops only after channel closure and when exploitable capability remains. A sympathetic reader would care because current agent designs often rely on textual descriptions alone, leaving the generative channel open to injection, leakage, and unauthorized actions.","feed_headline":"Prompt text describes LLM agent boundaries; projections enforce them","feed_subtitle":"AgentSecBench formalizes three games and shows defenses must close model-visible channels, not just annotate prompts.","key_machinery":"The three games (instruction-integrity, retrieval-confidentiality, capability-integrity) under intent-to-execution noninterference with permitted leakage, implemented via provenance projection, capability restriction, and output validation to enforce boundaries that prompt text only describes.","core_discovery":"AgentSecBench is an empirical instantiation of a formal security framework that defines instruction-integrity, retrieval-confidentiality, and capability-integrity games under intent-to-execution noninterference with permitted leakage. The framework represents policies as projections onto authorized observations and capabilities, distinguishes prompt annotations from enforcing projections, and measures adversarial advantage together with whether a defense closes the relevant model-visible channel before generation. The exact-marker experiments serve as one observable instantiation that tests disclosure and forbidden-action distinguishers with unambiguous ground truth. Evaluation of six defens","pith_inferences":["The framework could be extended to measure noninterference in multi-turn agent interactions where observations accumulate across steps.","Similar projection-based enforcement might apply to retrieval-augmented systems outside explicit agent tool use.","If exact markers prove too narrow, the games could be instantiated with semantic distinguishers while preserving the noninterference definition."],"forward_implications":["Evaluations of LLM agents must separate textual policy descriptions from enforceable projections rather than treating prompt text as sufficient.","Defenses succeed only when they close the generative channel before output is produced.","Security measurements should report both adversarial advantage and whether the defense eliminates the model-visible exploitable path.","Application policies are best expressed as projections that restrict observations and capabilities, not solely as instructions in the prompt."],"fun_headline_variants":["Projections enforce LLM agent policies unlike prompt annotations","AgentSecBench measures three security games for LLM agents","Defenses close model-visible channels in LLM agent frameworks","Intent-to-execution noninterference tested via AgentSecBench"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The exact-marker experiments supply unambiguous ground truth that sufficiently instantiates the three games to measure the claimed security properties.","fun_headline_variants_meta":{"raw":{"variants":["Projections enforce LLM agent policies unlike prompt annotations","AgentSecBench measures three security games for LLM agents","Defenses close model-visible channels in LLM agent frameworks","Intent-to-execution noninterference tested via AgentSecBench"]},"model":"grok-4.3","cost_usd":0.004519,"raw_usage":{"total_tokens":2271,"prompt_tokens":712,"num_sources_used":0,"completion_tokens":62,"cost_in_usd_ticks":45187000,"prompt_tokens_details":{"text_tokens":712,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1497,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":712,"tokens_out":62,"duration_ms":16769,"temperature":1.0,"reasoning_tokens":1497,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T21:14:49.089036+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment in which a defense closes the model-visible channel yet the adversarial marker still triggers the forbidden disclosure or action with high probability, or in which the markers fail to distinguish authorized from unauthorized behavior on the benign-control set.","supporting_citations":[],"review_version":1}