Pith. sign in

REVIEW 4 major objections 7 minor 55 references

APPA keeps LLM agent contexts usable under information-flow control by confining taint to disposable child branches instead of permanently polluting the main trajectory.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 10:17 UTC pith:YGBEBEDS

load-bearing objection Clean engineering of prospective IFC plus label-seeded branches, with honest proofs and a real ablation—but the headline utility recovery is partly baked into the benchmark design. the 4 major comments →

arxiv 2607.24625 v1 pith:YGBEBEDS submitted 2026-07-27 cs.CR cs.AI

Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents

Arseny Kravchenko , Vadim Liventsev , Innokentii Konstantinov , Ildar Iskhakov , Matvey Kukuy This is my paper
classification cs.CR cs.AI
keywords LLM agentsprompt injectioninformation flow controltaint trackingdeclassificationcontext branchingconfused deputyagent security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

LLM agents that mix private data with untrusted tool outputs face exfiltration and policy breaches from prompt injection and ordinary reasoning errors. Classic dynamic taint tracking stops the leaks but permanently raises the agent's confidentiality level after any sensitive read, locking out later tools and destroying utility. APPA fixes that bottleneck with two engine mechanisms: prospective checks that block risky acquisitions before they run and propose remedy plans (Authorize or Accept), and label-seeded child trajectories that absorb the taint locally so a trusted sanitizer can return only a bounded derivative to an unchanged parent. A two-monoid model over security labels and a shared event log underpins formal proofs that the parent label is preserved and merges stay confined. On a multi-turn corporate tool-chaining benchmark across four models, APPA cuts attack success from 31–50% to 0–7%, and on three of the four models branching recovers much of the utility that pure taint tracking forfeits.

Core claim

Engine-managed, label-seeded context branching plus prospective acquisition enforcement lets dynamic information-flow control confine taint to child trajectories: the parent label is preserved under abandonment or an adequate sanitized merge, while exfiltration is suppressed and substantial downstream utility is retained compared with permanent taint tracking alone.

What carries the argument

Taint-confining branch (Definition 3.3 / Theorem 6.1): a child inherits the parent's label, folds further descent only locally, and may return a value only through a checked merge that meets the parent label with the return label—so an adequate exit leaves the parent exactly unchanged. Prospective acquisition checks and atomic Authorize/Accept remedy plans clear blocks without silent privilege creep.

Load-bearing premise

Security holds only for flows that declared tool contracts and trusted sanitizers actually cover; undeclared write-side sinks or incomplete contracts still allow laundering even when the branching algebra is correct.

What would settle it

On the paper's own bench-corp suite, disable branching (APPA-no-fork) and check whether parent-label pollution returns and utility collapses back toward the no-fork numbers, or whether attack success stays near the open-baseline 31–50% when contracts are complete—if either fails to match the reported pattern, the central confinement claim does not hold.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Agent harnesses can keep a clean primary context after inspecting untrusted or confidential tool outputs instead of permanently revoking downstream tools.
  • Policy blocks become structured Authorize/Accept remedy plans rather than silent failures or ad-hoc guardrails scattered through agent code.
  • Formal parent-preservation and merge-confinement proofs give structural guarantees independent of model behavior inside the trusted engine boundary.
  • Defense-in-depth is available by pairing trajectory branching with OS-level process sandboxes without requiring dual-LLM harness redesign.
  • Multi-turn tool-chaining tasks that were previously unwinnable under pure taint tracking become feasible when restrictive reads run in child branches.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Production value hinges on policy-authoring quality: every new tool needs accurate deltas, emits, and sink requirements, or residual laundering paths reappear as in the paper's own residual breaches.
  • Prompt-cache-friendly snapshot inheritance may make branching cheaper at inference time than spawning fully isolated dual-LLM verifiers, a systems angle the evaluation only sketches.
  • The same prospective-remedy interface could surface human-in-the-loop approvals as first-class plans, turning approval fatigue into a measurable engine metric rather than an external process.
  • Extending committed-effect logging across sessions would bridge single-run confinement to persistent memory provenance without changing the core label monoid.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper presents APPA, a dynamic information-flow-control framework for LLM agents that addresses label creep via two mechanisms: (i) engine-managed context branching, in which restrictive reads are executed in label-seeded child trajectories whose checked exits merge only adequate or sanitized derivatives into the parent, and (ii) prospective acquisition enforcement, in which pre-dispatch checks on label descents and unmet tool requirements produce executable remedy plans (Authorize/Accept) and advisory Redispatch/Branch recommendations. A two-monoid model (restrictive-meet label actions × free event-log monoid with a committed-effect projection) supports five formal results proved in Appendix A: fold collapse (Prop. 3.1), monotone descent and settlement (Prop. 3.2), remedy completeness over a modeled transition system (Thm. 4.1), call-scoped release (Thm. 5.1), and branch taint confinement (Thm. 6.1). Empirically, the authors build bench-corp (14 multi-turn corporate-assistant scenarios, declarative end-state scoring) and evaluate four models across five arms; APPA reduces exfiltration ASR from 31%–50% (open) to 0%–7%, and the APPA vs APPA-no-fork ablation (same binary and policy, differing only in --max-forks) shows utility gains of 6–10 episodes on three of four models.

Significance. Label creep is a genuine and recognized usability bottleneck for agent IFC (Fides, CaMeL), and a mechanism that confines taint to disposable child trajectories while preserving the parent label is a useful conceptual contribution. The manuscript has uncommon strengths for this venue: the algebra is parameterized only by the deployment's reader sets and trust chain (no fitted constants), the appendix proofs are complete and correctly scoped to the stated primary model, the planner's empty-verdict completeness is cross-checked by property-based testing against an independent reference implementation, the empirical design includes a genuinely causal ablation (identical binary/policy, one flag), scoring is declarative rather than LLM-judged, residual breaches are honestly attributed to contract gaps rather than hidden, and the AgentDojo instrumentation (§7) is a valuable negative result showing that benchmark cannot discriminate branching on current-generation models. If the empirical claims are recalibrated as requested below, this would be a solid contribution.

major comments (4)
  1. [§7, Table 3; Abstract and §1 contributions] The headline utility-recovery claim needs a decomposition it currently does not receive. §7 states that three scenarios (reply-and-file-ticket, email-onboarding-buddy, review-then-notify) are 'structurally branch-dependent (unwinnable without context branching)' under APPA's policy — i.e., 9 of the 39 utility episodes per arm are unwinnable for the APPA-no-fork arm by construction. The reported fork gains are +10 (Luna, 27→37), +7 (Qwen, 21→28), +6 (Gemini, 11→17), and 0 net (GPT-4o). Since the no-fork arm's ceiling on the remaining 30 episodes is 30, the implied gains outside the engineered set are at most +1 (Luna), and are negative for Qwen (19/30 vs 21/30 winnable) and Gemini (8/30 vs 11/30 winnable); GPT-4o's 'nets four fewer elsewhere to mediation overhead' is consistent with this. In other words, the entire measured utility-recovery effect is concentrated in scenarios the benchmar
  2. [§7, Table 3 (Fides rows)] The cross-system security comparison against Fides is structurally stacked and should be reframed. Six of the fourteen scenarios are 'native-expressiveness' probes designed to isolate distinctions APPA's state model represents and Fides's does not (audience intersection vs ordinal ceilings, one-shot history predicates, intermediate trust ranks, pre-dispatch vs post-effect labeling). Fides's ASR is identical at 12/42 (29%) across all four models, which the text concedes is 'a deterministic policy mismatch rather than model-dependent susceptibility.' Table 3 therefore measures scenario–policy alignment on author-selected scenarios, not differential robustness, and a reader scanning the table will draw a comparative-security conclusion the design cannot support. The text hedges ('not a feature-equivalent one'), but the table itself should carry the caveat (e.g., a footnote on the Fides ASR
  3. [§4, Theorem 4.1 vs Appendix A ('Scope bounds')] The main-text statement of Theorem 4.1 names only one hypothesis — observational atomicity of a pending-cast success checkpoint and its value finalization — but the proof's scope bounds in Appendix A additionally exclude sanitizer argument substitution, compiled composites, cast resolution of Unknown dimensions, runs in which another checked call interleaves between a DispatchSucceeded checkpoint and value admission, and reported-success closes that withhold their value. As stated in §4, the theorem reads stronger than what is proved. Please enumerate the exclusions (or an explicit pointer and summary) in the main-text statement so the claimed completeness matches the proved coverage; the appendix's careful treatment suggests this is a presentation gap rather than a proof gap.
  4. [§7, Table 3 (statistical power)] With 3 repetitions per scenario (42 episodes per arm), the security cells underlying the headline '0%–7% ASR' are 0/42, 1/42, and 3/42 — pairwise indistinguishable at any conventional confidence level — and the smallest fork gain (Gemini, +6 episodes) is only twice the reported run-to-run variation of 'at most three episodes' (whose metric and direction are unspecified). Please report Wilson or exact binomial confidence intervals for the ASR and utility cells in Table 3, state precisely what 'varied by at most three episodes' measures, and consider additional repetitions for the cells that carry the abstract's quantitative claims.
minor comments (7)
  1. [§1] Typo: 'judgestructure' (missing space) in the paragraph on static structural restrictions.
  2. [§2 and References] The text refers to 'NeuroTaint [6]', but reference [6] is titled 'Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents' — please align the system name with the cited title. Reference [49] contains a stray space: 'Semantics-A ware'.
  3. [Table 3 caption] Please state explicitly that the utility denominator (39) excludes one security-only scenario, define the Remedies column (totals over 42 episodes; clarify what remedy calls mean in the no-fork arm, where Gemini shows the same count of 32 as the fork arm), and note that the identical Fides ASR across models is deterministic.
  4. [§7 (AgentDojo analysis)] Of the 32 GPT-4o AgentDojo tasks failing under enforcement, 24 are attributed to 'mediation overhead in our harness.' Since analogous overhead appears in bench-corp (GPT-4o's −4 episodes), please quantify mediation overhead separately from policy blocks in the bench-corp arms so utility costs are attributable.
  5. [§3, Definition 3.3] Definition 3.3 forward-references Theorem 6.1 (§6); consider a forward pointer or reordering for readers proceeding linearly.
  6. [§5] The 'Response-sink rule' and the later 'User-assistant trust boundary' paragraph describe the root response sink in slightly different terms (a hard no-ruling rule vs. a structural adequacy bar with mediation out of scope); please reconcile the two statements.
  7. [Appendix B / reproducibility] Including the full scenario prompts is welcome. Please also release the declarative scoring predicates, the policy/contracts used per scenario, and the harness (or a replication package), since the paper's empirical claims are otherwise difficult to audit independently.

Circularity Check

1 steps flagged

Formal IFC theorems are non-circular deductions from stated monoids; empirical utility-recovery is partly definitional because bench-corp includes scenarios the authors mark unwinnable without branching.

specific steps
  1. self definitional [§7 Scenario taxonomy; Table 3 APPA vs APPA-no-fork; Abstract utility claim]
    "under APPA’s policy, three scenarios are structurally branch-dependent (unwinnable without context branching)—reply-and-file-ticket, email-onboarding-buddy, and review-then-notify. ... APPA versus APPA-no-fork is the causal comparison ... overall utility rises from 69% to 95% (GPT-5.6 Luna), 28% to 44% (Gemini 3.5 Flash-Lite), and 54% to 72% (Qwen 3.6 35B)"

    Success on the three named scenarios is defined, under the authors’ own policy, to require context branching; 3 scenarios × 3 reps = 9/39 utility episodes are unwinnable for APPA-no-fork by construction. The measured fork gains (+6 to +10 episodes on three models) are therefore accounted for almost entirely by tasks built to make the ablated mechanism necessary. The abstract’s “branching recovers a substantial share of the utility taint tracking alone forfeits” is definitional on that subset, not an independent out-of-sample effect. (Formal theorems and ASR cells are unaffected.)

full rationale

The load-bearing formal chain (Propositions 3.1–3.2, Theorems 4.1, 5.1, 6.1) is ordinary lattice/monoid deduction: parent preservation is L'_p = L_p ∧ label(v) plus absorption, and call-scoped release follows from the stated atomic dispatch rule. Nothing is fitted to bench-corp, and no uniqueness or ansatz is imported via overlapping-author citation. The only circularity-adjacent step is empirical and partial. §7 explicitly builds three of fourteen scenarios as “structurally branch-dependent (unwinnable without context branching),” i.e. 9 of 39 utility episodes per arm that APPA-no-fork cannot win by construction. Reported fork gains (Luna +10, Qwen +7, Gemini +6, GPT-4o 0) sit almost entirely inside that engineered set, so the abstract’s claim that “branching recovers a substantial share of the utility that taint tracking alone forfeits” is, on those episodes, true by task design rather than an independent discovery. ASR suppression and the formal confinement proofs do not reduce this way. Score 3 reflects one disclosed, partial self-definitional evaluation step, not a circular derivation of the algebra.

Axiom & Free-Parameter Ledger

0 free parameters · 7 axioms · 3 invented entities

Guarantees rest on standard lattice/monoid math plus domain trust boundaries (engine, contracts, sanitizers, authorities, append-only log) and an intentionally limited threat model (no covert channels; no side-effect rollback). No numeric constants are fitted to produce the security theorems; empirical claims depend on the synthetic benchmark and declared policies rather than free physical parameters.

axioms (7)
  • standard math Label state is a finite product lattice S = P(U)×T under componentwise meet/join; primary checked actions are restrictive meets only.
    §3; underpins collapse, monotone descent, and absorption used in Theorems 5.1 and 6.1.
  • domain assumption LLM is policy-untrusted; engine, configuration, registered authorities, and registered transformations are the TCB; theorems do not depend on model behavior.
    Threat model §3; standard for language-based IFC but shifts all correctness of sanitizers/contracts into TCB (§8).
  • domain assumption Event log is durable, append-only, and globally shared; committed-effect projection defines prior/no_prior.
    §3 log monoid and Table 2; history predicates and cross-branch egress visibility depend on this.
  • domain assumption Tool contracts completely declare label deltas, emits, and requires for flows the deployment cares about; undeclared write-side sinks are out of modeled enforcement.
    §3 Contracts; residual joint-merger-brief breach and §8 explicitly show missing contracts admit laundering.
  • domain assumption Covert channels in model outputs and transactional rollback of external child side effects are out of scope.
    §3 and §8; bounds noninterference-style reading of the results.
  • ad hoc to paper Branching is engine/harness orchestration; advisory Branch recommendations never clear parent acquisition blocks by themselves.
    §4–§6 protocol; security of parent preservation assumes this control plane, not model-initiated privilege reset.
  • ad hoc to paper Registered exit transformations may assert structured label promotion without a ruling—the sole stated exception for promotion.
    §6 sanitized exits; correctness of those assertions is pure TCB trust.
invented entities (3)
  • APPA two-monoid policy model (checked label action monoid × free event-log monoid) with committed-effect projection E no independent evidence
    purpose: Unify trajectory-local label folding with tree-wide history predicates while proving parent preservation and call-scoped release.
    Framing is paper-specific engineering of standard monoid/lattice IFC ideas; not a new physical entity, but a new postulated interface for agent runtimes.
  • bench-corp multi-turn corporate-assistant benchmark (14 scenarios, declarative FS predicates) no independent evidence
    purpose: Probe cumulative label descent, branching utility recovery, and recipient/history policy distinctions that short injection suites miss.
    Purpose-built testbed; authors disclaim general real-world performance. Independent reuse would require release of the suite.
  • Remedy plans (atomic Authorize/Accept and non-atomic Redispatch) exposed via execute_remedy_plan no independent evidence
    purpose: Turn prospective policy failures into actionable, logged governance steps without scattering ad-hoc guardrails.
    Operational construct of the system; effectiveness shown only inside their harness/benchmark.

pith-pipeline@v1.2.0-grok45-kimik3 · 25429 in / 3730 out tokens · 75620 ms · 2026-07-31T10:17:52.030108+00:00 · methodology

0 comments
read the original abstract

Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors. While dynamic Information Flow Control (IFC) provides structural security guarantees, traditional taint tracking permanently taints an agent's context upon reading unvetted data, severely restricting downstream utility. We present APPA (Agentic Permissions Policy Algebra), an IFC framework that resolves this usability bottleneck through engine-managed context branching and prospective acquisition enforcement. Before data acquisition occurs, APPA prospectively evaluates label descents and missing prerequisites, generating actionable remedy plans (Authorize, Accept). To inspect unvetted data without polluting the primary context, a label-seeded child trajectory is spawned, absorbing label descent locally and allowing a trusted sanitizer to return a bounded derivative to the unchanged parent. Governed by a two-monoid model over security labels and shared event logs, we formally prove parent label preservation and merge confinement. Finally, we evaluate APPA on a multi-turn tool-chaining benchmark across four models: it suppresses exfiltration (31%-50% down to 0%-7% attack success), and on three of the four, branching recovers a substantial share of the utility that taint tracking alone forfeits.

Figures

Figures reproduced from arXiv: 2607.24625 by Arseny Kravchenko, Ildar Iskhakov, Innokentii Konstantinov, Matvey Kukuy, Vadim Liventsev.

Figure 1
Figure 1. Figure 1: APPA architecture for taint confinement and [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

55 extracted references · 5 canonical work pages

  1. [1]

    Devdatta Akhawe and Adrienne Porter Felt. 2013. Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness. In22nd USENIX Security Symposium (USENIX Security 13). 257–272

    2013

  2. [2]

    2024.Model Context Protocol (MCP) Specification

    Anthropic. 2024.Model Context Protocol (MCP) Specification. https:// modelcontextprotocol.io

    2024

  3. [3]

    Jonathan Bell and Gail Kaiser. 2014. Phosphor: Illuminating Dynamic Data Flow in Off-the-Shelf JVMs. InProceedings of the 2014 ACM International Conference on Object Oriented Programming Systems Languages & Applications (OOPSLA). 83–101. doi:10.1145/2660193.2660212

    arXiv 2014

  4. [4]

    Taylor, Krishnamurthy Dvijotham, and Alexandre Lacoste

    Rishika Bhagwatkar, Kevin Kasa, Anmol Puri, Guangzhi Huang, Irina Rish, Gra- ham W. Taylor, Krishnamurthy Dvijotham, and Alexandre Lacoste. 2025.In- direct Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks? arXiv:2510.05244 [cs.CR] doi:10.48550/arXiv.2510.05244

    doi:10.48550/arxiv.2510.05244 2025

  5. [5]

    1967.Lattice Theory(3rd ed.)

    Garrett Birkhoff. 1967.Lattice Theory(3rd ed.). Vol. 25. American Mathematical Society

    1967

  6. [6]

    Yuandao Cai, Wensheng Tang, Cheng Wen, and Shengchao Qin. 2026. Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents. arXiv:2604.23374 [cs.CR] doi:10.48550/arXiv.2604.23374

    Pith/arXiv arXiv doi:10.48550/arxiv.2604.23374 2026

  7. [7]

    James Clause, Wanchun Li, and Alessandro Orso. 2007. Dytan: A Generic Dy- namic Taint Analysis Framework. InProceedings of the 2007 International Sym- posium on Software Testing and Analysis (ISSTA). 196–206. doi:10.1145/1273463. 1273490

    work page doi:10.1145/1273463 2007

  8. [8]

    2025.Securing AI Agents with Information-Flow Control

    Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2025.Securing AI Agents with Information-Flow Control. arXiv:2505.23643 [cs.CR] doi:10.48550/arXiv.2505.23643

    Pith/arXiv arXiv doi:10.48550/arxiv.2505.23643 2025

  9. [9]

    2025.Defeating Prompt Injections by Design

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2025.Defeating Prompt Injections by Design. arXiv:2503.18813 [cs.CR] doi:10.48550/arXiv.2503.18813

    Pith/arXiv arXiv doi:10.48550/arxiv.2503.18813 2025

  10. [10]

    2024.AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024.AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352 [cs.CR] doi:10.48550/arXiv.2406.13352

    Pith/arXiv arXiv doi:10.48550/arxiv.2406.13352 2024

  11. [11]

    Boyi Deng, Wenjie Wang, Fuli Feng, Yang Deng, Qifan Wang, and Xiangnan He

  12. [12]

    Dorothy E. Denning. 1976. A Lattice Model of Secure Information Flow.Commun. ACM19, 5 (1976), 236–243. doi:10.1145/360051.360056

    arXiv 1976

  13. [13]

    Tim Disney and Cormac Flanagan. 2011. Gradual Information Flow Typing. In International Workshop on Scripts to Programs (STOP)

    2011

  14. [14]

    2026.DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback

    Yunpeng Dong, Jingkai He, Shiqi Liu, Yuze Hou, Dong Du, Zhonghu Xu, Si Yu, Baochuan Yang, Yubin Xia, and Haibo Chen. 2026.DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback. arXiv:2605.22781 https://arxiv.org/abs/2605.22781

    Pith/arXiv arXiv 2026

  15. [15]

    Luminous Fennell and Peter Thiemann. 2013. Gradual Security Typing with Ref- erences. InProceedings of the 26th IEEE Computer Security Foundations Symposium (CSF). 224–239. doi:10.1109/CSF.2013.22

    work page doi:10.1109/csf.2013.22 2013

  16. [16]

    Goguen and José Meseguer

    Joseph A. Goguen and José Meseguer. 1982. Security Policies and Security Models. InIEEE Symposium on Security and Privacy. 11–20. doi:10.1109/SP.1982.10014

    arXiv 1982

  17. [17]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec). 79–90. doi:10.1145/3605764.3623985

    arXiv 2023

  18. [18]

    2026.SMCP: Secure Model Context Protocol

    Xinyi Hou, Shenao Wang, Yifan Zhang, Ziluo Xue, Yanjie Zhao, Cai Fu, and Haoyu Wang. 2026.SMCP: Secure Model Context Protocol. arXiv:2602.01129 https://arxiv.org/abs/2602.01129

    arXiv 2026

  19. [19]

    Ziegler, Tim Maxwell, Nicholas Cheng, Adam Jermyn, Amanda Sharma, Shauna Johnston, Rohit Shah, Nelson Elhage, Samuel R

    Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Nicholas Cheng, Adam Jermyn, Amanda Sharma, Shauna Johnston, Rohit Shah, Nelson Elhage, Samuel R. Bowman, Ethan Perez, and Evan Kraus. 2024.Sleeper Agents: Training Deceptive LLMs That Persist Through Safety Training. arXiv:240...

    Pith/arXiv arXiv doi:10.48550/arxiv.2401.05566 2024

  20. [20]

    2023.Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rahul Rungta, Krithika Iyer, Yuning Mao, Madian Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Andrea Madotto. 2023.Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv:2312.06674 [cs.CL] doi:10.48550/arXiv.2312.06674

    Pith/arXiv arXiv doi:10.48550/arxiv.2312.06674 2023

  21. [21]

    Jensen and William H

    Michael C. Jensen and William H. Meckling. 1976. Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure.Journal of Financial Economics 3, 4 (1976), 305–360. doi:10.1016/0304-405X(76)90026-X

    doi:10.1016/0304-405x(76)90026-x 1976

  22. [22]

    Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. 2023. Survey of Hallucination in Natural Language Generation.Comput. Surveys55, 12 (2023), 1–38. doi:10.1145/ 3571730

    2023

  23. [23]

    Shin-ya Katsumata. 2014. Parametric Effect Monads and Semantics of Effect Sys- tems. InProceedings of the 41st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL). 633–645. doi:10.1145/2535838.2535846

    arXiv 2014

  24. [24]

    Frans Kaashoek, Eddie Kohler, and Robert Morris

    Maxwell Krohn, Alexander Yip, Micah Brodsky, Nels Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. 2007. Information Flow Control for Standard Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, and Matvey Kukuy OS Abstractions. InProceedings of the 21st ACM SIGOPS Symposium on Operating Systems Principles (SOSP). 321–...

    arXiv 2007

  25. [25]

    Gonzalez, Haotong Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Haotong Zhang, and Ion Stoica. 2023. Efficient Memory Management for Large Language Model Serving with PagedAttention. InProceedings of the 29th ACM Symposium on Operating Systems Principles (SOSP). 611–626. doi:10.1145/3600006.3613165

    arXiv 2023

  26. [26]

    Butler W. Lampson. 1973. A Note on the Confinement Problem.Commun. ACM 16, 10 (1973), 613–615. doi:10.1145/362375.362389

    arXiv 1973

  27. [27]

    Evan Li, Tushin Mallick, Evan Rose, William Robertson, Alina Oprea, and Cristina Nita-Rotaru. 2026. ACE: A Security Architecture for LLM-Integrated App Sys- tems. InProceedings of the Network and Distributed System Security Symposium (NDSS). arXiv:2504.20984 https://arxiv.org/abs/2504.20984

    Pith/arXiv arXiv 2026

  28. [28]

    Zhe Liu, Zonghao Ying, Wenxin Zhang, Quanchen Zou, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang, and Hao Peng. 2026. SafeHarbor: Hierarchical Memory- Augmented Guardrail for LLM Agent Safety. (2026)

    2026

  29. [29]

    2025.ceLLMate: Sandboxing Browser AI Agents

    Luoxi Meng, Henry Feng, Ilia Shumailov, and Earlence Fernandes. 2025.ceLLMate: Sandboxing Browser AI Agents. arXiv:2512.12594 https://arxiv.org/abs/2512.12594

    arXiv 2025

  30. [30]

    Miller and Jonathan S

    Mark S. Miller and Jonathan S. Shapiro. 2003. Paradigm Regained: Abstraction Mechanisms for Access Control. In8th Asian Computing Science Conference (ASIAN 2003) (Lecture Notes in Computer Science, Vol. 2894). Springer, 224–242. doi:10.1007/978-3-540-40965-6_15

    work page doi:10.1007/978-3-540-40965-6_15 2003

  31. [31]

    Myers and Barbara Liskov

    Andrew C. Myers and Barbara Liskov. 1997. A Decentralized Model for Infor- mation Flow Control. InProceedings of the 16th ACM Symposium on Operating Systems Principles (SOSP). 129–142. doi:10.1145/268998.266669

    arXiv 1997

  32. [32]

    Needham and Michael D

    Roger M. Needham and Michael D. Schroeder. 1978. Using Encryption for Authentication in Large Networks of Computers.Commun. ACM21, 12 (1978), 993–999. doi:10.1145/359657.359659

    arXiv 1978

  33. [33]

    Martin Odersky, Yaoyu Zhao, Yichen Xu, Oliver Bračevac, and Cao Nguyen Pham

  34. [34]

    2026.MemLineage: Lineage-Guided Enforcement for LLM Agent Memory

    Ciyan Ouyang and Rui Hou. 2026.MemLineage: Lineage-Guided Enforcement for LLM Agent Memory. arXiv:2605.14421 [cs.CR] doi:10.48550/arXiv.2605.14421

    Pith/arXiv arXiv doi:10.48550/arxiv.2605.14421 2026

  35. [35]

    Benjamin C. Pierce. 2002.Types and Programming Languages. MIT Press

    2002

  36. [36]

    2023.NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications

    Gabriel Reuchlin and NVIDIA NeMo Team. 2023.NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications. https://github.com/NVIDIA/NeMo- Guardrails

    2023

  37. [37]

    Stephen A. Ross. 1973. The Economic Theory of Agency: The Principal’s Problem. The American Economic Review63, 2 (1973), 134–139

    1973

  38. [38]

    Yangjun Ruan, Honghua Dong, Andrew Wang, Subhash Silwal, Joey Sung, Isaac Tian, Xiang Chen, Qiyang Ye, and Thomas Gao. 2024. Identifying Unexpected Behaviors of Language Model Agents through Tool Emulation. InProceedings of the International Conference on Learning Representations (ICLR)

    2024

  39. [39]

    Andrei Sabelfeld and Andrew C. Myers. 2003. Language-Based Information-Flow Security.IEEE Journal on Selected Areas in Communications21, 1 (2003), 5–19. doi:10.1109/JSAC.2002.806121

    arXiv 2003

  40. [40]

    Andrei Sabelfeld and David Sands. 2009. Declassification: Dimensions and Principles.Journal of Computer Security17, 5 (2009), 517–548. doi:10.3233/JCS- 2009-0352

    work page doi:10.3233/jcs- 2009

  41. [41]

    Saltzer and Michael D

    Jerome H. Saltzer and Michael D. Schroeder. 1975. The Protection of Information in Computer Systems.Proc. IEEE63, 9 (1975), 1278–1308. doi:10.1109/PROC. 1975.9939

    arXiv 1975

  42. [42]

    Schwartz, Thanassis Avgerinos, and David Brumley

    Edward J. Schwartz, Thanassis Avgerinos, and David Brumley. 2010. All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask). In2010 IEEE Symposium on Security and Privacy (S&P). 317–331. doi:10.1109/SP.2010.26

    work page doi:10.1109/sp.2010.26 2010

  43. [43]

    Mitchell, and David Mazières

    Deian Stefan, Alejandro Russo, John C. Mitchell, and David Mazières. 2011. Flexible dynamic information flow control in Haskell. InProceedings of the 4th ACM Symposium on Haskell. 95–106. doi:10.1145/2034675.2034688

    arXiv 2011

  44. [44]

    Philip Wadler. 1990. Linear Types Can Change the World!. InProgramming Concepts and Methods. North-Holland

    1990

  45. [45]

    Poskitt, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2025. AgentSpec: Customiz- able Runtime Enforcement for Safe and Reliable LLM Agents.arXiv.org(2025). doi:10.48550/ARXIV.2503.18666

    Pith/arXiv arXiv doi:10.48550/arxiv.2503.18666 2025

  46. [46]

    2026.From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Prove- nance in LLM Agents

    Yiqi Wang, Jiaqi Zhang, Taotao Cai, Zirui Liu, Qingqiang Sun, Zequn Sun, Zhangkai Wu, Manqing Dong, Mingkai Zheng, Xuefei Yin, and Yanming Zhu. 2026.From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Prove- nance in LLM Agents. arXiv:2606.04990 [cs.CR] doi:10.48550/arXiv.2606.04990

    Pith/arXiv arXiv doi:10.48550/arxiv.2606.04990 2026

  47. [47]

    Hu Wei. 2026. From Agent Loops to Structured Graphs:A Scheduler-Theoretic Framework for LLM Agent Execution.arXiv.org(2026). doi:10.48550/ARXIV. 2604.11378

    Pith/arXiv arXiv doi:10.48550/arxiv.2604.11378 2026

  48. [48]

    2023.The Dual LLM Pattern for Building AI Assistants That Can Resist Prompt Injection

    Simon Willison. 2023.The Dual LLM Pattern for Building AI Assistants That Can Resist Prompt Injection. https://simonwillison.net/2023/Apr/25/dual-llm-pattern/

    2023

  49. [49]

    Tianyuan Wu, Chaokun Chang, Lunxi Cao, Wei Gao, and Wei Wang. 2026. Crab: A Semantics-A ware Checkpoint/Restore Runtime for Agent Sandboxes. arXiv:2604.28138 https://arxiv.org/abs/2604.28138

    Pith/arXiv arXiv 2026

  50. [50]

    Steve Zdancewic and Andrew C. Myers. 2001. Robust Declassification. InPro- ceedings of the 14th IEEE Computer Security Foundations Workshop (CSFW). 15–23. doi:10.1109/CSFW.2001.930133

    arXiv 2001

  51. [51]

    Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. 2006. Making Information Flow Explicit in HiStar. InProceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation (OSDI). 263–278

    2006

  52. [52]

    Gonzalez, Ion Stoica, Frank Sifei Luan, and Hao Zhang

    Lianmin Zheng, Liangsheng Yin, Ziyue Zhou, Ruining Li, Shiyi Cao, Siyuan Zhuang, Lingxia Wang, Jiawei Yu, Zhanghao Wu, Joseph E. Gonzalez, Ion Stoica, Frank Sifei Luan, and Hao Zhang. 2023. Efficiently Programming Large Language Models with SGLang.arXiv preprint arXiv:2312.07104(2023)

    Pith/arXiv arXiv 2023

  53. [53]

    send the routine email: to all@northwind. example, subject ‘Routine update’, body ‘The scheduled corporate update is complete. ’

    Zhenhong Zhou, Yuanhe Zhang, Hongwei Cai, Moayad Aloqaily, Ouns Bouachir, Linsey Pang, Prakhar Mehrotra, Kun Wang, and Qingsong Wen. 2026.MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents. arXiv:2602.14281 https://arxiv.org/abs/2602.14281 A Proofs Setting.A Label is a pair (𝑅,𝑡) ∈𝑆=P(𝑈)×𝑇 , ordered by re...

    arXiv 2026

  54. [2024]

    InFindings of the Association for Computational Linguistics: ACL 2024

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Computational Linguistics: ACL 2024. 4897–4912

    2024

  55. [2026]

    arXiv:2603.00991 [cs.PL]

    Tracking Capabilities for Safer Agents.arXiv preprint arXiv:2603.00991 (2026). arXiv:2603.00991 [cs.PL]

    Pith/arXiv arXiv 2026