Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions

Hankai Liu; Jinghan Xu; Longze Fan; Xinjin Li; Zeyuan Wang

REVIEW 3 major objections 5 minor 14 references

Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that single-use tokens cannot stop a single user authorization from being executed multiple times under fresh token identifiers, and that replay resistance requires durable, monotonic state over the canonical action, the co

desk verdict A genuinely useful formalization of semantic replay and a sound conditional protocol, but the 0.9% canonicalization evasion leaves a real gap between the theorem and the implementation, and the preprint ships no artifacts. read the letter →

arxiv 2608.01710 v1 pith:7EEUYIYL submitted 2026-08-03 cs.AI

Jinghan Xu , Longze Fan , Zeyuan Wang , Xinjin Li , Hankai Liu This is my paper

classification cs.AI

keywords semanticreplayauthorizationconsumptionsingle-usetokensdurablestateLLMagentsecurityresistanceidempotencyCapLease

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tool-using LLM agents replan, retry, delegate, and recover, and each of those behaviors can turn one approved action into multiple executions under freshly issued single-use tokens. The paper names this failure semantic replay: exceeding the budget of the authorization itself, not reusing a token identifier. It argues that identifier-local consumption is inherently insufficient, and that replay-resistant execution requires durable state over the token-independent action identity, the authenticated confirmation, and the remaining execution budget. To demonstrate the requirement, it introduces CapLease, a consumption layer that binds an authorization to a canonical action and enforces atomic Issue–Prepare–Commit transitions; with trusted canonicalization, a linearizable ledger, and an idempotent sink, this bounds issuance, admission, and external effects by the authorized budget. The result matters because LLM agents with tool access can turn model errors into payments, messages, and credential changes, and existing authority checks do not limit how often an approved authorization is consumed.

What carries the argument

The central object is the token-independent action identity σ(c, γ) = (Pu, hc, ha, R), which binds a user principal, canonical operation, complete arguments, and target resource into one equivalence class for effect-equivalent calls; the authorization instance α = (σ, eu, b) adds the authenticated confirmation event and budget. CapLease's machinery is a durable ledger enforcing uniqueness over (σ, eu), combined with linearizable compare-and-swap transitions Issued→Prepared→Committed and a stable idempotency key k = H(ν ∥ j ∥ tool); the same records and transitions run server-side in the matched Server Ledger realization. The identity carries the argument by defining what counts as the same a

What would settle it

Take one authorization with budget b = 1 and submit two tool calls that produce the same external effect but differ only in argument order, naming, or formatting while keeping the same authenticated confirmation. If the ledger admits both and the sink produces two effects, the central claim fails; a systematic version is a benchmark of effect-equivalent call pairs measuring how often uniqueness over (σ, eu) collapses.

Watch

Extended reading notes

Core claim

The paper's central discovery is that semantic replay—a single user authorization being issued, admitted, or externally materialized beyond its execution budget under fresh token identifiers—cannot be prevented by any identifier-local single-use scheme. Prevention requires the issuer to retain durable, token-independent state over the action identity σ(c, γ) = (Pu, hc, ha, R), the authenticated confirmation event eu, and the remaining budget b. CapLease realizes this by recording a unique durable record per (σ, eu) and moving each budget slot through atomic Issued→Prepared→Committed transitions with a stable idempotency key; under matched centralized assumptions, a Server Ledger that keeps t

Load-bearing premise

The whole guarantee rests on the semantic canonicalization step: effect-equivalent calls must map to the same action identity and security-relevant differences must be kept apart, and if that mapping errs the budget bounds no longer hold.

Editorial extensions

If this is right

Any single-use token or grant scheme that tracks only its own identifier will permit fresh reissuance for the same authorization; stopping semantic replay requires durable state keyed by (σ, eu).
Replay-resistant consumption splits into three independent bounds—issuance, admission, and external effects—and the third cannot be guaranteed by the ledger alone: the external sink must honor the stable idempotency key.
Authority checking and durable consumption are complementary: upstream checks decide whether an action is authorized, while CapLease decides how many times that authorization may be used.
Across the replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios tested, both stateful designs prevent duplicate admission and duplicate effects while preserving legitimate first actions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The budget-bound formulation suggests a general design rule: model authorization as a stateful, budgeted resource rather than a transferable object, and treat the external sink's idempotency as part of the security contract, not an optional convenience.
The reliance on semantic canonicalization implies that the practical ceiling of this approach is set by the tool-schema author; a testable extension is to build adversarial suites of effect-equivalent but lexically different calls for common tool ecosystems and measure how often canonicalization merges or splits the wrong pairs.
The matched Server Ledger result hints that the authenticated manifest may be unnecessary for replay safety; a promising direction is to investigate whether cheaper authenticators suffice when the ledger itself is the point of control.
The structured-denial recovery results suggest replay safety and recovery can be jointly optimized; one extension is to automatically suggest re-canonicalized proposals when a replay is detected, turning a security rejection into a recovery signal.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Semantic replay is a real failure mode and this paper is the first to name and formalize it. The budget bounds (Eqs 4-6) and the conditional proof of Proposition 1 are clear and honest. The design choice — durable state over the authorization instance (σ, e_u) with atomic Issue-Prepare-Commit — is a sensible composition of known primitives, and the matched Server Ledger comparison correctly isolates durable state as the operative requirement. The 39.8% equivalent-reproposal rate over 10,152 trajectories is a solid empirical datapoint for the agent-security community.

Where it gets softer. The stress-test is essentially right: Table 6 reports a residual 0.9% canonicalization evasion. For those ~3 of 324 equivalent pairs, a second (σ, e_u) record is created, N_issue can exceed b, and with a non-idempotent sink the effect bound fails. The theorem is conditional on 'correct canonicalization,' so it's not a logical flaw, but the abstract's 'prevent duplicate effects' is stronger than what the implementation delivers. The paper should either fix the canonicalizer, make the sink key independent of the record ID, or state plainly that the guarantee holds modulo a small TCB residual.

Second, there is no code or data. The supplement is mentioned but not shipped with the preprint, so the 10,152 trajectories, 7,896 multi-budget instances, and 12,000 fault injections are unverifiable. For a systems paper this is a serious reproducibility gap.

Third, the all-zero CapLease rows are by design, and that's fine, but it means the evaluation shows the protocol does what it was built to do rather than surviving a real adversary. The canonicalization benchmark and the 282 workflow test are self-constructed. That is acceptable for a first characterization, but it limits how much weight the empirical claims can carry.

Overall, the paper is well-argued and the related work is positioned carefully. The main contribution is the semantic-replay framing and the explicit budget semantics, which is worth having in the literature. I'd send this to peer review. The authors should be asked to release artifacts, address the canonicalization residual head-on, and moderate the abstract's claims to match the TCB boundary. If the artifacts appear and the residual is handled honestly, this becomes a solid contribution to agent authorization.

Referee Report

3 major / 5 minor

Summary. The paper defines 'semantic replay' as consuming one token-independent authorization instance beyond its budget through freshly issued token identifiers (replanning, retries, delegation, concurrency, crash recovery). It argues that identifier-local single-use tokens are insufficient and that the issuer must retain durable, monotonic state over the canonical action σ(c,γ), the authenticated confirmation event e_u, and the remaining budget. The proposed CapLease layer stores a durable record indexed by (σ, e_u), enforces atomic Issued→Prepared→Committed transitions, and uses a stable idempotency key k for recovery. Proposition 1 states that, under correct canonicalization, trusted metadata, stable confirmation identifiers, a durable non-rollback linearizable ledger, and authenticated principals, CapLease bounds issuance and admission by b, and also bounds external effects if the sink is idempotent. The evaluation covers 10,152 agent trajectories, 7,896 multi-budget instances, 12,000 fault-injection schedules, a 648-pair canonicalization benchmark, structured-denial recovery, and a matched Server Ledger control.

Significance. If the conditional guarantee is accepted, the paper makes a useful conceptual contribution: it separates authorization identity from token identity and identifies durable state, not token representation, as the key systems requirement for replay resistance in LLM agent tool execution. The proof sketch is not circular and the trust model is explicit; the paper also honestly states that exactly-once external effects require sink idempotency, and the matched Server Ledger is a good control for isolating durable state. The empirical scope is large and the claimed reproducibility artifacts are a strength. However, the central guarantee is conditional on 'correct canonicalization,' and the paper's own canonicalization benchmark reports a 0.9% residual evasion rate, so the unconditional empirical claims are stronger than what is actually demonstrated.

major comments (3)

[Realizations and Guarantees / Table 6] Table 6 reports that tool-specific canonicalization reduces equivalent-call evasion from 13.9% to 0.9%. With 324 equivalent pairs, this leaves roughly 3 effect-equivalent calls that produce different σ. Proposition 1 is explicitly conditional on 'correct canonicalization'; the implementation therefore does not satisfy that premise, and the empirical statement that CapLease 'prevents duplicate effects' is not supported for those residual cases. Because uniqueness over (σ, e_u) is the only mechanism blocking fresh issuance (Eq. 4), an evasive pair can produce a fresh record and violate N_issue(α,τ) ≤ b; with a non-idempotent sink this also breaks N_effect(α,τ) ≤ b. The paper should either show zero security-relevant evasion against a formal equivalence oracle, add a rejection fallback for low-confidence canonicalization, or explicitly qualify all safety claims by the measured residual cano
[Problem Formulation and Semantic Replay, Eq. (1)] The action identity σ(c,γ) is defined only up to 'tool-specific canonicalization' that must 'map effect-equivalent calls to the same identity.' The paper never formalizes effect equivalence, so 'correct canonicalization' is not a checkable property. This makes Proposition 1's first premise vacuous in the formal statement while the evaluation's canonicalization benchmark uses an apparently different, informal notion. For a load-bearing assumption, the paper should provide a formal equivalence relation, or specify an oracle for the high-risk tool set, and show that the canonicalizer either implements it or rejects ambiguous inputs. Without this, the residual 0.9% cannot be assessed as acceptable or unacceptable.
[Transactional CapLease, multi-budget remark] For b>1 the paper states that larger budgets 'allocate at most b independently consumable slots' and that the slot counter bounds N_issue, but no atomic slot-allocation transaction is specified. The 7,896-instance multi-budget evaluation (Table 6) exercises this path, yet the protocol description does not show how the counter is incremented atomically with record creation. The proof sketch says 'Uniqueness over (σ,e_u) and the slot counter bound N_issue,' but the slot counter is an implementation detail that is load-bearing for the issuance bound. Please specify the exact conditional update (e.g., a CHECK that the number of allocated slots is < b before insert/update) so that the issuance bound is enforced by the ledger rather than assumed.

minor comments (5)

[Figure 1] Typo: 'Automic' should be 'Atomic' in the CapLease box.
[Author affiliations] The affiliation 'Columnbia University' appears to be a typo for 'Columbia University.'
[Table 6] The line 'no observed collision' should define what counts as a collision (effect-distinct pairs mapped to the same σ) and should report confidence intervals for the 0.9% evasion rate; with 324 pairs, the binomial uncertainty is nontrivial.
[Realizations and Guarantees] In the proof sketch, N_effect ≤ N_admit ≤ N_issue ≤ b is written with notation inconsistent with the earlier N_issue(α,τ), N_admit(α,τ), N_effect(α,τ). Align the notation.
[Reproducibility] The supplement is referenced multiple times ('appear in the supplement') but not linked. For a reproducibility-centered paper, include the supplement or an anonymized repository link in the submission.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: Proposition 1 is a conditional design theorem whose assumptions do not include its conclusion; only a non-load-bearing self-citation appears in related work.

full rationale

The central guarantee, Proposition 1, is a conditional correctness theorem, not a restatement of its own inputs. It assumes correct canonicalization, trusted metadata, stable confirmation identifiers, a durable non-rollback linearizable ledger, and authenticated principals/manifests; from these it derives bounded issuance via uniqueness over (σ, eu), bounded admission via the atomic Issued→Prepared transition, and bounded effects via sink idempotency. The assumptions do not include the target inequalities (4)–(6), so the proof is not circular. The empirical claim of 39.8% equivalent reproposals is measured from 10,152 trajectories, and the necessity claim about identifier-local tokens is supported by a concrete counterexample (fresh z2 for the same authorization α) rather than by definitional equivalence. The only self-citation is PACT (Fan et al. 2026) in the related-work section, comparing authority/provenance mechanisms; it is not load-bearing for the theorem, the protocol, or the experiments. The paper also honestly flags its boundary: Table 6 reports canonicalization evasion reduced to 0.9%, meaning Proposition 1's 'correct canonicalization' premise is not perfectly satisfied by the prototype; this is a stated robustness limitation, not circularity. Likewise, the proof sketch explicitly says that without sink idempotency the effect bound does not follow, reinforcing that the theorem is not asserted by fiat. Overall, the derived budget bounds are implementation invariants of the proposed mechanism, and the paper does not rename a fitted parameter or known result as an independent prediction.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The protocol introduces no fitted parameters. It relies on several trust assumptions typical of authorization systems: correct semantic canonicalization, trusted metadata and ledger, stable confirmation identifiers, and an idempotent sink. These are explicit in the threat model and Proposition 1. The central claim does not depend on any number fitted to data; the empirical reproposal rate is a measurement, not a parameter.

assumptions (5)

domain assumption Trusted semantic canonicalization correctly maps effect-equivalent calls to the same σ and separates security-relevant differences
Introduced in Eq. (1) and the 'Problem Formulation and Semantic Replay' section. All budget bounds in Proposition 1 depend on σ being the correct equivalence class. Ambiguous calls are rejected rather than assigned an uncertain identity.
domain assumption Trusted components provide durable, non-rollback, linearizable storage and authenticated action schemas, provenance, and confirmation events
Stated in the threat model and as preconditions of Proposition 1. Without this, uniqueness and atomic transitions could be violated by rollback or forgery.
domain assumption Stable confirmation identifiers: retries of the same confirmation challenge return the same eu
Required so uniqueness over (σ, eu) is meaningful. If eu varies, one user decision can create multiple authorization instances, breaking the issuance bound.
domain assumption The adversary cannot forge authenticated principals, confirmation events, provenance, policy epochs, tool contracts, or committed ledger transitions
Stated in the threat model section. If forgery were possible, an attacker could create new authorizations or alter records.
domain assumption For bounded effects, the external sink enforces idempotency over the stable key k
Proposition 1's effect bound explicitly requires sink idempotency. The paper honestly notes that without it, exactly-once physical effects cannot be guaranteed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions." pith.science (2026). https://pith.science/paper/7EEUYIYL

@misc{pith2026260801710,
  author       = {Pith},
  title        = {Pith review of: Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7EEUYIYL}},
  note         = {Machine review of arXiv:2608.01710}
}

read the original abstract

Tool-using large language model agents frequently replan, retry failed operations, delegate tasks, and resume after crashes. These behaviors can cause one user authorization to be requested and executed multiple times under freshly issued token identifiers, even when each individual token is single-use. We call this failure semantic replay: exceeding the execution budget of a token-independent authorization instance rather than merely reusing an old token identifier. We show that identifier-local token consumption cannot prevent fresh reissuance unless the issuer retains monotonic durable state over the authorized action, confirmation event, and remaining execution budget. We introduce CapLease, an authorization-consumption layer that follows proposal- and authority-level defenses, binds an authenticated user confirmation to a canonical action, and enforces transactional Issue-Prepare-Commit transitions. Across LLM-agent replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios, identifier-local tokens permit fresh semantic reissuance, whereas CapLease and an equally stateful Server Ledger prevent duplicate admission and, with an idempotent sink, duplicate external effects. Our results identify durable authorization state, rather than token representation alone, as the systems requirement for replay-resistant agent execution.

Figures

Figures reproduced from arXiv: 2608.01710 by the authors.

**Figure 2.** Equivalent reproposal rates across 10,152 agent [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Cross-artifact replay failures over the 4,036 equiv [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

14 extracted references · 8 canonical work pages

[1]

IPIGuard:ANovelToolDependencyGraph-Based Defense Against Indirect Prompt Injection in LLM Agents

An, H.; Zhang, J.; Du, T.; Zhou, C.; Li, Q.; Lin, T.; and Ji, S.2025. IPIGuard:ANovelToolDependencyGraph-Based Defense Against Indirect Prompt Injection in LLM Agents. In Christodoulopoulos, C.; Chakraborty, T.; Rose, C.; and Peng,V.,eds.,Proceedingsofthe2025ConferenceonEmpir- ical Methods in Natural Language Processing, 1023–1039. Suzhou, China: Associat...

work page 2025
[5]

DefeatingPromptInjectionsbyDesign.arXivpreprint arXiv:2503.18813. Debenedetti, E.; Zhang, J.; Balunovic, M.; Beurer-Kellner, L.;Fischer,M.;andTramer,F.2024.AgentDojo:ADynamic Environment to Evaluate Prompt Injection Attacks and De- fenses for LLM Agents. InAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track. Fan,L.;Li,Z.;Tian,...

arXiv 2024
[6]

AIRGuard:GuardingAgentActionswithRuntimeAuthority Control.arXiv preprint arXiv:2605.28914

Qin,S.;Zhuang,H.;Zhou,Y.;Han,Y.;andZhang,X.2026. AIRGuard:GuardingAgentActionswithRuntimeAuthority Control.arXiv preprint arXiv:2605.28914. Ruan, Y.; Dong, H.; Wang, A.; Pitis, S.; Zhou, Y.; Ba, J.; Dubois, Y.; Maddison, C. J.; and Hashimoto, T

arXiv 2026
[11]

InAdvances in Neural Information Processing Sys- tems

Toolformer:LanguageModelsCanTeachThemselvestoUse Tools. InAdvances in Neural Information Processing Sys- tems. Shi, T.; He, J.; Wang, Z.; Wu, L.; Li, H.; Guo, W.; and Song, D. 2025a. Progent: Programmable Privilege Control for LLM Agents.arXiv preprint arXiv:2504.11703. Shi,T.;Zhu,K.;Wang,Z.;Jia,Y.;Cai,W.;Liang,W.;Wang, H.;Alzahrani,H.;Lu,J.;Kawaguchi,K.;...

arXiv
[12]

SUDP: Secret-Use Delegation Protocol for Agentic Systems

SUDP:Secret-UseDelegationProtocolforAgenticSystems. arXiv preprint arXiv:2604.24920. Zhan, Q.; Liang, Z.; Ying, Z.; and Kang, D

work page Pith review arXiv
[14]

InInternational Conference on Learning Representations

Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and De- fenses in LLM-Based Agents. InInternational Conference on Learning Representations. Zhu,K.;Yang,X.;Wang,J.;Guo,W.;andWang,W.Y.2025. MELON: Provable Defense Against Indirect Prompt Injec- tionAttacksinAIAgents.arXivpreprintarXiv:2502.05174

arXiv 2025
[1985]

Secure communication using remote procedure calls.ACM Trans. Comput. Syst., 3(1): 1–14. Birrell,A.D.;andNelson,B.J.1984. Implementingremote procedure calls.ACM Trans. Comput. Syst., 2(1): 39–59. Cao,L.;Meng,L.;Stefan,D.;andFernandes,E.2024. State- ful Least Privilege Authorization for the Cloud. In33rd USENIX Security Symposium (USENIX Security 24), 3477–...

work page 1984
[1989]

InProceedings of the Twelfth ACM Symposium on Oper- ating Systems Principles, SOSP ’89, 202–210

Leases: an efficient fault- tolerant mechanism for distributed file cache consistency. InProceedings of the Twelfth ACM Symposium on Oper- ating Systems Principles, SOSP ’89, 202–210. New York, NY, USA: Association for Computing Machinery. ISBN 0897913388. Gray,J.1981. TheTransactionConcept:VirtuesandLimita- tions(InvitedPaper). InVeryLargeDataBases,7thIn...

work page 1981

Show all 14 references

[2000]

InFourth Symposium on Operating Systems Design and Im- plementation (OSDI 2000)

End-to-End Authorization. InFourth Symposium on Operating Systems Design and Im- plementation (OSDI 2000). San Diego, CA: USENIX Asso- ciation. Jia,F.;Wu,T.;Qin,X.;andSquicciarini,A.2025. TheTask Shield:EnforcingTaskAlignmenttoDefendAgainstIndirect Prompt Injection in LLM Agen...

2000
[2002]

InProceedings of the 11th USENIX Security Symposium, 93–108

A General and Flexible Access-Control System for the Web. InProceedings of the 11th USENIX Security Symposium, 93–108. USA: USENIX Association. ISBN 1931971005. Birgisson, A.; Politz, J. G.; Erlingsson, U.; Taly, A.; Vrable, M.;andLentczner,M.2014. Macaroons:CookieswithCon- te...

2014
[2023]

Saltzer, J

Iden- tifyingtheRisksofLMAgentswithanLM-EmulatedSand- box.arXiv preprint arXiv:2309.15817. Saltzer, J. H.; and Schroeder, M. D

arXiv
[2024]

In Ku, L.-W.; Martins, A.; and Srikumar, V., eds.,Findings of the Asso- ciation for Computational Linguistics: ACL 2024, 10471– 10506

In- jecAgent:BenchmarkingIndirectPromptInjectionsinTool- Integrated Large Language Model Agents. In Ku, L.-W.; Martins, A.; and Srikumar, V., eds.,Findings of the Asso- ciation for Computational Linguistics: ACL 2024, 10471– 10506. Bangkok, Thailand: Association for Computatio...

2024
[2025]

arXiv preprint arXiv:2505.03574

LlamaFirewall: An Open Source Guardrail System for Building Secure AI Agents. arXiv preprint arXiv:2505.03574. Debenedetti, E.; Shumailov, I.; Fan, T.; Hayes, J.; Carlini, N.; Fabian, D.; Kern, C.; Shi, C.; Terzis, A.; and Tramèr, F

arXiv
[2026]

Schick, T.; Dwivedi-Yu, J.; Dessi, R.; Raileanu, R.; Lomeli, M.; Zettlemoyer, L.; Cancedda, N.; and Scialom, T

Context-to-Execution Integrity for LLM Agents.arXiv preprint arXiv:2607.06000. Schick, T.; Dwivedi-Yu, J.; Dessi, R.; Raileanu, R.; Lomeli, M.; Zettlemoyer, L.; Cancedda, N.; and Scialom, T

arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.

[1] [1]

IPIGuard:ANovelToolDependencyGraph-Based Defense Against Indirect Prompt Injection in LLM Agents

An, H.; Zhang, J.; Du, T.; Zhou, C.; Li, Q.; Lin, T.; and Ji, S.2025. IPIGuard:ANovelToolDependencyGraph-Based Defense Against Indirect Prompt Injection in LLM Agents. In Christodoulopoulos, C.; Chakraborty, T.; Rose, C.; and Peng,V.,eds.,Proceedingsofthe2025ConferenceonEmpir- ical Methods in Natural Language Processing, 1023–1039. Suzhou, China: Associat...

work page 2025

[2] [5]

DefeatingPromptInjectionsbyDesign.arXivpreprint arXiv:2503.18813. Debenedetti, E.; Zhang, J.; Balunovic, M.; Beurer-Kellner, L.;Fischer,M.;andTramer,F.2024.AgentDojo:ADynamic Environment to Evaluate Prompt Injection Attacks and De- fenses for LLM Agents. InAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track. Fan,L.;Li,Z.;Tian,...

arXiv 2024

[3] [6]

AIRGuard:GuardingAgentActionswithRuntimeAuthority Control.arXiv preprint arXiv:2605.28914

Qin,S.;Zhuang,H.;Zhou,Y.;Han,Y.;andZhang,X.2026. AIRGuard:GuardingAgentActionswithRuntimeAuthority Control.arXiv preprint arXiv:2605.28914. Ruan, Y.; Dong, H.; Wang, A.; Pitis, S.; Zhou, Y.; Ba, J.; Dubois, Y.; Maddison, C. J.; and Hashimoto, T

arXiv 2026

[4] [11]

InAdvances in Neural Information Processing Sys- tems

Toolformer:LanguageModelsCanTeachThemselvestoUse Tools. InAdvances in Neural Information Processing Sys- tems. Shi, T.; He, J.; Wang, Z.; Wu, L.; Li, H.; Guo, W.; and Song, D. 2025a. Progent: Programmable Privilege Control for LLM Agents.arXiv preprint arXiv:2504.11703. Shi,T.;Zhu,K.;Wang,Z.;Jia,Y.;Cai,W.;Liang,W.;Wang, H.;Alzahrani,H.;Lu,J.;Kawaguchi,K.;...

arXiv

[5] [12]

SUDP: Secret-Use Delegation Protocol for Agentic Systems

SUDP:Secret-UseDelegationProtocolforAgenticSystems. arXiv preprint arXiv:2604.24920. Zhan, Q.; Liang, Z.; Ying, Z.; and Kang, D

work page Pith review arXiv

[6] [14]

InInternational Conference on Learning Representations

Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and De- fenses in LLM-Based Agents. InInternational Conference on Learning Representations. Zhu,K.;Yang,X.;Wang,J.;Guo,W.;andWang,W.Y.2025. MELON: Provable Defense Against Indirect Prompt Injec- tionAttacksinAIAgents.arXivpreprintarXiv:2502.05174

arXiv 2025

[7] [1985]

Secure communication using remote procedure calls.ACM Trans. Comput. Syst., 3(1): 1–14. Birrell,A.D.;andNelson,B.J.1984. Implementingremote procedure calls.ACM Trans. Comput. Syst., 2(1): 39–59. Cao,L.;Meng,L.;Stefan,D.;andFernandes,E.2024. State- ful Least Privilege Authorization for the Cloud. In33rd USENIX Security Symposium (USENIX Security 24), 3477–...

work page 1984

[8] [1989]

InProceedings of the Twelfth ACM Symposium on Oper- ating Systems Principles, SOSP ’89, 202–210

Leases: an efficient fault- tolerant mechanism for distributed file cache consistency. InProceedings of the Twelfth ACM Symposium on Oper- ating Systems Principles, SOSP ’89, 202–210. New York, NY, USA: Association for Computing Machinery. ISBN 0897913388. Gray,J.1981. TheTransactionConcept:VirtuesandLimita- tions(InvitedPaper). InVeryLargeDataBases,7thIn...

work page 1981