Pith. sign in

REVIEW 3 major objections 5 minor 42 references

Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AI agents' free-form explanations can be turned into typed action claims and checked against server facts, so contradictions deny, uncertainty reviews, and only matching claims execute.

desk verdict Sound design and unusually honest limitations, but the headline conformance numbers are self-referential and the load-bearing security guarantee is assumed, not demonstrated. read the letter →

arxiv 2607.25364 v2 pith:MI7LFSW4 submitted 2026-07-28 cs.AI cs.SE

Genliang Zhu (1 , 2) , Chu Wang (1 , 3) ((1) Accentrust , (2) Georgia Institute of Technology , (3) University of Illinois Urbana-Champaign) This is my paper · ORCID
classification cs.AIcs.SE
keywords AIagentstoolexecutionactionclaimsserver-sideverificationpromptinjectiondefenseleastprivilegeauditabilityaccesscontrol
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes that the right way to govern tool-using AI agents is to treat the explanation an agent gives for a tool call as an untrusted set of checkable claims, not as evidence of intent. It introduces Explanation-Bound Tool Execution (EBTE), a mediation layer that extracts typed fields—declared intent, tool, policy basis, expected effect, risk, uncertainty, context dependencies, and evidence digests—and compares them with independently held server facts. If any hard claim conflicts, the action is denied; if evidence is incomplete or uncertain, it is routed to review; only fully matching, low- or medium-risk claims can execute. The paper formalizes this as a three-outcome decision lattice (Allow, Review, Deny) and proves that the composed decision is never less restrictive than existing authorization or effect controls. The stated payoff is a concrete, auditable way to stop prompt-injected or hallucinated rationales from widening what an agent can do—without trusting chain-of-thought or the model's self-report.

What carries the argument

The central object is the ToolInvocationExplanation—a bounded, typed object an agent must emit alongside a tool call, containing declared intent, selected tool, policy basis, expected effect, risk tier, uncertainty, context dependencies, and digest references. The verifier treats it as untrusted and compares each enforceable field against server-held facts: an intent certificate, canonical tool registry, authorized route record, policy snapshot, and context-risk snapshot. The operator that carries the argument is the least-upper-bound join over {Allow, Review, Deny}: any hard contradiction or missing authority forces the most restrictive outcome, while advisory fields such as intentSummary a

What would settle it

Instrument a live deployment where server fact sources are deliberately corrupted—for example, a stale intent certificate or a tampered policy rule—and check whether EBTE allows an action that contradicts the true current intention; if stale facts produce an Allow, the non-widening and non-execution claims fail. A simpler local test: take any of the 136 authored scenarios, swap a server fact to a wrong-but-valid value, and observe whether the verifier still returns the profile disposition.

Watch

Extended reading notes

Core claim

EBTE's core claim is that the decision-relevant content of an agent's explanation can be projected onto a fixed set of dimensions (schema, intent, tool, route, resource, effect, policy, risk, uncertainty, context, evidence, privacy) and compared dimension-by-dimension with server-held facts. Each comparison yields match, soft, hard, or unknown; the verifier maps these to Allow, Review, or Deny, with hard dominating, and then joins with baseline authorization and effect controls by taking the most restrictive outcome. The design invariant is non-widening: because the final decision is the least upper bound of the three components, an explanation can never make an action less restricted. A sec

Load-bearing premise

The guarantee rests on the assumption that every tool effect really does pass through the gateway, that the server's facts are correct and current, and that a review can never be acted on without fresh re-verification—and the paper's own implementation stops at draft creation, leaving the later approval step untested.

Editorial extensions

If this is right

  • Deployed at a reference-monitor boundary, EBTE would prevent prompt-injected or hallucinated tool calls from executing when the explanation contradicts server-held intent, policy, route, payload, or context facts.
  • Because review outcomes create non-executing drafts that must be re-verified at action time, no stale or later-modified approval can bypass current policy.
  • The non-widening property means EBTE can be composed with existing authorization and effect controls without weakening them; it adds an extra deny or review signal even when credentials are broad.
  • The minimal audit packet allows decisions to be replayed and audited without exposing raw prompts, private records, or model traces—a structural answer to evidence and disclosure concerns.
  • The evaluation indicates a diagnostic gain: task–proposal contradictions that existing high-risk gates only route to review can be specifically denied when intent-to-payload binding is checked.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension beyond the paper: apply the same claim-checking contract to other agent side effects—such as data-exfiltration attempts smuggled through bounded free-text fields—and measure whether the verifier's non-widening property still holds when the advisory summary is the only channel.
  • Because low uncertainty is not independently certifiable and can only tighten routing, a deployment that wants real assurance likely needs independent random audits or semantic content scanning to catch encoded disclosure in advisory text—a step the authors explicitly defer.
  • The non-widening invariant is independent of model behavior, so the most consequential operational factor is the integrity and freshness of the server fact sources; deployments should invest in fact-freshness and identity binding before relying on EBTE's guarantees.
  • The paper stops at draft creation and leaves the later approval transition untested; a natural next experiment is measuring human-operator false-accept and false-reject rates on production review queues, since the security guarantee depends on that transition being re-verified.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces Explanation-Bound Tool Execution (EBTE), a mediation layer in which an agent's free-form rationale is replaced by a typed, claim-carrying ToolInvocationExplanation object. The gateway compares enforceable claims against server-held intent, tool, route, payload, policy, risk, context, and evidence facts, and computes a disposition in {Allow, Review, Deny} as a least upper bound over baseline authorization, the EBTE decision, and effect controls. Propositions 1--4 formalize that this composition is non-widening, that hard contradictions do not execute under complete mediation, that decisions are monotone, and that the minimized audit packet permits structural replay. The paper also reports a reference profile implementation, a 136-scenario conformance suite, a draft-only OpenPort integration, a frozen 224-attempt hosted-model record plus a zero-call offline revalidation, and a pinned AgentDojo-derived semantic adaptation. The central formal invariant is sound, but the empirical evidence largely establishes implementation conformance to a self-defined profile, while the security-relevant execution boundary remains unevaluated.

Significance. If the formal claim is taken as a design invariant under the stated assumptions, the paper contributes a useful discipline: separating untrusted explanatory prose from server-checkable action claims, and composing decisions monotonically with existing authorization and effect controls. The typed contract, stable reason taxonomy, and minimal-disclosure audit packet are concrete and well specified. The formal lattice argument (Prop. 1, §V) is correct, and the exhaustive 27-triple join check is a legitimate implementation check. The paper is also unusually candid about its assumptions and limitations. However, the paper's broader title-level claim that EBTE provides 'server-verified action claims without trusting model rationales' is not empirically established: the security guarantee is conditional on complete mediation and action-time recomputation, and the evaluation exercises neither the Allow path nor the Review-to-approval transition. The 1.0000 profile-disposition agreement is conformance to the same profile that defines the expected outcomes, so it is not independent evidence of security efficacy. The significance of the work is therefore primarily as a formalized design and a

major comments (3)
  1. [§V (Prop. 2), §III.B.a, §X] The load-bearing security claim is that hard contradictions do not execute and that review cannot execute without a fresh action-time decision. Proposition 2 is explicitly conditional on complete mediation, sound hard-comparison predicates, correct and current server facts, and action-time recomputation. The evaluation never instantiates this environment: the reference integration forces every forwarded action to terminate as a non-executing draft, and §III.B.a states that 'the later approval transition remains unevaluated.' Table IV's HCFD=0.0000 therefore only shows that dE=Deny before a forced-draft boundary; it does not test that an Allow outcome executes under complete mediation, that an approved Review draft re-resolves current facts, or that dX (effect control) is present. Proposition 1's non-widening relative to dX is likewise untested because no effect executor exists. The autho
  2. [§VIII.B, Table III, §XVI] The conformance evaluation is circular by construction: expected dispositions are derived from the same public profile that the evaluator implements, as the paper itself states in §VIII.B and §XVI. Consequently, PDA=1.0000, SNAC=1.0000, and HFAR=0.0000 are evidence of implementation-against-specification, not of security efficacy. The AgentDojo-derived adaptation does not break this circularity, because all 12 attack proposals are already non-allow under the high-risk ablations; EBTE's incremental effect is only to change review to deny for task--proposal contradictions, which the paper reports as a diagnostic distinction rather than additional blocking. The evaluation therefore does not show that EBTE prevents any attack that existing controls would allow. This does not invalidate the conformance contribution, but it means the title and abstract's 'server-verified' language overstates w
  3. [Appendix G-A] The central evidence for the paper is the deterministic artifact (verifier, conformance runner, wrapper, model pilot, and AgentDojo adapter), but Appendix G-A states that source code and task-level evaluation data are 'maintained as an internal research artifact and are not distributed with this manuscript.' The 1.0000 conformance results, 232 metamorphic checks, and subsequent empirical tables cannot be independently reproduced or audited by readers. For a paper whose main positive evidence is an implementation artifact, this is a substantial reproducibility gap. I would ask the authors to release the artifact under a permissive license in a public repository, or at minimum to provide the verifier and conformance runner as supplement, before the empirical claims can be fully credited.
minor comments (5)
  1. [§V] The description of exact-set comparison (slice at the registered field cap, then filter and deduplicate parseable bounded strings) is technically precise but difficult to follow. A small worked example showing how an over-cap tail, a duplicate value, and a malformed sibling are each treated would substantially improve readability.
  2. [§III.A and Table I] The relationship between the seven server facts (C, T, P, R, Xs, Q, H) and the three evidence-ref digest types is not immediately clear. In particular, context dependencies are described as carrying digests, but the evidenceRefs array contains only intent, policy, and payload digests. Please clarify where the context digest is bound in the packet.
  3. [§XI, Tables V and VI] The agreement reporting uses both total attempts and conditional-on-response denominators. The conditional values are parenthesized, but the main-text narrative alternates between the two. Please state explicitly in the text which denominator is the headline metric and why, to avoid reader confusion.
  4. [Appendix D] In the pseudocode, the variable 'hard' is computed before the schema-invalid branch and then reused inside that branch. This is correct, but a one-sentence comment explaining that schema-invalid results do not suppress independently resolvable hard contradictions would prevent misreading.
  5. [Throughout] There are a few formatting inconsistencies, including the 'OW ASP' spacing in §II.B and the citation style (e.g., 'Prop.' with and without a period). A final proofreading pass would polish the presentation.

Circularity Check

1 steps flagged · score 4.0 of 10

The conformance evidence is a disclosed spec-against-itself check, while the load-bearing security invariants are conditional on untested mediation assumptions; the core formal mechanism itself is not circular.

  1. self definitional [§XVI (Limitations and Threats to Validity); cf. §VIII.B]
    "Expected outcomes are defined by the same profile implemented by the evaluator, so profile-disposition agreement measures conformance within that profile."

    The headline empirical support (PDA=1.0000, 0/96 hard allows, 232/232 metamorphic checks) is implementation-against-spec: expected dispositions, the public profile, and the full evaluator all instantiate the same authored profile, so agreement is true by construction for a conforming implementation and cannot independently validate the security proposition. The paper concedes this and explicitly says the conformance runner 'validates the finite join implementation, not complete mediation by the draft-only wrapper.' The formal invariants, meanwhile, are conditional on complete mediation and action-time recomputation that the draft-only wrapper does not instantiate, so they remain untested rather than confirmed by these numbers.

full rationale

The paper splits into two evidentiary chains. The formal invariants (Props. 1–4, §V) are not circular: Prop. 1 states d* = d0 ⊔ dE ⊔ dX and observes that the join is the maximum under ⪯, so non-widening follows by definition of the order; Prop. 2 is an explicit conditional ('Assume complete mediation, sound hard-comparison predicates, correct and current server facts, and action-time recomputation') and its proof is valid under those assumptions. Those assumptions are not exercised by the draft-only wrapper (§X.A: 'every forwarded action terminates as a non-executing draft'; §III.B.a: 'the later approval transition remains unevaluated'), so the security claim is under-supported—but that is a validity and completeness threat, not a circular reduction. The actual circular step is in the conformance evaluation: expected outcomes are defined by the same profile implemented by the evaluator, which the paper states plainly in §XVI (and effectively in §VIII.B: 'Expected dispositions and the full evaluator instantiate the same public profile'). PDA=1.0000 is therefore a consistency check of implementation against an author-authored specification, not external validation; it cannot by itself establish that EBTE blocks real attacks. The minor self-citation of [27] for intent-governed authorization is not load-bearing because the model treats the intent certificate C as a trusted-fact assumption rather than deriving EBTE's guarantee from that citation. Overall, there is one disclosed self-definitional evaluation step, while the core conditional formalism has independent content, so the circularity burden is moderate rather than total.

Assumptions & free parameters 0 free parameters · 5 assumptions · 2 invented entities

EBTE's formal results are conditional on the paper's own definitions (D3 lattice, per-predicate availability, context/evidence normalization) and on unverified environment assumptions (complete mediation, trustworthy fact sources). No parameters are fitted to data; the profile's numeric caps and risk tiers are hand-set design bounds that do not affect the lattice invariants. The main burden is that the conformance profile is authored by the same framework it validates, so its dispositions (which mismatches are hard vs soft) are not independently grounded.

assumptions (5)
  • domain assumption Complete mediation and action-time recomputation: 'Assume complete mediation, sound hard-comparison predicates, correct and current server facts, and action-time recomputation' (Prop. 2, §V).
    The non-execution guarantee disappears if the gateway does not enforce d⋆=Allow or if an approval path skips re-resolution. The paper's own wrapper is draft-only and 'does not instantiate an effect executor' (§IX.D), and 'the later approval transition remains unevaluated' (§III.B.a).
  • domain assumption Trusted enforcement environment: 'We assume that principal and tenant binding, gateway code, the canonical policy and tool stores, digest implementation, clocks or version sources, and scoped current-state resolution are correct' (§III.B).
    A compromised fact source or confused-deputy identity binding is outside the guarantee envelope, yet the entire check compares claims against these facts.
  • standard math Decision-domain semantics: the three-outcome lattice (Allow≺Review≺Deny) with least-upper-bound composition defines EBTE's behavior (§V).
    Monotone lattice join is the system's model, not an external law; the non-widening property is a logical consequence of this definition (Prop. 1).
  • domain assumption Availability semantics: unregistered or unavailable authoritative operands are 'unknown' and can never be treated as match; exact-set and cap-first canonicalization (§V).
    The 'missing facts cannot be silently replaced by model assertions' guarantee is implemented through this rule; it is a design assumption about the comparison functions.
  • domain assumption Context and evidence model: normalized context set Deps(e)=∅ for trusted context and exactly the current pair otherwise; evidence freshness compares every parseable required digest against current-state digests (§V).
    These profile v0.1 definitions determine which omissions are hard vs review; they are the authors' schema choices, not independently established ground truth.
invented entities (2)
  • ToolInvocationExplanation (typed explanation contract with 8 field groups and evidence references)
    purpose: Carries decision-relevant claims from the model to the gateway; the server verifies non-advisory fields against current facts.
    Central new artifact; validated only by authored conformance and a diagnostic external adaptation. The schema is published, but the implementation is not distributed, so no external falsifiable handle exists outside the manuscript.
  • 18-predicate stable reason taxonomy and minimized audit packet
    purpose: Maps predicate outcomes to stable codes and stores digest-based evidence excluding raw context.
    Packet format is defined by the authors; structural conformance is self-tested (136 packets), with no third-party validation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales." pith.science (2026). https://pith.science/paper/MI7LFSW4

@misc{pith2026260725364,
  author       = {Pith},
  title        = {Pith review of: Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MI7LFSW4}},
  note         = {Machine review of arXiv:2607.25364}
}
read the original abstract

Tool-using agents expose structured calls but commonly attach free-form rationales. Such rationales are neither authorization nor reliable introspection. We present Explanation-Bound Tool Execution (EBTE), a claim-carrying mediation layer that converts decision-relevant rationale content into typed action claims and checks them against server-held intent, policy, payload, tool, risk, provenance, and freshness facts. EBTE cannot widen baseline authority: conflicts deny, incomplete or uncertain claims review, and only matching claims remain eligible for governed execution. We formalize this composition under explicit mediation and trusted-fact assumptions and implement a versioned reference profile with minimized audit packets. Across 136 authored conformance scenarios, the full profile matches all specified dispositions, admits none of 96 designated hard contradictions, and passes 232 metamorphic checks. A draft-only reference integration forwards none of 48 authored hard cases under EBTE while preserving all 16 soft-review and 4 aligned draft paths. In a frozen 2026-07-12 exploratory 224-attempt hosted-model record, the historical generation/runner agreement counts are 71/96, 66/96, and 19/32; a zero-call revalidation of the preserved minimized claims under the current pipeline yields 70/96, 65/96, and 17/32. In an AgentDojo-derived semantic check, existing high-risk controls make all 12 attack proposals non-allow, while EBTE resolves the task--proposal contradictions as deny. Together, these studies establish profile conformance and demonstrate the feasibility of server-checked action claims within the evaluated settings.

Figures

Figures reproduced from arXiv: 2607.25364 by the authors.

Figure 1
Figure 1. EBTE verifies an untrusted explanation against independently held facts. Every outcome produces minimized decision evidence. [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 6 linked inside Pith

  1. [1]

    Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting,

    M. Turpin, J. Michael, E. Perez, and S. R. Bowman, “Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting,” inAdvances in Neural Information Processing Systems, vol. 36. Red Hook, NY , USA: Curran Associates, Inc., 2023, pp. 74 952–74 965. [Online]. Available: https://proceedings.neurips.cc/paper files/pap...

    2023

  2. [2]

    Measuring faithfulness in chain-of-thought reasoning,

    T. Lanham, A. Chen, A. Radhakrishnan, B. Steiner, C. Denison, D. Hernandez, D. Li, E. Durmus, E. Hubinger, J. Kernion, K. Luko ˇsi¯ut˙e, K. Nguyen, N. Cheng, N. Joseph, N. Schiefer, O. Rausch, R. Larson, S. McCandlish, S. Kundu, S. Kadavath, S. Yang, T. Henighan, T. Maxwell, T. Telleen-Lawton, T. Hume, Z. Hatfield-Dodds, J. Kaplan, J. Brauner, S. R. Bowma...

    arXiv 2023

  3. [3]

    Dissociation of faithful and unfaithful reasoning in LLMs,

    E. Yee, A. Li, C. Tang, Y . H. Jung, R. Paturi, and L. Bergen, “Dissociation of faithful and unfaithful reasoning in LLMs,” 2024, preprint. [Online]. Available: https://arxiv.org/abs/2405.15092

    arXiv 2024

  4. [4]

    ReAct: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y . Cao, “ReAct: Synergizing reasoning and acting in language models,” in International Conference on Learning Representations. Kigali, Rwanda: OpenReview.net, 2023. [Online]. Available: https://openreview.net/forum?id=WE vluYUL-X

    2023

  5. [5]

    Why should i trust you?: Explaining the predictions of any classifier,

    M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should i trust you?: Explaining the predictions of any classifier,” inProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York, NY , USA: Association for Computing Machinery, 2016, pp. 1135–1144

    2016

  6. [6]

    Explanation in artificial intelligence: Insights from the social sciences,

    T. Miller, “Explanation in artificial intelligence: Insights from the social sciences,”Artificial Intelligence, vol. 267, pp. 1–38, 2019

    2019

  7. [7]

    The mythos of model interpretability,

    Z. C. Lipton, “The mythos of model interpretability,”Queue, vol. 16, no. 3, pp. 31–57, 2018

    2018

  8. [8]

    Interpreting interpretability: Understanding data scientists’ use of interpretability tools for machine learning,

    H. Kaur, H. Nori, S. Jenkins, R. Caruana, H. Wallach, and J. Wortman Vaughan, “Interpreting interpretability: Understanding data scientists’ use of interpretability tools for machine learning,” inProceedings of the 2020 CHI Conference on Human Factors in Computing Systems. New York, NY , USA: Association for Computing Machinery, 2020, pp. 1–14

    2020

Show all 42 references
  1. [9]

    Manipulating and measuring model interpretability,

    F. Poursabzi-Sangdeh, D. G. Goldstein, J. M. Hofman, J. Wortman Vaughan, and H. Wallach, “Manipulating and measuring model interpretability,” inProceedings of the 2021 CHI Conference on Human Factors in Computing Systems. New York, NY , USA: Association for Computing Machinery...

    2021

  2. [10]

    The protection of information in computer systems,

    J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,”Proceedings of the IEEE, vol. 63, no. 9, pp. 1278–1308, 1975

    1975

  3. [11]

    Guide to attribute based access control (ABAC) definition and considerations,

    V . C. Hu, D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone, “Guide to attribute based access control (ABAC) definition and considerations,” National Institute of Standards and Technology, NIST Special Publication 800-162, 2014. [Online]. Available: ...

    2014 doi

  4. [12]

    Not what you’ve signed up for: Compromising real-world LLM-Integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM-Integrated applications with indirect prompt injection,” inProceedings of the 16th ACM Workshop on Artificial Intelligence and Security. New York...

    2023

  5. [13]

    Identifying the risks of LM agents with an LM-Emulated sandbox,

    Y . Ruan, H. Dong, A. Wang, S. Pitis, Y . Zhou, J. Ba, Y . Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of LM agents with an LM-Emulated sandbox,” inThe Twelfth International Conference on Learning Representations. Vienna, Austria: OpenReview.net,

  6. [14]

    AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tram `er, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inAdvances in Neural Information Processing Systems 37. Red Hook, NY , USA: Curran Assoc...

    2024

  7. [15]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics: ACL 2024. Bangkok, Thailand: Association for Computational Linguistics, 2...

    2024

  8. [16]

    Prompt injection attack to tool selection in LLM agents,

    J. Shi, Z. Yuan, G. Tie, P. Zhou, N. Z. Gong, and L. Sun, “Prompt injection attack to tool selection in LLM agents,” inNetwork and Distributed System Security Symposium (NDSS 2026). San Diego, CA, USA: Internet Society, 2026. [Online]. Available: https://www.ndss-symposium.org...

    2026

  9. [17]

    MCPTox: A benchmark for tool poisoning on real-world MCP servers,

    Z. Wang, Y . Gao, Y . Wang, S. Liu, H. Sun, H. Cheng, G. Shi, H. Du, and X. Li, “MCPTox: A benchmark for tool poisoning on real-world MCP servers,”Proceedings of the AAAI Conference on Artificial Intelligence, vol. 40, no. 42, pp. 35 811–35 819, 2026. [Online]. Available: http...

    2026

  10. [18]

    StruQ: Defending against prompt injection with structured queries,

    S. Chen, J. Piet, C. Sitawarin, and D. Wagner, “StruQ: Defending against prompt injection with structured queries,” in34th USENIX Security Symposium (USENIX Security 25). Seattle, W A: USENIX Association, 2025, pp. 2383–2400. [Online]. Available: https://www.usenix.org/confere...

    2025

  11. [19]

    AttriGuard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations,

    Y . He, H. Zhu, Y . Li, S. Shao, H. Yao, Z. Liu, and Z. Qin, “AttriGuard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations,” in35th USENIX Security Symposium (USENIX Security 26). Baltimore, MD: USENIX Association, 2026. [Online]. Av...

    2026

  12. [20]

    Tools – model context protocol specification, 2025-11-25,

    Model Context Protocol, “Tools – model context protocol specification, 2025-11-25,” https://modelcontextprotocol.io/specification/2025-11-25/server/tools, 2025, version 2025-11-25; accessed 2026-07-24

    2025

  13. [21]

    Authorization – model context protocol specification, 2025-11-25,

    ——, “Authorization – model context protocol specification, 2025-11-25,” https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization, 2025, version 2025-11-25; accessed 2026-07-24

    2025

  14. [22]

    Artificial intelligence risk management framework: Generative artificial intelligence profile,

    National Institute of Standards and Technology, “Artificial intelligence risk management framework: Generative artificial intelligence profile,” National Institute of Standards and Technology, NIST AI 600-1, 2024. [Online]. Available: https://doi.org/10.6028/NIST.AI.600-1

    2024 doi

  15. [23]

    LLM01:2025 prompt injection,

    OW ASP Foundation, “LLM01:2025 prompt injection,” https://genai.owasp.org/llmrisk/llm01-prompt-injection/, 2025, accessed 2026-07-12

    2025

  16. [24]

    Auditable agents,

    Y . Nian, A. Yuan, H. Zhang, J. Li, and Y . Zhao, “Auditable agents,” 2026, preprint. [Online]. Available: https://arxiv.org/abs/2604.05485

    2026 arXiv

  17. [25]

    Agent audit: A security analysis system for LLM agent applications,

    H. Zhang, Y . Nian, and Y . Zhao, “Agent audit: A security analysis system for LLM agent applications,” 2026, preprint. [Online]. Available: https://arxiv.org/abs/2603.22853

    2026

  18. [26]

    JSON canonicalization scheme (JCS),

    A. Rundgren, B. Jordan, and S. Erdtman, “JSON canonicalization scheme (JCS),” RFC 8785, 2020. [Online]. Available: https://www.rfc-editor.org/rfc/rfc8785.html

    2020

  19. [27]

    Intent-governed tool authorization for AI agents,

    G. Zhu and C. Wang, “Intent-governed tool authorization for AI agents,” 2026, preprint. [Online]. Available: https://arxiv.org/abs/2606.22916

    2026 arXiv

  20. [28]

    To trust or to think: Cognitive forcing functions can reduce overreliance on AI in AI-Assisted decision-making,

    Z. Buc ¸inca, M. B. Malaya, and K. Z. Gajos, “To trust or to think: Cognitive forcing functions can reduce overreliance on AI in AI-Assisted decision-making,” inProceedings of the 2021 CHI Conference on Human Factors in Computing Systems. New York, NY , USA: Association for Co...

    2021

  21. [29]

    Crying wolf: An empirical study of SSL warning effectiveness,

    J. Sunshine, S. Egelman, H. Almuhimedi, N. Atri, and L. F. Cranor, “Crying wolf: An empirical study of SSL warning effectiveness,” in 18th USENIX Security Symposium. Montreal, Quebec: USENIX Association, 2009, pp. 399–416. [Online]. Available: https://www.usenix.org/conference...

    2009

  22. [30]

    Guidelines for Human-AI interaction,

    S. Amershi, D. Weld, M. V orvoreanu, A. Fourney, B. Nushi, P. Collisson, J. Suh, S. Iqbal, P. N. Bennett, K. Inkpen, J. Teevan, R. Kikin-Gil, and E. Horvitz, “Guidelines for Human-AI interaction,” inProceedings of the 2019 CHI Conference on Human Factors in Computing Systems. ...

    2019

  23. [31]

    Explainable security,

    L. Vigan`o and D. Magazzeni, “Explainable security,” in2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Genoa, Italy: IEEE, 2020, pp. 293–300. [Online]. Available: https://doi.org/10.1109/EuroSPW51379.2020.00045

    2020

  24. [32]

    Towards explainable access control [BlueSky Paper],

    G. Hasel Mehri, C. Morisset, and N. Zannone, “Towards explainable access control [BlueSky Paper],” inProceedings of the 30th ACM Symposium on Access Control Models and Technologies. New York, NY , USA: Association for Computing Machinery, 2025, pp. 117–126. [Online]. Available...

    2025

  25. [33]

    SmartAuth: User-centered authorization for the internet of things,

    Y . Tian, N. Zhang, Y .-H. Lin, X. Wang, B. Ur, X. Guo, and P. Tague, “SmartAuth: User-centered authorization for the internet of things,” in26th USENIX Security Symposium (USENIX Security 17). Vancouver, BC: USENIX Association, 2017, pp. 361–378. [Online]. Available: https://...

    2017

  26. [34]

    AWare: Preventing abuse of privacy-sensitive sensors via operation bindings,

    G. Petracca, A.-A. Reineh, Y . Sun, J. Grossklags, and T. Jaeger, “AWare: Preventing abuse of privacy-sensitive sensors via operation bindings,” in26th USENIX Security Symposium (USENIX Security 17). Vancouver, BC: USENIX Association, 2017, pp. 379–396. [Online]. Available: ht...

    2017

  27. [35]

    Decision provenance: Harnessing data flow for accountable systems,

    J. Singh, J. Cobbe, and C. Norval, “Decision provenance: Harnessing data flow for accountable systems,”IEEE Access, vol. 7, pp. 6562–6574, 2019. [Online]. Available: https://doi.org/10.1109/ACCESS.2018.2887201

    2019

  28. [36]

    ACCESSPROV: Tracking the provenance of access control decisions,

    F. Capobianco, C. Skalka, and T. Jaeger, “ACCESSPROV: Tracking the provenance of access control decisions,” in9th USENIX Workshop on the Theory and Practice of Provenance (TaPP 2017). Seattle, W A: USENIX Association, 2017. [Online]. Available: https://www.usenix.org/conferenc...

    2017

  29. [37]

    Defeating prompt injections by design,

    E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tram `er, “Defeating prompt injections by design,” inIEEE Conference on Secure and Trustworthy Machine Learning (SaTML). Munich, Germany: IEEE, 2026, also available as arX...

    2026 arXiv

  30. [38]

    Securing AI agents with information-flow control,

    M. Costa, B. K ¨opf, A. Kolluri, A. Paverd, M. Russinovich, A. Salem, S. Tople, L. Wutschitz, and S. Zanella-B ´eguelin, “Securing AI agents with information-flow control,” 2025, preprint. [Online]. Available: https://arxiv.org/abs/2505.23643

    2025 arXiv

  31. [39]

    Securing agents with tracked capabilities,

    M. Odersky, Y . Zhao, Y . Xu, O. Bra ˇcevac, and C. N. Pham, “Securing agents with tracked capabilities,” inProceedings of the ACM Conference on AI and Agentic Systems. New York, NY , USA: Association for Computing Machinery, 2026, pp. 812–838. [Online]. Available: https://doi...

    2026

  32. [40]

    AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,

    H. Wang, C. M. Poskitt, and J. Sun, “AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,” in2026 IEEE/ACM 48th International Conference on Software Engineering (ICSE). New York, NY , USA: Association for Computing Machinery, 2026, 12 pages. [Online]. ...

    2026

  33. [41]

    Towards verifiably safe tool use for LLM agents,

    A. Doshi, Y . Hong, C. Xu, E. Kang, A. Kapravelos, and C. K ¨astner, “Towards verifiably safe tool use for LLM agents,” inProceedings of the IEEE/ACM 48th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER). New York, NY , USA: Associat...

    2026

  34. [2024]

    Available: https://openreview.net/forum?id=GEcwtMk1uA

    [Online]. Available: https://openreview.net/forum?id=GEcwtMk1uA

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.