SecureClaw: Clawing Back Control of LLM Agents

Stefan Schmid; Yuhan Ma

REVIEW 2 major objections 2 minor 15 references

SecureClaw confines sensitive data at the read boundary and authorizes writes via preview-commit in LLM agents.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-27 16:23 UTC pith:WZ5EWQYL

load-bearing objection SecureClaw's dual-boundary design with handles and preview-commit is the main idea, but security rests on unhardened trusted components. the 2 major comments →

arxiv 2606.09549 v1 pith:WZ5EWQYL submitted 2026-06-08 cs.CR cs.AI

SecureClaw: Clawing Back Control of LLM Agents

Yuhan Ma , Stefan Schmid This is my paper

classification cs.CR cs.AI

keywords LLM agentstool usesecuritydata confinementauthorizationhandlespreview commitbenchmarks

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Tool-using LLM agents risk unauthorized external actions and leaking sensitive plaintext because the runtime can access raw values and trigger effects without oversight. Defenses that protect only the planner or only the action sink leave one vulnerability open. SecureClaw adds a trusted gateway that swaps sensitive reads for opaque handles and summaries, plus a PREVIEW to COMMIT protocol where a trusted executor alone can finalize changes. The agent can still plan using these safe references. In tests on three benchmarks, this setup keeps task utility while driving attack success rates to zero or very low, something no other tested defense achieves at once.

Core claim

SecureClaw is a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary. Sensitive reads pass through a trusted gateway that replaces raw values with opaque handles and, in the evaluated deployment, bounded summaries as an explicit declassification interface. Writes that change external state follow a PREVIEW→COMMIT protocol in which only a trusted executor may commit the exact canonical request authorized by policy. The runtime can still plan over summaries and symbolic references, but cannot directly dereference secrets or perform side effects.

What carries the argument

Trusted gateway for replacing raw values with opaque handles and bounded summaries, together with the PREVIEW→COMMIT protocol enforced by the trusted executor.

Load-bearing premise

The trusted gateway and executor components remain uncompromised and correctly implement the handle replacement and preview-commit logic.

What would settle it

Demonstrating a successful attack that extracts raw sensitive values through the runtime or forces an unauthorized commit despite the protocol would falsify the security guarantees.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

LLM agents retain the ability to plan and use tools over symbolic references without seeing plaintext secrets.
External state changes occur only after preview and explicit commit by the trusted component following policy.
Attack success rates drop to 0% on ASB, 0.64% on AgentDojo, and 3.23% leak on AgentLeak while task utility stays usable.
The approach secures both the confidentiality and authorization surfaces that single-boundary defenses miss.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Inserting such gateways into existing agent runtimes could secure them without retraining the underlying models.
Defining appropriate summary bounds for different data types would determine how much planning capability is preserved.
Similar handle mechanisms might apply to prevent leakage in multi-turn or multi-agent conversations.
Policy definition for what constitutes an authorized commit becomes a central design choice for deployment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

SecureClaw's dual-boundary design with handles and preview-commit is the main idea, but security rests on unhardened trusted components.

read the letter

The main thing here is a dual-boundary architecture for LLM agents. Reads go through a trusted gateway that swaps raw values for opaque handles (plus bounded summaries for declassification), and writes use a preview-then-commit step where only a trusted executor can finalize actions. The abstract reports that this keeps task utility while hitting 0% ASR on ASB, 0.64% on AgentDojo, and 3.23% leak on the attacked parity lane of AgentLeak.

The combination of read confinement and write authorization in one evaluated system is what stands out as new. Most prior defenses target one surface or the other. Running the comparison in a shared harness against other defenses is useful for seeing relative performance on both security and usability.

The soft spot is exactly what the stress-test note flags. The claims only hold if the gateway correctly performs handle replacement and the executor correctly enforces the commit policy. The abstract gives no description of hardening, verification, or isolation for those two components. A bypass or misconfiguration there collapses both the confidentiality and authorization properties. The headline numbers also come without threat model details, ablation data, or evaluation methodology, so it is hard to judge how sensitive the results are to setup choices.

This paper is aimed at researchers and engineers working on practical agent deployments. Anyone looking at concrete ways to limit both data exposure and unauthorized actions would find the architecture worth reading. It deserves a serious referee because the problem is real, the proposed fix is specific, and the benchmarks are standard in the area.

I would send it to peer review to get the full evaluation details and a closer look at the trusted-component assumptions.

Referee Report

2 major / 2 minor

Summary. SecureClaw proposes a dual-boundary architecture for LLM agents that confines plaintext at the read boundary (via a trusted gateway replacing raw values with opaque handles and bounded summaries) and enforces authorization at the write boundary (via a PREVIEW→COMMIT protocol executed only by a trusted executor). The runtime plans over summaries and symbolic references but cannot dereference secrets or perform side effects directly. Across AgentDojo, AgentLeak, and ASB benchmarks in a common harness, it is claimed to be the only evaluated defense that retains usable task utility while achieving 0% ASR on ASB, 0.64% ASR on AgentDojo, and 3.23% overall leak on AgentLeak's attacked parity lane.

Significance. If the empirical results hold under the stated deployment assumptions, the work is significant for simultaneously addressing both confidentiality and authorization surfaces that prior single-boundary defenses leave exposed. The common-harness comparison and explicit declassification interface via summaries are strengths that enable direct comparison of utility-security trade-offs.

major comments (2)

[Abstract] Abstract and threat-model discussion: the confidentiality and authorization guarantees rest entirely on the assumption that the trusted gateway correctly performs handle replacement and the trusted executor correctly enforces the PREVIEW→COMMIT policy; the manuscript does not describe additional hardening or a threat model for compromise/misconfiguration of these components, yet any bypass would collapse both properties and undermine the reported ASR numbers.
[Evaluation] Evaluation sections (AgentDojo, AgentLeak, ASB results): the central claim that SecureClaw is the only defense retaining utility at the reported ASR/leak rates depends on the precise implementation of the gateway and executor in the harness; without an ablation or explicit statement that these components were themselves hardened against the evaluated attacks, the 0%/0.64%/3.23% figures cannot be interpreted as robust to realistic deployment.

minor comments (2)

[Abstract] Abstract lacks any mention of the threat model, number of runs, or statistical significance of the ASR figures; adding one sentence on these would improve clarity without altering the technical contribution.
[Architecture] Notation for handles and the PREVIEW→COMMIT transition could be formalized with a short diagram or pseudocode to make the boundary separation easier to follow.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. Below we provide point-by-point responses to the major comments and outline the revisions we plan to make.

read point-by-point responses

Referee: [Abstract] Abstract and threat-model discussion: the confidentiality and authorization guarantees rest entirely on the assumption that the trusted gateway correctly performs handle replacement and the trusted executor correctly enforces the PREVIEW→COMMIT policy; the manuscript does not describe additional hardening or a threat model for compromise/misconfiguration of these components, yet any bypass would collapse both properties and undermine the reported ASR numbers.

Authors: The guarantees do rely on the trusted components remaining uncompromised. Our threat model treats the gateway and executor as the TCB and assumes they are correctly implemented and not subject to compromise. We will revise the manuscript to make this assumption explicit in the abstract and threat model discussion, including a note that bypass of these components would invalidate the security claims. We do not provide hardening mechanisms for the TCB as that falls outside the scope of the current threat model. revision: yes
Referee: [Evaluation] Evaluation sections (AgentDojo, AgentLeak, ASB results): the central claim that SecureClaw is the only defense retaining utility at the reported ASR/leak rates depends on the precise implementation of the gateway and executor in the harness; without an ablation or explicit statement that these components were themselves hardened against the evaluated attacks, the 0%/0.64%/3.23% figures cannot be interpreted as robust to realistic deployment.

Authors: In the common harness, the gateway and executor are implemented according to the SecureClaw specification and are not the target of the evaluated attacks, which focus on the agent planner and runtime. The results reflect performance under correct TCB implementation. We will add an explicit clarification in the evaluation sections stating this assumption. While we do not provide an ablation on TCB compromise (as it would require a different evaluation setup), we will acknowledge this as a boundary condition of the reported figures. revision: partial

Circularity Check

0 steps flagged

No circularity; performance claims are direct experimental measurements

full rationale

The paper presents a dual-boundary architecture (trusted gateway for handle replacement and trusted executor for PREVIEW→COMMIT) and reports measured attack success rates (0% ASR on ASB, 0.64% on AgentDojo, 3.23% leak on AgentLeak) from benchmark evaluations. No equations, fitted parameters, predictions derived from inputs, or self-citations appear as load-bearing elements in the derivation chain. The results are presented as outcomes of running the system on the benchmarks rather than reductions to prior self-work or definitional equivalences. The architecture's guarantees are stated to depend on correct implementation of the trusted components, but this is an explicit assumption, not a circular derivation.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Only the abstract is available; no free parameters, axioms, or invented entities can be extracted.

pith-pipeline@v0.9.1-grok · 5751 in / 1075 out tokens · 24759 ms · 2026-06-27T16:23:48.888139+00:00 · methodology

0 comments

read the original abstract

Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene. Existing defenses usually protect one boundary, either the planner/runtime or the action sink, and therefore do not by themselves secure both surfaces. We present SecureClaw, a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary. Sensitive reads pass through a trusted gateway that replaces raw values with opaque handles and, in the evaluated deployment, bounded summaries as an explicit declassification interface. Writes that change external state follow a PREVIEW$\rightarrow$COMMIT protocol in which only a trusted executor may commit the exact canonical request authorized by policy. The runtime can still plan over summaries and symbolic references, but cannot directly dereference secrets or perform side effects. Across AgentDojo, AgentLeak, and Agent Security Bench (ASB), SecureClaw is the only defense we evaluate in a common harness that simultaneously retains usable task utility and achieves 0\% attack success rate (ASR) on ASB, 0.64\% ASR on AgentDojo, and 3.23\% overall leak on AgentLeak's attacked parity lane, which measures final-output and internal-relay leakage.

Figures

Figures reproduced from arXiv: 2606.09549 by Stefan Schmid, Yuhan Ma.

discussion (0)

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages

[1]

RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage

URLhttps://arxiv.org/abs/2502.08966. A Extended Experimental Evidence This appendix substantiates the main empirical claims with exact counts, uncertainty bounds, bench- mark breakdowns, and robustness checks. We keep only evidence that directly supports the pa- per’s core effect/plaintext decomposition. The evidence is consistent across the different eva...

work page Pith review arXiv 2000
[2]

the authorization artifact carries a valid MAC under the policy-service authentication key
[3]

the artifact binds the tuple(a, p, h)
[4]

the recomputed digest equals the digest bound inside the artifact
[5]

timestamps fall inside the freshness window
[6]

the action identifier has not already been consumed by the replay guard
[7]

the reconstructed policy result isallow
[8]

if the action requires user confirmation, a confirmation token bound to(a, p, h)is present; and
[9]

Any failure is fail-closed

any required handle-resolution or sink-specific validation succeeds before the effectful sink is reached. Any failure is fail-closed. Appendix B.5 gives the optional distributed specialization that replacesπ with two separately authenticated shares for the same digest. Handles, dereference, and read interfaces.Sensitive values identified by the deployment...
[10]

unauthorized commits still require executor-side authorization and are covered by Theo- rem 1
[11]

internal channels such as C2 and C5 do not obtain newly dereferenced raw protected val- ues; any content-dependent information they may carry must already originate from the authorized summary interface; and
[12]

The next proposition isolates that point

the read interface itself rate-limits exposure to one bounded summary per authorized read. The next proposition isolates that point. Proposition 4(Three-layer composition for high-∆summary categories).LetCbe a summary category with∆(D(v 0), D(v1)) = 1. Under the assumptions of Theorems 1, 2, and 3, an adversary controlling the runtime remains subject to t...
[13]

no unauthorized side effect can commit
[14]

the internal relay channels C2 and C5 do not newly expose raw protected values beyond what was already released through the authorized bounded-summary interface; any resid- ual content-dependent signal must already have been released through that interface; and 24
[15]

disclosure through the read path is limited by the authorized, bounded summary interface itself. Therefore a high-∆summary category weakens the per-read confidentiality term of Theorem 3, but it does not reopen unauthorized commit or a fresh raw-plaintext relay from trusted storage into C2/C5. Proof.Item 1 follows directly from Theorem 1, whose premises a...

[1] [1]

RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage

URLhttps://arxiv.org/abs/2502.08966. A Extended Experimental Evidence This appendix substantiates the main empirical claims with exact counts, uncertainty bounds, bench- mark breakdowns, and robustness checks. We keep only evidence that directly supports the pa- per’s core effect/plaintext decomposition. The evidence is consistent across the different eva...

work page Pith review arXiv 2000

[2] [2]

the authorization artifact carries a valid MAC under the policy-service authentication key

[3] [3]

the artifact binds the tuple(a, p, h)

[4] [4]

the recomputed digest equals the digest bound inside the artifact

[5] [5]

timestamps fall inside the freshness window

[6] [6]

the action identifier has not already been consumed by the replay guard

[7] [7]

the reconstructed policy result isallow

[8] [8]

if the action requires user confirmation, a confirmation token bound to(a, p, h)is present; and

[9] [9]

Any failure is fail-closed

any required handle-resolution or sink-specific validation succeeds before the effectful sink is reached. Any failure is fail-closed. Appendix B.5 gives the optional distributed specialization that replacesπ with two separately authenticated shares for the same digest. Handles, dereference, and read interfaces.Sensitive values identified by the deployment...

[10] [10]

unauthorized commits still require executor-side authorization and are covered by Theo- rem 1

[11] [11]

internal channels such as C2 and C5 do not obtain newly dereferenced raw protected val- ues; any content-dependent information they may carry must already originate from the authorized summary interface; and

[12] [12]

The next proposition isolates that point

the read interface itself rate-limits exposure to one bounded summary per authorized read. The next proposition isolates that point. Proposition 4(Three-layer composition for high-∆summary categories).LetCbe a summary category with∆(D(v 0), D(v1)) = 1. Under the assumptions of Theorems 1, 2, and 3, an adversary controlling the runtime remains subject to t...

[13] [13]

no unauthorized side effect can commit

[14] [14]

the internal relay channels C2 and C5 do not newly expose raw protected values beyond what was already released through the authorized bounded-summary interface; any resid- ual content-dependent signal must already have been released through that interface; and 24

[15] [15]

disclosure through the read path is limited by the authorized, bounded summary interface itself. Therefore a high-∆summary category weakens the per-read confidentiality term of Theorem 3, but it does not reopen unauthorized commit or a fresh raw-plaintext relay from trusted storage into C2/C5. Proof.Item 1 follows directly from Theorem 1, whose premises a...