6arXiv cs.AI (Artificial Intelligence)·
APPA: Agentic Permissions Policy Algebra for taint confinement in LLM agents
Researchers introduce APPA (Agentic Permissions Policy Algebra), an Information Flow Control framework designed to prevent prompt injection and data exfiltration in autonomous LLM agents processing mixed-confidentiality data. The key innovation is engine-managed context branching: rather than permanently tainting an agent's context when it reads unvetted data, APPA spawns isolated child trajectories that absorb label descent locally, allowing a sanitizer to return a bounded derivative to the clean parent context. Evaluated on a multi-turn tool-chaining benchmark across four models, APPA reduces exfiltration attack success from 31–50% down to 0–7% while recovering substantial utility lost by naive taint tracking. The framework is grounded in a formal two-monoid model with proofs of parent label preservation and merge confinement.
Related guides (2)
Related events (8)
APPO: Fine-grained branching and credit assignment for agentic RL in LLMs
Researchers introduce Agentic Procedural Policy Optimization (APPO), a reinforcement learning method that shifts branching and credit assignment from coarse tool-call boundaries to fine-grained decision points within generated sequences. APPO uses a Branching Score combining token uncertainty with policy-induced likelihood gains to select exploration points, plus procedure-level advantage scaling for credit distribution. Evaluated on 13 benchmarks, APPO improves strong agentic RL baselines by nearly 4 points while maintaining efficient tool use and interpretability. The work addresses a known weakness in multi-turn agentic RL: that influential decisions are distributed throughout sequences, not concentrated at tool-call boundaries.
ANTAP: Geometry-based routing defense against malicious agents in multi-agent systems
Researchers introduce ANTAP (Automatic Non-Textual Agent Picker), a routing architecture for multi-agent LLM systems that replaces text-based agent self-descriptions with empirical capability testing and algebraic projection in a shared semantic space. The approach creates a 'linguistic firewall' that makes metadata-based injection attacks inexpressible at inference time. Against description-based injection attacks, ANTAP achieves near-zero attack success rate compared to 67.3%+ for baseline routers, and reduces embedding-based attack success by 20%.
Multi-agent mediation can reverse LLM safety refusals: compositional safety gap demonstrated with GPT-5.6
A new arXiv paper demonstrates that a high-capability LLM (GPT-5.6) can appear safer when exposed directly to a dangerous objective than when that objective is transformed and relayed through a multi-agent pipeline. In the tested setup, an 'Id' and 'Censor' agent rewrite a manipulative instruction before passing it to a 'Superego' user-facing agent, which then produces advice aligned with the manipulative target despite never seeing the raw objective or its provenance. The authors identify this as a compositional safety gap: multi-stage automated workflows can launder dangerous instructions past safety mechanisms by keeping raw instructions outside the downstream model's context window. The finding has direct implications for agentic deployment architectures where end users and safety evaluators only have endpoint-level visibility.
Dynamic capability scoping for enterprise AI agents: synthetic dataset and three-source permission architecture
A new arXiv preprint proposes a dynamic least-privilege architecture for enterprise AI agents, replacing static credential sets with a three-source system combining role-based ceilings, task-context classifiers, and policy-derived combination prohibitions. The authors release a synthetic dataset of 600 enterprise task prompts labeled with minimum required permissions across a 15-permission taxonomy, validated with high inter-rater agreement (Cohen's κ = 0.967 post-review). The architecture supports both enforced and observe-only deployment modes, with the latter generating behavioral signals for misalignment research. The work addresses the over-privilege problem in agentic deployments, where persistent broad credentials expand attack surface regardless of model reasoning quality.
LCGuard: Adversarial Training Framework for Safe KV Cache Sharing in Multi-Agent LLM Systems
LCGuard introduces a framework for preventing sensitive information leakage when multi-agent LLM systems share KV caches as a latent communication channel. The approach formalizes leakage operationally via reconstruction: a shared cache artifact is deemed unsafe if an adversarial decoder can recover sensitive inputs from it. An adversarial training loop pits a reconstructor against LCGuard's representation-level transformations, which aim to preserve task-relevant semantics while suppressing recoverable sensitive content. Empirical results across multiple model families and multi-agent benchmarks show reduced reconstruction-based leakage and attack success rates with competitive task performance.
Multi-agent semantic rewriting framework for privacy-preserving RAG
A new arXiv preprint proposes a three-agent framework for sanitizing retrieved content in RAG pipelines by performing privacy extraction, semantic analysis, and reconstruction as an offline preprocessing step. Evaluated on ChatDoctor and Wiki-PII datasets across six LLMs, the approach reduces targeted information exposure in LLaMA-3-8B from 144 baseline instances to 1, while maintaining contextual fidelity (BLEU-1 of 0.122 vs. SAGE's 0.117). The framework introduces no additional online inference latency since rewriting is done offline. Source code is publicly released.
Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools
This paper identifies a privacy vulnerability in tool-augmented language agents that speculatively issue future tool calls to reduce latency: these 'ghost tool calls' leak inferred user intent to external services before the agent commits to a branch, and cannot be unsent after the fact. The authors argue that timing—not authorization—is the core issue, and propose Speculative Tool Privacy Contracts, a runtime abstraction treating pre-commitment observation as a distinct first-class effect. A prototype runtime is implemented and twelve policies are evaluated across three corpora, finding that only issue-time argument or destination suppression/modification actually reduces inference leakage.
AprielGuard: A Guardrail for Safety and Adversarial Robustness in Modern LLM Systems
ServiceNow AI has released AprielGuard, a guardrail system designed to improve safety and adversarial robustness in LLM deployments. The system targets prompt injection, jailbreaks, and other adversarial inputs that bypass standard safety measures. It is presented as a component for enterprise LLM pipelines seeking more robust content moderation and safety filtering.