Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
APPA tries to keep an agent’s main context clean by sending risky data into a controlled branch first.
The paper argues that ordinary taint tracking can lock down an LLM agent too broadly once it reads unvetted material. Its framework checks permissions before acquisition, proposes remedies such as authorization or acceptance, and uses child trajectories so a sanitizer can return only a bounded derivative to the parent context. The authors claim formal guarantees for parent label preservation and merge confinement. In benchmark tests across four models, reported attack success fell from 31%-50% to 0%-7%, with branching recovering some utility lost under taint tracking alone. ArXiv · AI/CL/LG's note
The paper argues that ordinary taint tracking can lock down an LLM agent too broadly once it reads unvetted material. Its framework checks permissions before acquisition, proposes remedies such as authorization or acceptance, and uses child trajectories so a sanitizer can return only a bounded derivative to the parent context. The authors claim formal guarantees for parent label preservation and merge confinement. In benchmark tests across four models, reported attack success fell from 31%-50% to 0%-7%, with branching recovering some utility lost under taint tracking alone. ArXiv · AI/CL/LG's note
score 5