Source-linked AI summary
ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
Yusheng Zheng, Yiwei Yang, Wei Zhang, Andi Quinn
TL;DR
Checkpoint-restore is unsafe for LLM agents because regenerated tool calls can bypass protections that assume identical retries, causing duplicate or unauthorized irreversible actions. The paper identifies and experimentally validates Action Replay and Authority Resurrection, then proposes ACRFence, which logs tool effects and enforces replay-or-fork semantics at restoration. ACRFence is framework-agnostic and uses semantic comparison to distinguish equivalent retries from legitimate divergent exploration.
Problem
Checkpoint-restore saves local state but cannot undo external effects, while LLM agents regenerate different requests that servers accept as new actions.
Method
ACRFence records irreversible tool effects at the tool boundary and uses an analyzer LLM to classify post-restore calls as semantic replays or forks.
Results
The paper identifies and experimentally validates Action Replay and Authority Resurrection, including duplicate commits and successful stateless token reuse after restore.
Takeaways & Limitations
Safe checkpoint-restore requires replay-or-fork enforcement that accounts for semantic divergence rather than relying on identical regenerated requests.
Takeaways & Limitations
The evaluation uses Claude Code’s built-in checkpoint-restore rather than OS-level mechanisms such as CRIU.
Abstract
from arXiv · showhide
LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects; we term these semantic rollback attacks. We identify two attack classes, Action Replay and Authority Resurrection, validate them in a proof of concept experiment, and confirm that the problem has been independently acknowledged by framework maintainers. We propose ACRFence, a framework-agnostic mitigation that records irreversible tool effects and enforces replay-or-fork semantics upon restoration
1 Background and Motivation
Checkpoint-restore creates a security gap because LLM agents regenerate different tool requests after external side effects, allowing retries to be accepted as new actions. The paper identifies semantic rollback attacks and documents their prevalence across agent frameworks.
- Motivating example: A restored payment with a new reference ID can be processed twice, giving Bob $1000 instead of the requested $500.Each transaction appears legitimate because the bank records distinct reference IDs.
- Root cause: Checkpoint-restore cannot undo external effects, while LLM agents regenerate different requests that bypass protections assuming identical retries.Even at temperature=0, GPU floating-point variation can change token sequences and tool requests.
- Real-world evidence: A survey of 12 major agent frameworks found pervasive tool-call side-effect issues and no framework enforcing exactly-once semantics at the tool boundary.Reported examples include duplicate execution after checkpoint resume, documented rewind limitations, and webhook replay vulnerabilities.
2 Threat Model
The threat model requires preventing irreversible-effect replay and keeping consumed credentials consumed after restore. It covers both attacker-triggered crashes and intentional rollback abuse by insiders.
- Security invariants: ACRFence targets two invariants: irreversible effects must not replay across restores, and consumed credentials must remain consumed.The model distinguishes crash-induced restore from deliberate rollback abuse.
- Attacker models: Crash-Induced Restore lets an external attacker trigger a crash after an irreversible action, causing re-execution with different parameters.The scenario is analogous to crash-recovery exploits in distributed systems.
- Attacker models: Deliberate Rollback Abuse lets an insider rewind to an earlier checkpoint and redirect the agent using previously obtained credentials.This parallels restart attacks against trusted execution environments.
3 Attacks and Experimental Validation
The experiments validate two attack classes—Action Replay and Authority Resurrection—using checkpointed agent interactions with simulated bank, cloud, and authorization services. Restore causes duplicate payments and enables reuse of stateless single-use tokens.
- Experimental setup: The testbed used Claude Code CLI with Qwen3-32B, simulated MCP bank, cloud, and approval services, and checkpoints before irreversible actions.This setup tests both duplicate commits and authorization-token reuse.
- Action Replay: Action Replay re-issues a successful payment with a fresh reference ID, can chain across crash-restore cycles, and is difficult to audit.Each duplicate transaction appears legitimate in isolation.
- Action Replay: 100% of checkpoint-restore trials produced duplicate payment commits, compared with 0/10 for the no-checkpoint baseline.The result attributes the vulnerability to restore rather than general LLM behavior.
4 Mitigation: ACRFence
ACRFence interposes at the tool boundary, logs irreversible effects, and compares post-restore calls semantically. It replays equivalent calls without execution and supports divergent calls through fork semantics without framework modifications.
- Effect logging: ACRFence records each irreversible tool effect with thread, branch, tool, argument, and environment context at the tool boundary.eBPF-based system monitors capture context without requiring agent framework changes.
- Semantic comparison: A restore-path analyzer LLM separates changing fields such as request IDs from intent-bearing fields such as amount and recipient.The analyzer adapts to new tools without manual schema configuration.
- Replay semantics: Semantically equivalent post-restore calls receive the recorded response instead of re-executing the irreversible action.This implements replay semantics at the tool boundary.
5 Related Work
Prior reliability, rollback, and security mechanisms address related problems but generally assume deterministic caller behavior. The paper identifies nondeterministic post-restore LLM re-synthesis as an unaddressed security attack surface.
- Existing I/O tabling, durable execution, duplicate detection, and TEE rollback protection assume deterministic programs or callers.
- Agent record-and-replay improves reliability, but does not address irreversible external effects after checkpoint restoration.
- No prior work treats nondeterministic LLM re-synthesis after restore as a security attack surface.
6 Discussion and Conclusion
The experiments show that restored LLM agents can generate different tool calls, bypassing duplicate detection. ACRFence proposes semantic comparison with replay-or-fork enforcement, while its implementation and analyzer reliability remain future work.
- LLM agents inevitably produce different tool calls after restore, silently bypassing duplicate-detection mechanisms.
- ACRFence uses a lightweight analyzer LLM at the tool boundary to enforce replay-versus-fork semantics for irreversible calls.
- The evaluation validates the attacks but does not implement ACRFence, and analyzer misclassification and adversarial evasion remain open failure modes.
- Future work includes broader model and scale coverage plus measuring analyzer accuracy and overhead.
AI Use Statement
The authors used Claude for manuscript text polishing and iterative editing, while conducting the technical work themselves.
- Claude was used for text polishing and iterative manuscript editing.
- The authors conducted the technical content, experimental design, and analysis.
- The statement distinguishes AI-assisted editing from the authors’ technical contributions.