Policy-Backed Selective Regeneration under Tainted Inter-Agent Communication

Introduction

• Inter-agent messages can combine useful task information with instructions unauthorized by the original request, creating a security problem for collaborative agents.Downstream agents may need evidence that they cannot directly observe themselves.Source: Introduction · p. 1
• Polluted-context retry may preserve the state that induced a violation, while dropping the entire message can discard information required by downstream agents.Recovery must remove unauthorized influence while retaining independently supported task information.Source: Introduction · p. 1
• ESC-CR builds an executable commitment from the trusted task, platform evidence, and policy, then checks candidate effects at an external release boundary.Intermediate messages can supply implementation-relevant claims but cannot independently authorize new effects.Source: Introduction · p. 1
• After a violation, ESC-CR taints the responsible message and rejected program, verifies candidate claims against trusted evidence, reconstructs context, and regenerates under the same policy.Explicitly recorded artifacts derived from the tainted inputs are also marked tainted.Source: Introduction · pp. 1–2
• ESC-CR preserves evidence-backed claims while enforcing the same release policy before and after recovery across standard and communication-essential code-generation tasks.The evaluation spans multiple model families, communication topologies, and adaptive attacks, with unauthorized effects assessed by an independent oracle under matched computational budgets.Source: Introduction · p. 2

Agent attacks, evaluation, and diagnosis

• Prior agent-security work evaluates tool-using and multi-agent risks, while auditing and fuzzing methods test and localize unsafe behavior.ESC-CR focuses on authorization enforcement and task-preserving recovery after a tainted message has influenced code generation.Source: Related Work · p. 2

Prompt-level and contextual defenses

• Prompt-level and contextual defenses filter injection or guide instruction handling, while some approaches check task alignment or verify tool-stream actions.ESC-CR additionally excludes tainted messages and rejected artifacts before evidence-backed regeneration.Source: Related Work · p. 2

Architectural and policy enforcement

• Architectural and policy approaches constrain dependencies, information flow, capabilities, or runtime privileges; ESC-CR complements them with task-scoped commitments and clean-room recovery.Its recovery aims to preserve evidence-backed task information while preventing rejected state from re-entering generation.Source: Related Work · p. 2

Problem Setting and Threat Model

• The trusted task, platform evidence, and local policy determine authorized effects, and an external boundary checks generated programs before release.The system includes upstream agents that send messages to a downstream coder.Source: Problem Setting and Threat Model · p. 2
• The attacker may modify an intermediate message to retain useful task information while inducing unauthorized effects, but cannot modify the trusted task, evidence, policy, or release boundary.Attacks may be direct, obfuscated, indirect, or verifier-aware, and may adapt to prior accept–reject outcomes.Source: Problem Setting and Threat Model · p. 2
• Communication-essential tasks require upstream information such as an interface specification or resource identifier, represented in trusted evidence so supported claims can be reconstructed without the original message.An attacker may combine this information with an unauthorized instruction in the same message.Source: Problem Setting and Threat Model · pp. 2–3
• Figure 1 maps matched-budget repair, communication-essential tasks, and end-to-end agent trajectories to the framework’s evaluation.Its caption describes trusted evidence verifying retained claims, the release boundary checking effects, and violations triggering clean-room recovery.Source: Figure 1 · p. 3
• A released program must satisfy the functional task and stay within authorized effects; after rejection, recovery must not reuse tainted messages, rejected programs, or their derived artifacts.Rejecting every candidate is safe but not useful, so the objective also includes retaining supported information and functional success.Source: Problem Setting and Threat Model · p. 3
• Code-release metrics use release, functional-correctness, and unauthorized-effect indicators; AgentDojo instead uses its benchmark-native oracles.The evaluation compares methods within each benchmark rather than treating ASR values from different benchmarks as interchangeable.Source: Problem Setting and Threat Model · p. 3

Overview

• Messages may inform generation but cannot change the commitment or authorize effects; candidate programs are checked at an external release boundary.The commitment records task requirements, authorized effects, denials, and scope; implementation checks claims against platform evidence and rejects unresolved effects.Source: Overview · pp. 3–4

Executable Semantic Commitments

• The commitment is built from the trusted task, platform evidence, and policy without using the inter-agent message.It encodes functional requirements, authorized effects, explicit denials, and task/resource scope; effects outside that scope are not authorized.Source: Executable Semantic Commitments · p. 4

Evidence-Backed Claim Reconstruction

• ESC-CR retains message claims only when trusted evidence supports them and they are compatible with the commitment.Canonical evidence values or authorized aliases may verify claims; partial, conflicting, ambiguous, or unsupported claims fail closed, and the clean representation excludes original wording and unsupported instructions.Source: Evidence-Backed Claim Reconstruction · p. 4

Effect-Aware Release Boundary

• The release boundary accepts a candidate only when it meets functional requirements and its extracted effects are authorized.Unresolved behavior is mapped to an unknown effect that is not authorized; the boundary operates outside the language models.Source: Effect-Aware Release Boundary · p. 4

Taint-Aware Clean-Room Recovery

• After rejection, ESC-CR taints the responsible messages, rejected program, and recorded derived artifacts, then rebuilds context from an allowlist.The reconstructed context uses the trusted task, commitment, verified claims, and structured rejection metadata, excluding tainted state; regeneration is checked again and is bounded by K attempts.Source: Taint-Aware Clean-Room Recovery · pp. 4–5

Release and Recovery Procedure

• The procedure constructs the commitment independently, checks candidate correctness and effects, and releases only candidates that pass the boundary.On rejection it records a category, propagates taint, verifies claims against evidence, reconstructs clean context, and regenerates; it returns BLOCK if no candidate passes within K attempts.Source: Release and Recovery Procedure · p. 5

Experiments and Analysis

• The evaluation covers HumanEval, MBPP, communication-essential tasks, indirect effects, and AgentDojo under matched computational budgets, using multiple models, topologies, and adaptive attacks.The code-repair protocol compares polluted-context retry, message dropping, clean-task retry, and ESC-CR.Source: Experiments and Analysis · p. 5

RQ1: Equal-Budget Recovery

• On standard code tasks, polluted-context retry is consistently weak; clean-task retry slightly exceeds ESC-CR for the two Qwen models, while ESC-CR is strongest in the listed Mistral cells.The table compares secure task success under a maximum of two generations.Source: RQ1: Equal-Budget Recovery · p. 6, Table 1 · p. 6

RQ2: Communication-Essential Retention

• On communication-essential tasks, ESC-CR exceeds complete message dropping in every model–topology cell while recording zero observed code ASR.Each cell contains 200 attacked trials; the advantage is bounded to the benchmark’s trusted-evidence construction, not arbitrary message content.Source: RQ2: Communication-Essential Retention · p. 6, Table 2 · p. 6, Figure 2 · p. 6

RQ3: Effect Coverage and Adaptive Attacks

• Across 5,000 indirect-effect attacks, EffectIR detects every attack without flagging paired benign programs, while lexical matching detects 40 attacks and produces four benign detections.The held-out adaptive suite spans alias imports, direct effects, encoded strings, reflection and runtime strings, and wrapper indirection; both guard-only enforcement and ESC-CR record zero aggregate code ASR.Source: RQ3: Effect Coverage and Adaptive… · pp. 6–7, Table 3 · p. 7

RQ4: End-to-End AgentDojo Evaluation

• ESC-CR records 1,607/2,240 attacked-trajectory secure successes and no benchmark attack-success event, while retaining 1,640/2,240 attacked-task utility and 88/120 benign secure successes.The evaluation uses AgentDojo’s benchmark-native oracles.Source: RQ4: End-to-End AgentDojo Evaluation · p. 7, Table 4 · p. 7

Interpretation and Scope

• Recovery utility depends on model and task: clean-task retry can outperform ESC-CR on standard code tasks, so ESC-CR does not uniformly maximize raw code-task utility.Its value is an authorization-preserving recovery path under the same generation budget.Source: Interpretation and Scope · p. 7
• Chain and quorum alter retry outcomes, but the decisive security condition remains the release-time commitment check; the AgentDojo results show the same distinction in trajectories.The EffectIR results support the evaluated effect vocabulary, not exhaustive extraction of arbitrary language-level effects.Source: Interpretation and Scope · p. 7
• When planner information is task-essential, ESC-CR improves over message dropping in every reported cell, with the strongest reported result for Qwen3.5-9B chain at 63.00% versus 18.50%.This conclusion is limited to the local trusted-evidence construction used by the benchmark.Source: Interpretation and Scope · p. 7

• ESC-CR preserved verified claims while suppressing unauthorized releases across evaluated code and agent settings under matched generation budgets.Source: Conclusion · p. 7
• Polluted-context retry remained ineffective, while complete message removal lost information required by communication-essential tasks.Source: Conclusion · p. 7
• ESC-CR separates information from authority, enforces task-scoped effects externally, and reconstructs evidence-backed context without reusing tainted state.Source: Conclusion · p. 7