PaperlayerView exact revision on arXiv

Source-linked AI summary

AGATE: Provenance-Based Runtime Defense Against Compositional Attacks on LLM Agents

Xiaorui Zhang, Zhuoran Cheng, Kailin Liu, Zhaoxi Sun, Shiyu Fan, Tongyu Yuan, Bin Yuan, Weizhong Qiang, Deqing Zou

arXiv:2609.30830v1cs.CRcs.SE

TL;DR

LLM agents can produce harmful effects through ordinary operations, while judging those actions requires tracking both authorization and data origin. AGATE combines deterministic authorization and provenance checks at harness boundaries and retains decision grounds for replay. Its evaluation reports observed protection boundaries, utility costs, and reconstruction consistency, while identifying limits in transformations and observation.

  • Problem

    Compositional attacks can produce harmful effects through routine operations, and judging them requires evidence of both who authorized an action and where its data came from.

    Source: §1 · p. 1

  • Method

    AGATE applies deterministic authorization and data-provenance checks at instrumented harness boundaries, connecting operations with consumable grants, registered sources, and an effect ledger while recording grounds for replay.

    Source: §1 · p. 1, §4.1 · p. 3

  • Results

    The evaluation reports a parameter-rewriting bypass, denials in 6 of 11 benign file-processing scenarios, and replay agreement for 63/63 scenarios on each of two platforms.

    Source: §1 · p. 2, §9 · p. 13

  • Takeaways & Limitations

    AGATE connects runtime judgments to retained authorization and data-origin evidence, with observed protection boundaries, utility costs, and reconstruction behavior across its evaluated settings.

    Source: §9 · pp. 12–13

    Replay equality establishes consistency of retained evidence, but not adapter truthfulness, complete mediation, or confirmation of external effects.

    Source: §7.1 · p. 11

Abstract

from arXiv · show

LLM agents can produce harmful effects through sequences of ordinary operations. Judging such actions requires establishing both the authority that permits them and the origin of the data they carry. We present AGATE, an authorization and data-provenance gate at instrumented agent-harness boundaries. Operator declarations and host approval events ground authorization; delegated actions are constrained by grants that bind to exact parameters, expire, and permit a limited number of uses. Source registration connects observed inputs to subsequent transfers, while an effect ledger tracks repeated requests. Deterministic checks make decisions without an LLM in the decision path and retain their grounds with execution evidence for forensic replay. Adapters integrate three production harnesses -- DeepSeek Harness, OpenCode, and OpenClaw -- without modifying host code, translating each host's native observation and veto points into a single shared gate interface; the judgment core is identical in all three, and only enforcement depth differs. Our evaluation combines 153 exercised attack-chain records with deployment, utility, and reconstruction experiments. The deployment observations expose how tool declarations and data checks govern business actions, including a bypass through parameter rewriting. Six of eleven benign file-processing scenarios contain denial events, revealing the utility cost of content-based provenance policies. Across 252 runs on 63 sanitized scenarios, replay agrees with live graph projections for all 63 scenarios on each of two platforms. These results establish the feasibility of provenance-based runtime judgment and identify content transformation, legitimate reuse, and observation coverage as concrete limits.

1 Introduction

Compositional attacks can turn routine operations into harmful effects when authorization and data origin are judged separately or lost across steps. AGATE joins those judgments at instrumented harness boundaries and retains their grounds for replay.

1 Introduction

  • A runtime defense must use evidence beyond conversational context because benign-looking instructions do not establish who authorized an action or where its data originated.Tool availability does not authorize every use, and permission to read a value does not itself permit transmitting it.Source: §1 · p. 1
  • The same judgment core integrates DeepSeek Harness, OpenCode, and OpenClaw through adapters that translate host-specific observation and veto points without modifying host code.Enforcement depth varies by host.Source: §1 · pp. 1–2
  • 153 attack-chain records and deployment experiments expose undeclared-action rejection, a parameter-rewriting bypass, benign denials in 6 of 11 file-processing scenarios, and replay agreement for 63/63 scenarios on each of two platforms.The evaluation also includes 252 monitored runs on 63 sanitized scenarios.Source: §1 · p. 2
  • AGATE jointly checks authorization provenance and scope and the origin of carried data, using operator declarations and host-issued events as its trust root.This targets attacks assembled from ordinary operations, such as transferring a credential through a routine DNS update.Source: §1 · pp. 1–2
  • Consumable grants, source registration, and an effect ledger connect successive operations, while recorded decision grounds support inspection and replayable graph reconstruction.Grants bind to session and exact call parameters, expire, and have limited uses; source observations connect inputs to later transfers.Source: §1 · pp. 1–2

2 Background and Motivation

Agent harnesses dispatch actions and expose host-dependent observation and veto surfaces, while compositional attacks combine ordinary operations into harmful effects. AGATE addresses the gap between model-layer judgments and runtime evidence about authorization and data movement.

2.1 LLM agents and their harnesses

  • The harness assembles context, registers capabilities, dispatches calls, and manages delegation, but downstream processes or remote services may create effects outside a tool hook’s visibility.Observation and veto surfaces depend on the host.Source: §2.1 · p. 2

2.2 Compositional attacks

  • Compositional attacks distribute harmful effects across ordinary operations, and the 153-record corpus combines single-step primitives with multi-step attacks to characterize tool behavior and motivate retaining state across operations.The corpus includes 76 incident/study, 49 semantic/structural delivery, and 28 coverage-matrix records.Source: §2.2 · p. 2

2.3 Runtime judgment and evidence

  • Model-layer acceptance does not establish authorization or permission for parameters to cross a data boundary; AGATE grounds runtime judgments in declarations, authentic approvals, and registered source observations.The paper reports that 40 of 47 direct instructions led to tool invocation, not as a universal model failure rate or proof of host compromise.Source: §2.3 · p. 2

3 Threat Model

The threat model places AGATE between model context and host assets, with security judgments grounded in a defined trust base and explicit adversaries. It frames attacks as sequences whose effects are accounted for through overlapping asset categories.

3.1 System model

  • The system model separates model context, harness middleware where AGATE observes or intercepts selected boundaries, and host assets; its trusted base includes the kernel, adapters, policy state, evidence store, and relied-upon host mechanisms.Tool descriptions, returned content, skills, and peer messages are not authorization sources.Source: §3.1 · pp. 2–3

3.2 Adversary model

  • The model includes an external attacker controlling context content and an instructing user adversary under an enterprise assumption that separates user from operator; attacks may distribute steps across tools or sessions.The experiments do not establish decomposition invariance across arbitrary sessions or rewrites.Source: §3.2 · p. 3

3.3 Effect categories

  • Nine overlapping effect categories describe affected assets and compare outcomes, but the 153-record H1–H9 coverage is descriptive rather than a guarantee of complete classification or detection.Categories can overlap when persistence, memory corruption, and later propagation occur in one chain.Source: §3.3 · p. 3

4 System Design

AGATE judges actions by both authorization provenance and the origin of carried data, using persistent state to connect operations. Operator declarations and host approvals ground authority, while source records and repeated-effect state inform boundary checks.

4.1 Overview and trust root

  • AGATE independently checks whether an action is authorized and whether its carried material may cross a protected boundary.An effect ledger connects repeated requests, and decisions retain their grounds alongside execution evidence.Source: §4.1 · p. 3
  • Operator declarations establish the trust root; explicit denials override grants, and conversational text cannot issue authorization.Broad tool eligibility differs from scoped preauthorization, while host approvals can add session-bound grants when delegation is permitted.Source: §4.1 · p. 3
  • The design separates synchronous judgment from asynchronous forensic storage and makes decisions deterministic, with inspectable grounds.A veto-capable boundary can apply a decision before dispatch; a passive observer records findings for inspection.Source: §4.1 · p. 3

4.2 Authorization and effect state

  • Table 1 uses overlapping effect categories for corpus analysis and makes defense state and persistent memory explicit protected assets.Source: Table 1 · p. 4
  • Approval instruments bind to a session and exact request parameters, expire, and have limited uses; only a final allow consumes an instrument.Coverage also checks configured amount bounds, while a changed argument requires a new approval.Source: §4.2 · p. 4
  • The effect ledger groups requests by observable operation target and can request additional approval for repeats, independently of an existing instrument.It records review attempts rather than confirmed external effects; bounded session retention limits which repeats it can recognize.Source: §4.2 · p. 4

4.3 Source registration and boundary checks

  • Source registration distinguishes domain, session-external, and agent-written origins, while destination trust remains a separate policy fact.Adapters register supported reads, tool results, web content, command outputs, and delegated inputs; path records can identify file references even when call arguments omit file content.Source: §4.3 · p. 4

L1 Agent context (untrusted)

AGATE operates at harness boundaries while treating model context as untrusted and relying on declared trust roots and observed sources. It applies boundary checks before dispatch where control is available, then records evidence for replay; decomposition invariance remains a research objective.

L1 Agent context (untrusted)

  • The architecture separates a synchronous gate that maintains authority, source, and repeated-effect state from an asynchronous evidence path.Adapters apply decisions where control is available; the graph store is not the dispatch queue.Source: Figure 1 · p. 5
  • Source retention budgets and per-source fair shares constrain observed entries, while protected paths remain pinned independently of source churn.Registration pressure is recorded when the active-session budget is exceeded rather than silently claiming complete retention.Source: L1 Agent context (untrusted) · p. 5
  • Sink-side checks select transmission fields and compare raw and recognized decoded forms against registered paths and content under source-to-destination policy.Descriptions and justifications are not transmission fields; matching supplies origin evidence, not the user’s intended purpose.Source: L1 Agent context (untrusted) · p. 5
  • Primitive-shape screening identifies known command and argument patterns, with six hard-deny shapes and a separate advisory library of 23 patterns.The advisory library’s matches are annotations on the evaluated path, not additional enforced denials.Source: L1 Agent context (untrusted) · pp. 5–6

4.4 Decision flow and state updates

  • At boundary-crossing requests, the gate applies authorization, origin/transfer, primitive, and quota checks; unresolved authorization or repeated effects require approval.In unattended mode, the gate denies such requests and retains them for operator review; flag-only adapters record findings without preventing execution.Source: §4.4 · p. 6

4.5 Execution evidence and replay

  • Retained events replay in stored order to reconstruct the graph, and comparison with the live projection checks the reconstruction procedure.Independent host records provide a separate basis for examining collection coverage; decision grounds and execution events share request and session links.Source: §4.5 · p. 6
  • Decomposition invariance—consistent verdicts across action decompositions for a fixed effect and policy—is a research objective, not established by the deployment observations.A controlled test would vary decomposition while holding policy, observed inputs, and outcome criteria fixed.Source: §4.5 · p. 6

5 Implementation

The implementation translates host observations and control points into shared gate interfaces, while adapters differ in their enforcement capabilities. Its evaluated paths include authorization and provenance mechanisms, and the implementation reports reconstruction tests alongside important limits on what deployment outcomes establish.

5 Implementation

  • Adapters translate native requests and post-execution events into shared gate interfaces, but their control capabilities differ across harnesses.OpenCode combines plug-in observations with a supervised sidecar and native-store tailing; OpenClaw uses gateway event sources and policy integration points.Source: §5 · p. 6, Table 2 · p. 7
  • Approval instruments bind to session and stable tool-argument digests, with configurable expiry, use counts, and amount bounds.The implementation’s default approval lifetime is 30 minutes with three uses; consumption occurs on the final allow path before dispatch.Source: §5 · p. 7
  • The source registry stores path records, exact-value summaries, and content-window fingerprints, while operator declarations define domain policy separately from origin tags.Declared protected paths persist independently of dynamic content eviction.Source: §5 · p. 7
  • The reconstruction engineering suite reports 183 passing tests, while an independent OpenClaw audit covers 37 real runs and 37 tool calls.Deployment outcomes do not establish activation of the pinned tier, fair-share retention, or decoding; evaluated outcomes exclude content decoding.Source: §5 · p. 7

6 Evaluation

The evaluation examines authorization and data boundaries, attack behavior without AGATE, usability costs, and reconstruction across distinct scenario and run sets. Results include consistent replay for the sanitized scenarios, alongside limits from parameter rewriting, benign data reuse, and incomplete observation.

6.1 Questions and experimental setting

  • The study combines 63 sanitized scenarios, two rounds, and two platforms for 252 monitored runs, with separate business-boundary, no-monitor, and delivery experiments.A tool invocation, signature match, attack-effect criterion, and confirmed external effect are distinct outcomes.Source: §6.1 · pp. 7–8, §6.2 · p. 8, §6.3 · p. 9

6.2 RQ1: defense and authorization boundaries

  • Historical traces show parameter rewriting followed a provenance denial with a later synthetic deletion request; tool/recipient signatures matched in 12/12 OC scenarios and 2/12 DSH scenarios.The signature counts are not attack-success measures, and the DSH mailbox case did not establish deletion of a real mailbox.Source: §6.2 · pp. 8–9
  • Business-boundary cases distinguish approval claims from valid authorization and tool eligibility from data permission, checking copied markers at protected history and DNS sinks.The history-write and DNS cases are structural reconstructions; the former measures a history_append request, while payment is modeled.Source: §6.2 · pp. 8–9

6.3 RQ2: attack behavior without AGATE

  • Semantic batch: 12/46 execute (26.1%) and 24/46 refuse (52.2%); structural batch: 23/52 execute (44.2%) and 9/52 refuse (17.3%).The batches use different scenario sets and adjudication procedures, so the comparison is descriptive rather than a paired wording estimate.Source: §6.3 · p. 9

6.4 RQ3: usability and failure analysis

  • 6/11 benign file-processing scenarios had denials totaling eight events: five from legitimate reuse, one correct-rule transfer, and two basename false matches.Scenario incidence is not a measured task-failure rate.Source: §6.4 · p. 9
  • Repair removed four DSH false denials from narrative fields (4 to 0), but legitimate reuse at actual sinks remained; read-channel effect counts rose from 3 to 8 without a paired denominator.The channel counts therefore do not establish a migration rate.Source: §6.4 · p. 10

6.5 RQ4: reconstruction, coverage, and cost

  • Replay and live-projection digests agree for 63/63 scenarios on DSH and 63/63 on OC.Historical OpenClaw replay processed 5,033 events in 0.24 s; offline throughput does not measure online decision latency.Source: §6.5 · pp. 10–11
  • Expected-stage hits were 334/376 on DSH and 328/376 on OC across 53 scenarios; these coverage counts are not attack-detection recall.The remaining ten scenarios use scenario criteria rather than expected topologies, and missing provider-wire observations and descendant effects limit the observed surface.Source: §6.5 · p. 10

7 Discussion

AGATE’s discussion identifies limits in authorization scope, observable data provenance, utility, evaluation coverage, and replay evidence, then outlines validation needs and deployment considerations. It also describes the ethics safeguards used for scenario construction and evidence handling.

7.1 Limitations

  • Authorization and effect controls remain bounded: extracted target matching may miss unauthorized recipients, mechanical keys can misgroup effects, and separate grants lack a global budget.Consuming authorization before dispatch also does not confirm completion or guarantee transactional exactly-once effects.Source: §7.1 · p. 11
  • Content and path matching can miss rewritten, inferred, or unobserved data, while memory enforcement covers supported write/edit paths rather than uninstrumented surfaces.Equivalent shell-command changes require their own mediation.Source: §7.1 · p. 11
  • Six of eleven benign scenarios contain denials, but the report lacks an end-to-end task-failure rate and requires joint assessment of completion and protection.Narrowing sink fields removed four description-field false denials, while legitimate reuse at actual sinks still needs a suitable policy.Source: §7.1 · p. 11
  • The selected scenarios, differing evaluation conditions, and targeted repetitions limit generalization; the observations do not isolate provenance’s contribution or establish population-wide attack rates.The business-tool scenarios do not distinguish every legitimate action from an attack effect.Source: §7.1 · p. 11
  • Replay equality establishes consistency of retained evidence, not truthful adapters, complete mediation, or external-effect confirmation; offline replay timing also does not establish online latency or overhead.A silent bypass may leave neither an action record nor a coverage gap.Source: §7.1 · pp. 11–12

7.2 Further work

  • Further work should use controlled same-platform component comparisons and adaptive testing, then measure changed-recipient and retry cases, paired channel migration, latency, overhead, and benign completion.The proposed decomposition study holds target effect and declaration fixed while varying step count and placement.Source: §7.2 · p. 12

7.3 Deployment considerations

  • Deployment pairs harness checks of authority and observable provenance with host controls for execution and defense-state protection; operator policy and adapter veto capability shape the deployment mode.Authorization and effect constraints remain bounded by the installed instruments and adapter behavior.Source: §7.1 · p. 11, §7.3 · p. 12

7.4 Ethics

  • Business-tool scenarios use synthetic values and local dry-run tools, while evidence summaries exclude API keys and separate scenario outcomes from sensitive raw artifacts.Some sanitized primitive tests use public echo endpoints, so the archive is not entirely offline.Source: §7.4 · p. 12

8 Related Work

Related work spans runtime policy and information-flow controls, authorization–provenance analysis, forensic attribution, and agent-security evaluations. AGATE’s positioning combines consumable authority, registered provenance, and effect accounting in a deterministic gate with evidence for inspection and reconstruction.

Runtime enforcement and information flow

  • Capability, information-flow, and runtime-specification systems regulate tool use, while related approaches address per-tool privilege, policy updates, and execution boundaries.Examples include CaMeL [11], APPA [19], FIDES [31], AgentSpec [29], Progent [25], AgentBound [7], and SkillGuard/RBC [32].Source: §8 · p. 12
  • AuthGraph aligns prompt-and-catalog authorization graphs with injected execution graphs, whereas AGATE grounds authority in operator declarations and host-issued instruments and tracks explicit runtime state.AGATE’s state covers request binding and consumption, source-to-sink matching, and repeated-effect review.Source: §8 · p. 12

Forensics and attribution

  • Forensic systems analyze trajectories, replay, injection localization, and attribution; AGATE links decision-time grounds to later inspection, with replay and host-audit measurements on covered paths.Examples include Agent-BOM [1], AttriGuard, AttnTrace and PromptLocate [15] [30], CTF-ABACUS [21], Famas [12], and MATE.Source: §8 · p. 12

Attack surfaces and evaluation

  • Agent-security research covers compositional risks, persistent memory influence, plugin ecosystems, and adaptive redteaming; AGATE’s experiments examine authority, copied data, benign reuse, and channel coverage.The evaluation distinguishes tool invocation from attack effect and retains failed candidates in its validation denominator.Source: §8 · p. 12

Positioning

  • AGATE combines consumable authority, registered data provenance, and effect accounting in one deterministic gate, with execution evidence supporting runtime inspection and forensic reconstruction.Its three adapters expose engineering consequences of differing host boundaries, and the records can support an agent detection-and-response pipeline.Source: §8 · p. 12

9 Conclusion

AGATE combines authorization-scope and data-origin checks at instrumented harness boundaries, retaining decision grounds for inspection and replay. Its evaluation reports reconstruction agreement alongside observed protection boundaries and utility costs, while mechanism positioning distinguishes the compared design dimensions from attack-success rates.

9 Conclusion

  • AGATE relates actions to authorization provenance and scope and to the origin of carried material, using consumable grants, source registration, and an effect ledger across instrumented boundaries.Deterministic decisions retain their grounds with execution evidence for inspection and replay, while adapters accommodate different host observation and control surfaces.Source: §9 · p. 12
  • Table 6 compares mechanism positioning by policy inputs, source handling, control, and evidence use, not attack-success rates across benchmarks.It distinguishes AGATE’s registry design and measured paths.Source: Table 6 · p. 13
  • 63/63 scenarios on each of two platforms showed replay agreement with live projection, alongside a parameter-rewriting bypass and denials in six of eleven benign file-processing scenarios.The evaluation also included 153 exercised attack-chain records and 252 monitored runs.Source: §9 · pp. 12–13
Loading 2609.30830v1…