Source-linked AI summary
The Envelope Layer: An Underestimated Surface of LLM Agent Defense
Yuelin Han
TL;DR
Prior work established the envelope layer as an agent-defense surface but had limited evidence on label strength, envelope authenticity, and memory. This paper tests those factors with A2A-TIBA, finding that outcomes vary across conditions and supporting an envelope model with both admission and context assembly surfaces.
Problem
Prior envelope-layer work tested labels briefly, mainly on one frontend, and did not establish how label strength, forged provenance, scaffold differences, or existing memory affect defense.
Source: §1 · p. 1Method
The paper applies GDA Measurement and the A/B/C/D taxonomy to A2A-TIBA, using semantic breach as the primary indicator in a factorial label-authenticity experiment and a separate memory experiment.
Source: §1 · p. 2, §3.2 · p. 4Results
Success memory raises semantic breach rate to 81.2%, failure memory lowers it to 6.2%, and most combinations containing both experiences return near the no-memory baseline.
Source: §1 · p. 2Takeaways & Limitations
The envelope layer includes both an admission channel and a context assembly surface, with its security boundary jointly shaped by label claims, frontend permissions, and historical memory.
Source: §1 · p. 2The attack chain uses one fixed skill family without adaptive attacks, limiting the tested attack scope.
Source: §6.3 · p. 14
Abstract
from arXiv · showhide
Prior work framed the envelope layer as the channel through which malicious content enters an agent, and established it as a defense surface independent of the LLM layer and the agent layer; however, that work only tested the envelope layer briefly and did not examine how label strength, envelope authenticity, scaffold differences, or existing memories affect defense effectiveness. Following its GDA Measurement methodology and the A/B/C/D outcome taxonomy, this paper takes the A2A-TIBA attack as the test vehicle, uses the semantic breach rate as the primary indicator with the semantic refusal rate as its complementary reference, and characterizes the security boundary of the envelope layer through a two-by-two factorial experiment and a memory experiment. The results show that: when the envelope is authentic, strong labels consistently reduce the semantic breach rate, whereas weak labels are not necessarily better than an unlabeled baseline; when the envelope can be forged, the benefit of strong labels is weakened and its direction varies across frontends; and memory has a larger effect than any label manipulation: success memory raises the semantic breach rate while failure memory lowers it, and most combinations that contain both experiences return to the no-memory baseline. Accordingly, this paper refines the envelope layer from a single admission channel into two levels, an admission channel plus a context assembly surface, and argues that its security boundary is not a fixed property of labels but a dynamic outcome jointly shaped by label claims, frontend permissions, and historical memory.
1 INTRODUCTION
The paper addresses the limited testing of envelope-layer defenses by evaluating label strength, envelope authenticity, and memory effects in A2A-TIBA. It finds that defense effectiveness varies with the envelope and frontend, and refines the envelope layer to include context assembly as well as admission.
1 INTRODUCTION
- Prior work established the envelope layer as a defense surface independent of the LLM and agent layers, but tested labels briefly and mainly on one frontend.That work’s single-factor design could not assess forged envelopes, scaffold differences, or pre-existing memory.Source: §1 · p. 1
- Following GDA Measurement and the A/B/C/D taxonomy, this paper uses semantic breach rate as its primary indicator and semantic refusal rate as a complementary reference.It tests label strength and envelope authenticity in a 1,200-cell factorial experiment and memory in a 320-cell experiment.Source: §1 · pp. 1–2
- With authentic envelopes, strong labels consistently lower semantic breach rates, but weak labels can perform worse than the unlabeled baseline.Under forged envelopes, the benefit of strong labels weakens and varies by frontend; memory effects exceed label effects.Source: §1 · p. 2
- Success memory raises semantic breach rates, failure memory lowers them, and most combinations containing both experiences return near the no-memory baseline.The exception is the openclaw weak-label group, where both conflict conditions exceed its baseline.Source: §1 · p. 2
- The paper extends the envelope layer from an admission channel to a context assembly surface involving the system prompt, skill declarations, message-role wrapping, and memory.Its security boundary is jointly shaped by label claims, frontend permissions, and historical memory; the admission channel is held fixed, so conclusions do not extend to cryptographic authentication.Source: §1 · p. 2
2 RELATED WORK
Prior agent-security work often relies on attack success rate, which conflates semantic refusal, agent-layer interception, and successful exfiltration. This paper situates envelope labels and memory within a layered defense framework and distinguishes admission from context assembly.
2.1 Agent Security Evaluation and the Four-Way Decomposition
- A single attack success rate merges outcomes with different implications for defense, while prior evaluations report that defense-induced reductions can be inconsistent.Some recent work instead reports outcomes such as tool-call and data-leakage rates.Source: §2.1 · p. 2
- A/B/C/D measurement separates semantic refusal, partial delivery, agent-layer interception, and successful exfiltration, locating where a defense changes outcomes.An envelope label may affect whether execution begins without changing whether the agent stops it afterward.Source: §2.1 · p. 2
2.2 The Envelope Layer, Protocol Wrapping, and Forgery Attacks
- The paper distinguishes the admission channel (L1a) from the assembly surface (L1b), the complete context sent to the backend LLM.Its label-strength, envelope-authenticity, and memory-valence manipulations concern L1b; L1a is held fixed.Source: §2.2 · p. 3
- A2A sender identity is carried in an HTTP authentication header rather than cryptographically bound to the message-body provenance claim, leaving natural-language labels dependent on model compliance and scaffold placement.A2ABreak [5] identified protocol-level defects exploitable by compliant attackers without implementation bugs.Source: §2.2 · p. 3
- Whether a strong label remains effective against a forged envelope had rarely been tested as an independent factor, motivating the paper’s factorial design.The forged header makes the message appear to come from the highest-privilege local user.Source: §2.2 · p. 3
2.3 Memory and Persistent State
- Unlike memory-poisoning studies, this paper fixes label configuration and varies memory-record valence—success, failure, or conflict—to test how experience nudges behavior.It examines whether conflicting experiences return behavior toward the no-memory baseline, rather than which conflicting knowledge the model selects.Source: §2.3 · p. 4
3 RESEARCH DESIGN
The research design holds the malicious payload constant while varying provenance claims and memory, then classifies outcomes by where the attack is refused, intercepted, or succeeds. It measures semantic breach primarily and crosses label strength with envelope authenticity.
3.1 Capability Boundaries of Attackers and Defenders
- The attacker can disguise a provenance claim, while the defender can label provenance as untrusted and set policy; the payload stays identical across conditions.The experiment therefore varies the LLM’s judgment of whether the prompt is user-authorized behavior or an attack.Source: §3.1 · p. 4
3.2 Measurement Method and the Four Outcome Classes
- Semantic breach rate (non-A share) is the primary measure, semantic refusal rate (A share) its complementary reference, and penetration rate an auxiliary indicator.A/B/C/D classes distinguish refusal, partial delivery, agent-layer interception, and successful exfiltration.Source: §3.2 · p. 4
3.3 2×2 Factorial Design
- The 2×2 design crosses weak versus strong labels with original versus forged envelopes, yielding W-O, W-F, S-O, and S-F conditions.The forged header appears to be a direct user message; the payload and attack module remain unchanged.Source: §3.3 · pp. 5–6
3.4 Memory Study
- The memory study tests Fail, Success, Success-first, and Fail-first conditions to compare single-valence memories with conflicting experiences written in opposite orders.The order manipulation distinguishes a recency account from a preference for one kind of experience; no extra untrusted label is added to memory messages.Source: §3.4 · p. 6
4 EXPERIMENTAL SETUP
The experiments use A2A communication to test envelope-layer defenses across agent frontends and backend models. The main experiment varies label strength and forgery, while a separate memory experiment compares four memory conditions against no-memory baselines.
4.1 Testbed and the A2A Channel
- The testbed reuses the prior environment and uses an authenticated A2A channel that transports prompts intact without adding permission-based defense.Three frontends and five backend LLMs form 15 target combinations; strong and weak labels are ported across frontends, with placement varying by agent structure.Source: §4.1 · p. 6
4.2 Attack Skill and Outcome Adjudication
- The skill07-a attack asks the target to add and invoke an MCP tool that runs a callback program, reads malicious instructions, and returns sensitive information.A judge agent adjudicates outcomes, with human reviewers resolving disagreements.Source: §4.2 · pp. 6–7
4.3 Experimental Plan
- The experimental plan separates a main test of label defense from a memory test of historical experience.The main experiment targets the A2A channel; the memory experiment independently tests memory’s effect on attack outcomes.Source: §4.3 · p. 7
4.3.1 Main Experiment Plan
- The main experiment repeats four label-by-authenticity conditions 20 times across three frontends and five backends, totaling 1,200 cells.An abnormal testing-time combination used a reduced maxTokens setting.Source: §4.3.1 · p. 7
4.3.2 Memory Experiment Plan
- The memory experiment tests four selected frontend-label-skill combinations under four memory conditions, totaling 320 cells, with corresponding main-experiment results as no-memory baselines.The backend is fixed to deepseek-v4-pro.Source: §4.3.2 · p. 7
5 RESULTS
Across 1,200 test cells, the results show that label strength, envelope authenticity, frontend context, and memory all shape the envelope layer’s defensive boundary. Strong labels help under authentic envelopes, but forgery and memory can weaken or alter that benefit; the paper therefore defines the envelope as both an admission channel and a context assembly surface.
5.1 Main Experiment Results
- The 1,200-cell distribution was A 609 (50.8%), B 17 (1.4%), C 234 (19.5%), and D 340 (28.3%), yielding a 49.2% semantic breach rate.Class B was rare; the authors report that partial execution of malicious content was also rare.Source: §5.1 · p. 7
5.1.1 Effect of Envelope-Label Strength
- Porting Hermes’ native A2A strong label to OpenClaw and Claude Code lowered both agents’ semantic breach rates; weak labeling diverged, raising OpenClaw’s rate but lowering Claude Code’s.A strong label was more effective than a weak label, which may even introduce higher compromise risk.Source: §5.1.1 · p. 9
5.1.2 Effect of the Attacker’s Forged Envelope Claim
- Under forged skills, the strong-label effect varies by frontend: it reduces breach rates by 63 percentage points on openclaw and 19 on hermes, but is 3.0 points higher than the weak-label rate on claude.The authors caution that the claude result does not establish that strong labels defend worse than weak labels there.Source: §5.1.2 · p. 10, Table 3 · p. 10
5.1.3 Effect of the LLM Backend
- At the backend margin, forged skills weaken but do not reverse the strong-label benefit, while pooled results can mask frontend sign reversals.The reported forged-versus-original differences vary by backend and can differ by up to 80 percentage points across frontends for the same backend.Source: §5.1.3 · p. 10, Table 4 · p. 11, Table 5 · p. 11
5.2 Memory Experiment Results
- Across memory conditions, failure memory lowers the semantic breach rate and success memory raises it; conflict memory is near baseline in three of four groups but not openclaw with a weak label.The pooled baseline was 40.0%, compared with 81.2% for success memory, 6.2% for failure memory, and 41.2% and 43.8% for the two conflict conditions.Source: §5.2 · pp. 11–12, Table 6 · p. 12
5.3 Experimental Conclusions
- The experimental conclusions are that strong labels help under original skills, forged-label effects depend on the frontend, and memory has a larger effect than labels.Success memory raises the breach rate, failure memory lowers it, and conflict memory is near baseline in three of four groups.Source: §5.3 · p. 12
5.4 Extending the Definition of the Envelope Layer
- The paper defines the envelope layer as both an admission channel for incoming data and a context assembly surface jointly formed by prompts, skill declarations, role wrapping, and memory.Its security boundary is presented as a dynamic outcome shaped by label claims, frontend permissions, and historical memory.Source: §5.4 · pp. 12–13
6 DISCUSSION
The discussion treats agent–LLM pairing, protocol support, context-component weighting, and inter-agent trust as security considerations, and frames label defense as bounded by unverifiable provenance. It also qualifies the findings by experimental design, attack scope, and cross-batch comparisons.
6.1 Inferences and Conjectures
- The discussion identifies frontend–backend pairing, unsupported protocol additions, context-component weighting, and inter-agent trust as security considerations.It proposes studying how context components receive attention and how trust mechanisms can prevent compromise from spreading among collaborating agents.Source: §6.1 · p. 13
6.2 Verifiability Boundary of the Envelope Layer
- Under a strong label, claude’s semantic breach rate rises from 13% to 52% when the envelope is forged, illustrating that provenance claims are not proof.The paper says labels cannot provide cryptographic provenance guarantees and limits its conclusions about forgery to settings without verified provenance; signed envelopes may behave differently.Source: §6.2 · pp. 13–14
6.3 Limitations
- The study’s conclusions are bounded by group-run conditions, a fixed non-adaptive attack family, and baseline comparisons drawn across different batches.The authors also note that 20 repetitions cannot stably estimate differences as small as 5–10 percentage points, while selected memory combinations carry regression-to-the-mean risk.Source: §6.3 · p. 14
7 CONCLUSION
Across the experiments, label effects depend on envelope authenticity and frontend, while memory has a larger effect than label manipulations. The paper extends the envelope layer to cover both data admission and context assembly.
7 CONCLUSION
- The 1,200-cell factorial and 320-cell memory experiments hold the admission channel fixed, so their conclusions do not extend to cryptographic provenance in signed envelopes.Source: §7 · p. 14
- Strong labels lower semantic breach under authentic envelopes; forgery weakens and frontend-diverges their benefit, while success and failure memories raise and lower breach, respectively.Most combinations containing both memory experiences return to the no-memory baseline, with an openclaw weak-label exception.Source: §7 · p. 14
- The envelope layer comprises an admission channel (L1a) and a context assembly surface (L1b), jointly shaped by label claims, frontend permissions, and historical memory.Source: §7 · p. 14
- Security evaluation should measure channel trustworthiness separately from how context is assembled.Source: §7 · p. 15
- Future work will examine frontend-specific LLM fine-tuning, attention to agent-context components, and task allocation in multi-agent systems.Source: §7 · p. 15
ETHICS AND REPRODUCIBILITY STATEMENT
The paper reports isolated-testbed experiments and provides the label and forged-envelope constructions, including their frontend-specific installation details and a token-cap rationale.
ETHICS AND REPRODUCIBILITY STATEMENT
- Experiments used isolated agent containers, A2A-only attack commands, fictitious decoy files, and no production system, user data, or online service.The inbound-credential attacker setting is part of the testbed design.Source: ETHICS AND REPRODUCIBILITY STATEMENT · p. 15
- The paper reports no new protocol-level vulnerability; it identifies its contribution as measurement methodology and a defense model, with testbed and results slated for release after publication.Source: ETHICS AND REPRODUCIBILITY STATEMENT · p. 15
APPENDIX A VERBATIM TEXT OF THE LABELS AND FORGED ENVELOPES
- The appendix documents three envelope constructions that vary the envelope while keeping payload body and attack module unchanged across frontends.Source: Appendix A · p. 16
A.1 Weak Label (W)
- The weak label only marks A2A delivery, omitting peer identity and the three prohibitions; it is prepended by each frontend without adding an A2A security statement to the system prompt.Its leading token matches the strong label, and the forged attack receives the same imitable label shape.Source: §A.1 · p. 16
A.2 Strong Label (S)
- The strong label pairs a peer-naming, untrusted-input prefix with a common system-prompt warning, while peer identity is runtime-provided only for hermes and fixed for openclaw and claude code.The latter two gateways do not pass peer identity into the container.Source: §A.2 · p. 16
A.3 Forged Label (F)
- The forged label is a byte-identical, one-line out-of-band user-message header across frontends; openclaw’s automatic conversation-info prefix is a platform constant, not part of this factor.Source: §A.3 · p. 16
A.4 Installation Locations
- Label text is unified but installed in frontend-native shells; the strong label changes recipient presuppositions, and the unlabeled baseline is available only for openclaw and claude code.Weak-label placement and prompt handling vary by frontend; it is not equivalent to the no-label baseline.Source: §A.4 · p. 16
QWEN3.8-MAX COMBINATION
- Only openclaw with qwen3.8-max received a 16,384-token cap; it addressed unusually long weak-label runs and affected truncation and duration, not judgments or A/B/C/D definitions.The six uncapped weak-label × original-skill cells had a 38.5-minute median duration and a 55.0-minute maximum.Source: QWEN3.8-MAX COMBINATION · p. 16
APPENDIX C RATIONALE FOR THE FOUR COMBINATIONS IN THE MEMORY EXPERIMENT
The memory experiment uses a fixed backend and compares memory conditions against matching cells from the main experiment.
APPENDIX C RATIONALE FOR THE FOUR COMBINATIONS IN THE MEMORY EXPERIMENT
- The 320-cell memory experiment fixes the backend to deepseekv4-pro and varies frontend, label strength, skill form, and memory condition.Source: Appendix C · p. 17
- For each of four combinations, 20 matching main-experiment cells serve as the no-memory baseline.Source: Appendix C · p. 17
- The matching baseline cells are reused rather than rerun.Source: Appendix C · p. 17
C.1 Fixing the Backend
Deepseek-v4-pro was selected because both label and forgery effects were active in the main experiment, and fixing one backend keeps memory contrasts interpretable.
C.1 Fixing the Backend
- Under original skill, semantic breach fell from 76.7% with weak labels to 10.0% with strong labels on deepseek-v4-pro, the largest drop among five backends.Strong-label forgery raised breach by +30.0 percentage points (15.5–44.5), and weak-label forgery by +20.0 points (8.4–31.6); neither 95% CI contained 0.Source: §C.1 · p. 17
- Holding the backend fixed avoids confounding backend differences with memory condition and keeps frontend, label, and skill contrasts interpretable.Source: §C.1 · p. 17
- The reported memory-effect magnitude is not extrapolated to other backends because deepseek-v4-pro does not represent them.Source: §C.1 · p. 17
C.2 The Four Combinations
The memory experiment tests four selected frontend, label, and skill combinations across memory conditions, then varies only the remembered outcome. Its interpretation is limited to how past outcomes affect current judgment, not to who can write memories.
C.2 The Four Combinations
- The 320-cell design repeats four selected frontend–label–skill combinations 20 times under each of four memory conditions.The combinations include two Claude settings with strong labels and two OpenClaw settings with weak and strong labels; their baseline semantic breach rates range from 10% to 85%.Source: §C.2 · p. 17
C.3 Memory Text and Construction
- The four memory conditions write failure or success alone, or both records in either order, before a same-type task is issued.Conflicting records have identical content and date; the session is cleared while native frontend memory is retained.Source: §C.3 · p. 17
C.4 Interpretive Constraints
- Because only the record’s outcome changes, the experiment tests how past experience affects current judgment, not memory poisoning or the memory write path.The paper states that memory poisoning requires attacker access to memory writing, which it does not test.Source: §C.4 · p. 17
THE ATTACK TESTS
- Execution time is measured from recorded start to end, including container preparation and waiting; token counts sum captured LLM-call usage per cell.Reported values are means over 20 repetitions; cells with no collected tokens are marked “—”.Source: THE ATTACK TESTS · p. 17
D.1 Main Experiment
The main experiment’s execution appendix organizes time and token-consumption measurements by frontend and backend across four label–skill conditions. Claude is fastest in most combinations, while one OpenClaw configuration is the longest-running.
D.1 Main Experiment
- Each of the four 2×2 conditions contains 3 frontends, 5 backends, and 20 repetitions, totaling 300 cells per condition.Tables D-1–D-4 present backends as rows and frontends as columns, with each cell reporting the mean over 20 repetitions.Source: §D.1 · p. 17, Table D-1 · p. 18, Table D-2 · p. 18
- Claude has the shortest mean execution time, 3–6 min for most combinations; openclaw × qwen3.8-max takes 17.3 min in both weak-label conditions.The tables report execution time and token consumption for each label–skill condition, with 20 repetitions per cell.Source: §D.1 · p. 18, Table D-1 · p. 18, Table D-2 · p. 18
D.2 Memory Experiment
The memory experiment compares four selected settings across four memory conditions, using matching main-experiment cells as baselines. Memory condition strongly changes token consumption, while execution-time changes are small.
D.2 Memory Experiment
- The experiment fixes the backend to deepseek-v4-pro and repeats four frontend–label–skill combinations 20 times under each of four memory conditions, totaling 320 cells.Its baseline uses 20 matching cells from the main experiment per combination, 80 cells total, without rerunning them.Source: §D.2 · p. 18, Table D-5 · p. 19
- Token consumption varies markedly by memory condition: for Claude with strong label + original skill, fail uses 71,200 tokens and success uses 356,718.The mean execution time across the four groups and five values remains between 3.5–6.9 min.Source: §D.2 · p. 18