Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper identifies a novel security vulnerability, "causality laundering," in tool-calling LLM agents where information about denied actions is leaked through subsequent, seemingly benign tool calls. To address this, they introduce the Agentic Reference Monitor (ARM), a runtime enforcement layer that uses a provenance graph augmented with counterfactual edges representing denied actions. Experiments demonstrate that ARM effectively blocks causality laundering and other attacks missed by flat provenance tracking, with minimal performance overhead.
LLM agents leak sensitive information about denied actions through seemingly innocuous tool calls, creating a subtle but serious security hole.
Tool-calling LLM agents can read private data, invoke external services, and trigger real-world actions, creating a security problem at the point of tool execution. We identify a denial-feedback leakage pattern, which we term causality laundering, in which an adversary probes a protected action, learns from the denial outcome, and exfiltrates the inferred information through a later seemingly benign tool call. This attack is not captured by flat provenance tracking alone because the leaked information arises from causal influence of the denied action, not direct data flow. We present the Agentic Reference Monitor (ARM), a runtime enforcement layer that mediates every tool invocation by consulting a provenance graph over tool calls, returned data, field-level provenance, and denied actions. ARM propagates trust through an integrity lattice and augments the graph with counterfactual edges from denied-action nodes, enabling enforcement over both transitive data dependencies and denial-induced causal influence. In a controlled evaluation on three representative attack scenarios, ARM blocks causality laundering, transitive taint propagation, and mixed-provenance field misuse that a flat provenance baseline misses, while adding sub-millisecond policy evaluation overhead. These results suggest that denial-aware causal provenance is a useful abstraction for securing tool-calling agent systems.