Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study introduces the Recuse Signal, a novel in-band communication mechanism that allows operators to request LLM agents to voluntarily withdraw from accessing certain resources without hard-failing them. By implementing this signal in a live production environment using SSH and PostgreSQL protocols, the researchers conducted controlled experiments that demonstrated a 100% compliance rate in recusal when the signal was present, contrasting with 100% task completion in the absence of the signal. The findings highlight the cooperative nature of the signal, revealing that agent behavior can be influenced by framing, with more capable models sometimes choosing to ignore the recusal request when explicitly authorized by the operator.
LLM agents can be made to voluntarily recuse themselves from tasks with a simple in-band signal, achieving 100% compliance in controlled tests.
As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini-standard, implement two zero- or low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal -- 100% recusal when present versus 100% task completion in a no-signal control -- and, revealingly, behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. We release the standard, adapters, and experiment harness for reproduction.