Search papers, labs, and topics across Lattice.
This paper investigates the security vulnerabilities of large language model (LLM) agents operating in high-performance computing (HPC) environments, specifically focusing on the hijacked authorized agent problem where adversarial instructions can exploit user credentials. By defining a tailored threat model for HPC and identifying critical attack surfaces, the authors highlight the inadequacies of existing security controls that fail to account for the specific intent behind tasks assigned to LLM agents. The study culminates in the proposal of an empirical benchmark, TaskBound, aimed at systematically evaluating these security challenges.
Adversarial instructions can exploit LLM agents in HPC, leading to unauthorized actions even under authenticated user credentials.
Large language model (LLM) agents are starting to take on routine work in high-performance computing (HPC), including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's credentials and inherits the user's access to files and the scheduler. This arrangement creates a failure mode that ordinary account-level controls do not capture. Adversarial instructions in a log, tool description, shared file, or peer-agent message may redirect the agent beyond the task the user assigned, even though every resulting command is authenticated and permitted for that account. We refer to this as the hijacked authorized agent problem. Existing agent-security studies explain relevant mechanisms, such as indirect prompt injection and tool misuse, but generally evaluate them in web, enterprise, or personal-assistant settings. HPC security, by contrast, has mature controls for identity and isolation but does not ordinarily represent the intent of a particular task. This paper defines the threat model in the HPC setting, identifies attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows, and examines where current controls fall short. It concludes with a research agenda and a plan for an empirical benchmark, TaskBound.
