Search papers, labs, and topics across Lattice.
This paper introduces SPA, a novel plan-first architecture designed to enhance the security of persistent LLM agents operating in untrusted environments. By employing dual-lattice information-flow control, SPA effectively mitigates risks associated with attacker-controlled data that could compromise execution and state reuse across queries. The evaluation demonstrates that SPA can reduce the success rate of specific attacks to near zero, highlighting a significant advancement in securing LLM agents while navigating the complexities of security-utility tradeoffs.
SPA's innovative plan-first approach eliminates nearly all attack vectors for persistent LLM agents, revealing a critical breakthrough in securing AI interactions with untrusted data.
Large language model (LLM) agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources. Existing defenses typically protect either planning or individual tool interactions, but persistent agents face a broader threat: attacker-controlled data can alter control flow, enter security-sensitive tool arguments, or compromise later queries. We present SPA, a plan-first architecture that secures planning, execution, and cross-query state reuse. SPA invokes the planner once per query to generate a complete executable plan in a declarative domain-specific language, then applies dual-lattice information-flow control to track confidentiality and integrity across explicit data flows and control dependencies. To support persistence without re-exposing untrusted payloads to the planner, SPA stores execution results as labeled artifacts and reveals only semantic metadata during later planning. We evaluate SPA on AgentDojo and AgentDojo-MQ, which is our multi-query extension for measuring secure state reuse and delayed attacks. Under the'tool_knowledge'attack, SPA with information-flow control reduces attack success to zero on AgentDojo and 0.2% on AgentDojo-MQ. Our results show that plan-first execution combined with label-preserving persistence can substantially strengthen persistent LLM agents, while revealing an important security-utility tradeoff introduced by strict integrity enforcement.
