Search papers, labs, and topics across Lattice.
This paper introduces the Agentic Permissions Policy Algebra (APPA), an innovative framework that enhances the usability of dynamic Information Flow Control (IFC) for autonomous LLM agents dealing with mixed-confidentiality data. By implementing engine-managed context branching and prospective acquisition enforcement, APPA allows agents to inspect unvetted data without permanently tainting their primary context, significantly reducing the risk of prompt injection attacks. The evaluation shows that APPA not only minimizes exfiltration success rates from 31%-50% down to 0%-7%, but also recovers substantial utility lost in traditional taint tracking methods across multiple models.
APPA enables LLM agents to safely inspect unvetted data without compromising their operational context, drastically reducing security risks while preserving utility.
Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors. While dynamic Information Flow Control (IFC) provides structural security guarantees, traditional taint tracking permanently taints an agent's context upon reading unvetted data, severely restricting downstream utility. We present APPA (Agentic Permissions Policy Algebra), an IFC framework that resolves this usability bottleneck through engine-managed context branching and prospective acquisition enforcement. Before data acquisition occurs, APPA prospectively evaluates label descents and missing prerequisites, generating actionable remedy plans (Authorize, Accept). To inspect unvetted data without polluting the primary context, a label-seeded child trajectory is spawned, absorbing label descent locally and allowing a trusted sanitizer to return a bounded derivative to the unchanged parent. Governed by a two-monoid model over security labels and shared event logs, we formally prove parent label preservation and merge confinement. Finally, we evaluate APPA on a multi-turn tool-chaining benchmark across four models: it suppresses exfiltration (31%-50% down to 0%-7% attack success), and on three of the four, branching recovers a substantial share of the utility that taint tracking alone forfeits.
