Track manipulation, locomotion and embodied systems.
Search papers, labs, and topics across Lattice.
This paper investigates the limitations of influence-based guardrails in tool-using LLM agents, revealing their inability to differentiate between legitimate user actions and unauthorized actions when both rely on external tool information. Through an authorization-equivalence audit of 96 conditions, the authors demonstrate that benign actions can inadvertently trigger security interventions due to shifts in causal signals, leading to reduced utility and increased latency. The findings highlight that while a semantic monitor can improve utility, it does not effectively prevent unauthorized actions, underscoring the need for better reference construction and routing in guardrail designs.
Benign actions can be misclassified as attacks due to causal signal shifts, leading to significant utility loss in tool-using LLMs.
The key limitation of current state-of-the-art influence-based guardrails is that they do not reliably distinguish a legitimate, user-authorized action from a malicious, unauthorized action when both rely on external tool information. This ambiguity can cause benign actions to trigger unnecessary verification and intervention, reducing utility and adding latency. We expose this limitation through an authorization-equivalence audit of 96 conditions derived from 24 base cases. Within matched source comparisons, we hold authorization, the exact committed action, and its intended effect fixed, changing only whether a required value comes from the user or a legitimate tool result. Although the action remains unchanged, this harmless relocation shifts the causal signal toward the attack region in all 24 cases under both Llama and Gemma scorers. Matched unauthorized controls show that the signal remains attack-sensitive, yet the benign relocation produces a larger average score shift than the actual change in authorization. Architecture-level evaluation shows how this mismatch propagates through guardrail designs. With a semantic monitor, attack success is 0% and utility is 28%, compared with 16% and 60% without it. A shadow-based guardrail allows every tested harmless run, yet does not reject matched unauthorized actions more often overall: 57.5% of unauthorized runs pass automatically before reaching the later security check, compared with 29.2% of authorized runs. These results show that the studied causal signal reveals what shaped an action without reliably encoding whether the action was authorized, and that reference construction and routing are integral to the effective security decision.