Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents

arXiv:2608.29942 · cs.CR, cs.AI · Submitted 2026-08-30 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-08-30

Updated: 2026-08-30

Terminology

• Benchmark — 12× in this paper · explained in 2 episodes
• Provenance — 12× in this paper · explained in 4 episodes
• Trace — 12× in this paper · explained in 2 episodes
• Fidelity — 9× in this paper · explained in 2 episodes
• Calibration — 4× in this paper · explained in 7 episodes
• Verification — 4× in this paper · explained in 2 episodes
• Accuracy — 2× in this paper · explained in 1 episode
• Analyzer — 2× in this paper · explained in 1 episode
• Security and Privacy — 2× in this paper
• AI Agents — 1× in this paper · explained in 2 episodes
• Aggregation — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 3 episodes
• Granularity Mismatch — 1× in this paper · explained in 2 episodes
• Verifier — 1× in this paper · explained in 2 episodes

Sources

• Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems
• Defeating Prompt Injections by Design
• The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
• The Replay Gap: Static Evaluation of Model Switching in LLM Agents Scores the Wrong World
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
• ClawsBench: Evaluating Capability and Safety of LLM Productivity Agents in Simulated Workspaces
• Auditing Provenance Sensitivity in LLM Agent Action Selection
• AIRGuard: Guarding Agent Actions with Runtime Authority Control
• Context-to-Execution Integrity for LLM Agents
• Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
• Agent-Sentry: Bounding LLM Agents via Execution Provenance
• Causal Agent Replay: Counterfactual Attribution for LLM-Agent Failures
• Progent: Securing AI Agents with Privilege Control
• Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents
• AgentWatcher: A Rule-based Prompt Injection Monitor
• Beyond Accuracy: Policy Invariance as a Reliability Test for LLM Safety Judges
• ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection
• AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification
• FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs
• Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs