Environment Steering: Using Data Flow Control to Improve Agent Utility and Safety

arXiv:2609.35807 · cs.CL, cs.AI, cs.DB · Submitted 2026-09-19 · Read on arXiv

cs.CL, cs.AI, cs.DB

Submitted: 2026-09-19

Updated: 2026-09-19

Terminology

• Benchmark — 58× in this paper · explained in 2 episodes
• Provenance — 20× in this paper · explained in 4 episodes
• Steering — 13× in this paper · explained in 2 episodes
• Data Flow Control — 12× in this paper
• Trace — 5× in this paper · explained in 2 episodes
• Agent Harness — 4× in this paper · explained in 2 episodes
• Grounding — 4× in this paper · explained in 3 episodes
• AI Agents — 3× in this paper · explained in 2 episodes
• Ablation — 2× in this paper · explained in 1 episode
• Verification — 2× in this paper · explained in 2 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Abstraction — 1× in this paper · explained in 1 episode
• Agentic Task — 1× in this paper · explained in 1 episode
• Agentic Tasks — 1× in this paper · explained in 1 episode
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• EMMA — 1× in this paper · explained in 2 episodes
• Information Leakage — 1× in this paper · explained in 2 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Perplexity — 1× in this paper · explained in 3 episodes
• Policy Graph Notation — 1× in this paper
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models
• WildClawBench: A Benchmark for Real-World, Long-Horizon Agent Evaluation
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• Kimi K2.5: Visual Agentic Intelligence
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents
• AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
• The MiniMax-M2 Series: Mini Activations Unleashing Max Real-World Intelligence
• gpt-oss-120b & gpt-oss-20b Model Card
• Progent: Securing AI Agents with Privilege Control
• PromptArmor: Simple yet Effective Prompt Injection Defenses
• An AI Agent Execution Environment to Safeguard User Data
• Data Flow Control: Data Safety Policies for AI Agents
• AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
• Qwen3 Technical Report

Related papers

• Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
• Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
• Subliminal Steering: Stronger Encoding of Hidden Signals
• MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
• The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
• Untangling the Mechanisms of Misleading Context in Medical Question Answering