When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents
Ranking
Overall
79
Content
95
Popularity
42
Observed public metrics from 1 member.
Merged summary
TL;DR - SARA is a runtime security framework that separates action suggestions derived from untrusted tool outputs from authorization to execute those actions. It sharply reduces agent attack success rates while preserving competitive task utility.
- An isolated Action Probe detects action-inducing content in observations and tracks its provenance across multiple steps.
- Tool calls are authorized only when supported by the user’s objective and evidence from previously authorized, successful executions.
- “No-History-Promotion” prevents repeated malicious instructions from gaining authority merely by recurring in an agent’s history.
- On AgentDojo and AgentDyn, SARA held attack success rates to at most 0.63% across four primary settings and reduced them across additional agent backbones.
Sources (1)
When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents
Public signals
Semantic Scholar citations 0 · Semantic Scholar influential citations 0
TL;DR - SARA is a runtime security framework that separates action suggestions derived from untrusted tool outputs from authorization to execute those actions. It sharply reduces agent attack success rates while preserving competitive task utility.
- An isolated Action Probe detects action-inducing content in observations and tracks its provenance across multiple steps.
- Tool calls are authorized only when supported by the user’s objective and evidence from previously authorized, successful executions.
- “No-History-Promotion” prevents repeated malicious instructions from gaining authority merely by recurring in an agent’s history.
- On AgentDojo and AgentDyn, SARA held attack success rates to at most 0.63% across four primary settings and reduced them across additional agent backbones.