The paper introduces EDIC, a framework for per‑instruction compliance in large language models that interact with external data. It decomposes the task into identifying, classifying, and acting on each embedded directive, using a scene‑grounded pipeline and a generative judge trained with GRPO to attribute compliance at the instruction level. Experiments on two backbones and five benchmarks show that EDIC improves safety and utility, achieving up to a 7.7% increase in harmful‑rejection and a 12.5% boost in Arena‑Hard‑Auto utility on Qwen3‑4B.
By Zesheng Shi, Xue Li, Chenrui Dai, Jing Li
The paper introduces Learnable Trust‑Boundary Delimiters (LTBD), a lightweight defense that embeds learnable delimiters into LLM inputs to explicitly mark trusted user instructions versus untrusted external data. LTBD keeps the model’s parameters unchanged, achieving superior performance over inference‑time defenses and matching training‑based methods while adding negligible inference overhead. Experiments show near‑zero attack success rates on AlpacaFarm and TaskTracker, and the method remains robust even against adaptive attackers who know the defense.
By Luman Zhao, Minghui Xu, Yue Zhang, Yijun Yang
arXiv:2610.16838v1 Announce Type: new
Abstract: As language-model agents write code, move money and change records on behalf of users, deciding whether an action is authorized has become a central sa...
By Huihao Jing, Shaojin Chen, Wenbin Hu, Yuxuan Liu, Haochen Shi, Zhongwei Xie, Haoran Li, Yangqiu Song
The paper introduces Trustworthy RAG, an evaluation agent designed to detect misinformation and knowledge poisoning in Retrieval-Augmented Generation systems. It combines natural language inference verification, a five-signal poison detector, and a weighted Trust Index to assess the reliability of retrieved content. Experiments on multiple LLMs show high accuracy and precision, with the agent effectively blocking unsafe advice in a secure-coding assistant scenario.
By Balkrishna Giri, Md Toufique Hasan, Jussi Rasku, Muhammad Waseem, Pekka Abrahamsson
The paper introduces Policy-as-Skill (PaS), a modular runtime that packages evidence validation, review routing, version control, and auditability as executable, versioned policy capabilities for large language models. PaS was evaluated on 600 development tasks using a Gemma4 backend, achieving 53.8% exact accuracy and high audit completeness, and deterministic control further improves aggregate accuracy to 61.2% in a task‑dependent manner.
By Kabeh Mohsenzadegan, Vahid Tavakkoli, Kyandoghere Kyamakya
arXiv:2609.39065v1 Announce Type: cross
Abstract: LLM agents increasingly rely on installable skills, which are packages of instructions, code, and resources that equip them with task-specific capabi...
By Yan Wang, Zhihao Zhang, Ke Chen, Kai Chen, Yaqin Zhang, Duohe Ma, Jun Dai, Xiaoyan Sun
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
By Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang
arXiv:2610.16426v1 Announce Type: new
Abstract: Automated approval systems let coding agents execute high-risk actions with minimal human oversight by delegating the authorization decision to a class...
By Zhixiong Zhuang, Jin Jia, Zhiwei Shang, Ziyu Wang
arXiv:2608.30041v1 Announce Type: cross
Abstract: Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later pri...
By Wujie Xiong, Rabimba Karanjai, Yang Lu, Weidong Shi, Lei Xu
The paper introduces a framework for evaluating AI systems that not only checks final labels but also tracks the reasoning behind them through three core sources—grounds, norms, and authority—forming an eight-cell counterfactual judgment cube. It defines minimal source replacement sets, called judgment receipts, to explain changes in verdicts and provides certification cost bounds for black-box evaluators. The authors present ReasonBench, a benchmark with 19,520 cases, and demonstrate that while high standard accuracy can mask robustness issues, receipt accuracy reveals significant gaps in reasoning consistency across different models.
By Ye Chen, Weining Zhang
The paper introduces LLM4Trust, a benchmark framework that evaluates large language models (LLMs) for trust assessment in cybersecurity. It constructs trust graphs to represent five fundamental trust properties, designs property‑understanding tasks, and tests eight LLMs across nine prompting strategies. The study identifies effective LLM‑prompt combinations, applies them to real datasets, proposes methods to handle context limits, and demonstrates that LLMs can understand trust properties while highlighting vulnerabilities and high inference costs, for which defense mechanisms and batch inference are suggested.
By Jie Wang, Yanbo Sun, Zheng Yan, Jiahe Lan, Elisa Bertino
SecJev is a family of Jev-like decision models specialized for security, ranging from 0.8 B to 9 B parameters. Built on Kev’s single‑pass candidate scorer, it learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories, and is trained on the SecJev‑Corpus that unifies source‑label prediction and explicit‑policy evaluation across 14 tasks and eight sources. The security specialization improves every model, with SecJev‑0.8B outperforming general Kev‑9B by 20.51 percentage points in task‑macro accuracy and matching generative fine‑tuning in accuracy and latency while using less peak inference memory.
By Zheng Chen, Fei Yu, Haohao Huang, Yang Li, Anlong Chen, Lei Chen