The paper introduces Governed Deduction (GD), a framework that distinguishes between premise relevance and premise authorization in reasoning systems. Using an RBAC-augmented Spider benchmark, the authors create 4,461 authorization pairs where the same premise is either allowed or denied for a transition, revealing that simple linear models fail to capture policy constraints. The study demonstrates that matched controls and leakage audits are essential for evaluating policy-sensitive reasoning.
arXiv:2610.27620v1 Announce Type: cross Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authori...
arXiv:2608.23224v1 Announce Type: cross Abstract: Retrieval can efficiently and effectively augment a frozen vision--language--action (VLA) policy without retraining, yet retrieved text becomes a con...
arXiv:2606. 10385v1 Announce Type: cross Abstract: On-policy distillation (OPD) has demonstrated strong empirical gains in enhancing complex reasoning in LLMs by aligning a student model with a teacher's predictive distribution over the student's own trajectories.
arXiv:2607. 25364v1 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales.
arXiv:2606. 03089v1 Announce Type: cross Abstract: On-policy self-distillation (OPSD) has emerged as an efficient post-training paradigm by using a teacher conditioned on privileged information to provide dense token-level supervision.
The paper introduces the Event Reasoning System (ERS), a framework that represents reasoning as an explicit event graph and uses hierarchical rule composition to manage dependencies and revisions. ERS employs semantic features to nominate candidate objects and rule bindings, while low‑level rules provide reusable transformations and high‑level control rules organize subgoals, ensuring that only admissible operations enter accepted reasoning paths. Empirical results on structured‑event graphs show ERS can build long dependency chains, eliminate irrelevant operations, and maintain correctness across numerous test cases, while reducing inference time by over 50% compared to single‑level control.
The paper investigates a critical flaw in AI coding-agent systems such as Claude Code, Codex CLI, and Cursor, where the action approved by a human is not the same as the action executed by the harness. It introduces the concept of Approval Laundering, categorizing six systematic failure modes—Scope, Argument, Temporal, Tool, Delegation, and Semantic laundering—and demonstrates these failures through controlled experiments. The authors propose an Approval Token mechanism that mitigates some laundering types but leaves others unaffected, highlighting the limitations of current enforcement strategies.
Modern AI coding-agent harnesses (Claude Code, Codex CLI, Cursor) rest their security boundary on a largely unexamined assumption: that the action A a human approves is the same action A' the harness...
The paper introduces a protocol for cross‑interface authorization of AI computer‑use agents, ensuring that policy decisions remain consistent across graphical interfaces, command lines, APIs, scripts, and Model Context Protocol servers. It defines a profile‑bounded system that enumerates all effect‑bearing routes, normalizes requests to canonical effects, issues prepare tickets, and re‑verifies all relevant state at commit time, requiring a sink receipt for a committed result. Extensive testing across two runtime mappings produced thousands of traces, with rigorous checks confirming no semantic regressions, mutant rejections, and correct outcome matching.
arXiv:2606. 12320v1 Announce Type: new Abstract: Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls -- access control, data-loss prevention, perimeter inspection -- governed crossings of that boundary.
SecureGARD is a dynamic ontology‑guided governance framework designed to secure tool‑using large language model agents. It grounds heterogeneous tool calls in a shared semantic representation, using an executable ontology combined with episode‑level task state to make deterministic ready, waiting, and forbidden decisions. The system evolves its ontology offline from verified training executions, ensuring logical consistency and protecting entailments, and achieves a 0% attack success rate across multiple benchmarks while improving task utility under attack.
arXiv:2607. 13069v1 Announce Type: new Abstract: Large language models produce chain-of-thought (CoT) reasoning that appears logically sound yet may not genuinely depend on its stated premises.