← Back to all news
arXiv AI By Bo Yan, Qi Zhang, Ziwen Kan, Fnu Suya, Song Wang

PROVISO: Provenance-Informed Action Selection for Secure LLM Agents

Read the original on arXiv AI →

PROVISO is a controller that selects which action an LLM agent should commit after the agent proposes an action and before execution. It encodes trusted and external observations, the proposed action, and an alternative into provenance-typed memory, uses role‑specific queries to relate them, and commits the action with the highest calibrated value learned from outcomes. In four agent security tasks, PROVISO outperforms all baselines in both security and utility, improving F1 by 13.84 points on SkillsBench and 7.07 points on ToolSafe, and achieving 88–99 F1 on three additional skill detection benchmarks.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Aug 28

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

The paper introduces SARA, a framework that separates action induction from runtime authorization in tool‑augmented LLM agents. By treating these as distinct roles, SARA uses an Action Probe to record action provenance and only authorizes tool calls that align with the user objective and past successful executions. Experiments on AgentDojo and AgentDyn show that SARA reduces action‑to‑side‑effect risk to below 0.63% while preserving task performance.

By Xiaokun Guo, Zhen Xu, Dongdong Huo, Yanqiu Zhang, Wei Wang, Qinfu Yang, Dongjin Yu, Yu Wang
llmsagentsmultimodal
More like this →
arXiv AI
Oct 2

PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents

The paper introduces PACE, a Provenance-Aware Capability Enforcement system designed to secure tool-using large language model agents by mediating every tool call before execution. PACE employs path confinement to limit influence paths and verifies effects against authenticated authority, distinguishing certified execution contracts from evaluated configurations. Experiments on eight agent‑security benchmarks show that the evaluated configuration reduces attack success in most cases while maintaining near‑native utility.

By Fengpeng Li, Qizhou Wang, Yuke Hu, Kemou Li, Jun Liu, Haiwei Wu, Jiantao Zhou, Di Wang
llmsagentsbenchmarks
More like this →