Study tests how labels and memory change LLM agent envelope defenses
Original title: The Envelope Layer: An Underestimated Surface of LLM Agent Defense
Authentic strong labels cut semantic breaches, but forged envelopes and prior success memory can erase that gain.
A paper evaluates the envelope layer of LLM agent defenses using the A2A-TIBA attack, semantic breach rate, and the A/B/C/D outcome taxonomy. Authentic strong labels consistently lowered breaches, while weak labels were not reliably better than an unlabeled baseline. When envelopes could be forged, strong-label benefits weakened and varied by frontend. Memory mattered more than labels: success memory raised breaches and failure memory lowered them.
Unconfirmed: Findings come from the authors' factorial and memory experiments, not from reported real-world incidents.
- Strong labels helped only when the envelope was authentic.
- Forged envelopes made strong-label benefits frontend-dependent.
- Success memory raised the semantic breach rate.
- Most mixed success-and-failure memories returned to the no-memory baseline.
- The authors split the envelope into admission and context-assembly surfaces.
From the original article
1 min read at arxiv.orgPrior work framed the envelope layer as the channel through which malicious content enters an agent, and established it as a defense surface independent of the LLM layer and the agent layer; however, that work only tested the envelope layer briefly and did not examine how label strength, envelope authenticity, scaffold differences, or existing memories affect defense effectiveness.
By Yuelin Han · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.