PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
PACE checks provenance and authority before LLM agent tool calls and posts the lowest attack success on most benchmarks.
PACE is a defense for tool-using LLM agents that mediates every tool call immediately before execution, targeting influence from poisoned tool metadata, retrieved pages, memory, and reusable skills. Path confinement proposes an executable cut of influence paths, while effect verification checks schema-defined effects against authority from the authenticated request. On eight executable agent-security benchmarks across three model families, the evaluated configuration had strictly lowest attack success in 62 of 79 eligible columns and tied in 14, with full-benchmark utility losing at most three points. A reduced adaptive search succeeded on 0 of 30 out-of-authority targets.
- PACE mediates every tool call immediately before execution.
- Lowest attack success in 62 of 79 columns; ties in 14.
- Native utility drops by at most three points versus undefended agents.
- Adaptive search succeeded on 0 of 30 out-of-authority targets.
From the original article
1 min read at arxiv.orgTool-using large language model (LLM) agents turn generated text into real side effects, so poisoned tool metadata, retrieved pages, memory, and reusable skills can steer the next call. Vetting an artifact before admission does not settle this. A safe variant and a leaking variant can produce the same admission evidence, and a sound gate then cannot relax that site for either.
By Fengpeng Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.