CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.
The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.
- Identifies security-context discontinuity: individually correct controls fail when composed end to end.
- Carries authenticated context via signed root grants, provenance commitments, and effect-bound execution permits.
- Full configuration committed no harmful effects across 2,560 attack instances, completing all 700 benign tasks.
- Products
- CONTINUITY
From the original article
1 min read at arxiv.orgLLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries.
By Chris Zheng · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.