PRISM paper cuts LLM agent tool privileges using causal roles
Original title: PRISM: Causal Counterfactual Minimization of Agent Tool Privileges via Information Bottleneck Role Induction
On AgentDojo, tau-bench and ToolEmu, authors report 78.3% fewer tools per role and a 15.9% blast radius.
The paper proposes PRISM to limit over-authorization when LLM agents receive full tool privileges through the Model Context Protocol. It treats tool necessity as a causal question, learns it with sandbox interventions, compresses trajectories with an information bottleneck, and prunes roles through a Stackelberg game sampled by a generative flow network. On AgentDojo, tau-bench and ToolEmu, the authors report 78.3% fewer authorized tools per role, 78.2% task success, 88.7% counterfactual necessity accuracy, and a 15.9% blast radius.
Unconfirmed: Compression, success, accuracy, and blast-radius figures are author-reported benchmark results.
- Role count is chosen at the knee of the rate-distortion curve.
- Privilege pruning is cast as a bilevel Stackelberg game.
- A generative flow network samples diverse near-optimal role solutions.
- Evaluated on AgentDojo, tau-bench, and ToolEmu.
From the original article
1 min read at arxiv.orgThis paper shifts the object of role engineering from human users to large language model (LLM) agents, and proposes PRISM to address the over-authorization that arises when an agent obtains full tool privileges through the Model Context Protocol (MCP).
By Yang Luo · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.