Intent-graph audit checks agent tool calls without a per-call model
Original title: Least-Privilege Auditing of Agent Tool Calls with Intent Graphs and Reasoning-Guided Escalation
A deterministic loop checks each call in a median 5.7 microseconds, and flagged calls go to a reasoning guardian.
The paper proposes a runtime audit that builds an executable intent graph from the user objective and tool catalog with one model call per task. Later tool calls are checked by a deterministic loop. Lookups of the user's own state bypass the audit, while remaining flagged calls escalate to a reasoning guardian that does not see tool outputs and may use a restricted Python-expression tool.
Unconfirmed: End-to-end validation remains open because the tested agent showed no baseline attack success.
- The target is indirect prompt injection hidden in tool outputs.
- Own-state lookups bypass the audit because harm is treated as a write or outward step.
- The guardian sees the objective, plan, call history and flagged call.
- End-to-end validation is open after no baseline attack success on the tested agent.
From the original article
1 min read at arxiv.orgLLM agents that call tools are exposed to indirect prompt injection: instructions hidden in tool outputs can steer an agent into calls the user never asked for. We present a runtime audit that derives an executable intent graph from the user's objective and the deployment's tool catalog with one LLM call per task, and checks every tool call against it with a deterministic loop that makes no LLM call (median 5.
By Doron Shavit · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.