AgentFlow clamps data flows in LLM agent pipelines

Problem

The paper studies how sensitive or untrusted data can flow across multiple steps in LLM agent systems and cause harm even when individual actions appear legitimate. Modern agents plan, call tools, read private data, and delegate to sub-agents, creating multi-hop exfiltration, trust-laundering, and unsafe delegation risks that request-level authorization alone cannot express or prevent. The work focuses on policy-visible, mediated behaviours such as tool calls, delegated actions and modeled response sinks rather than on jailbreaks, hallucinations, covert channels or unmediated component compromises.

Approach

AgentFlow is a flow-centric policy language and enforcement framework that places a runtime reference monitor between agents and their tools and a bounded SMT-based verifier for pre-deployment checks. Policies are written over labeled runtime edges and the provenance graph. Labels are triples of sensitivity, category set and trust; labels propagate through edges using declared propagation modes (direct, transformation/sanitisation, opaque, or constant replacement). The language supports per-hop flow rules, temporal path rules over lineage or session traces, task-scoped capabilities, controlled release, field-level taint, and optional runtime scanners to upgrade labels. The reference monitor constructs candidate execution steps for intercepted tool invocations, resolves input labels from fields and lineage, applies propagation semantics, evaluates flow and path clauses, and returns Allow, Deny or Pause. A bounded SMT verifier encodes executions of length at most k symbolically to check safety properties and produce counterexample traces when a violation is possible. The prototype is implemented in Python and integrated into agent frameworks for benchmark evaluation.

Key Findings

• Concrete mitigation: On 949 injected AgentDojo cases, AgentFlow reduced confirmed compromise from 33.0% to 0.0% and increased aggregate utility from 46.7% to 63.3% under a fixed model configuration.
• Generalisation: On a 200-case AgentDyn Dailylife run, it reduced confirmed compromise from 73.5% to 0.0% while preserving near-baseline utility (44.5% to 43.5%).
• Breadth and blocking: Replay checks across ASB, InjecAgent, BIPIA, AgentHarm and MCPTox indicate the configured policies block the benchmark-specified policy-visible attacker flows; in ASB’s upstream direct-prompt-injection harness attack success was 0 out of 1,200.
• Verification and diagnostics: The SMT-based verifier caught all 12 seeded unsafe policy variants and verified seven safety properties in under 0.5 seconds each using a bounded trace bound k=10.
• Operational cost: Core per-intercept policy decision latency is negligible relative to LLM inference (average 6.4 microseconds, P95 8.7 microseconds).

Limitations

The guarantee of the SMT verifier is bounded by the verifier’s abstraction and execution length; it does not cover arbitrary unbounded LLM behaviour. AgentFlow addresses only policy-visible, mediated flows and assumes a trusted runtime and modelled sinks. Overtainting is a practical limitation in message-heavy workflows because token-level dependencies are not recovered. The runtime relies on explicit release contexts and scoped capabilities; missing releases can block legitimate dynamic tasks. Runtime scanners are conservative label upgraders and false negatives are outside formal guarantees. Covert channels, unmediated bugs or compromises, and semantic correctness of allowed calls are out of scope.

Implications

From an offensive-security viewpoint, attackers who control external content, supply malicious tools, or compromise sub-agents can craft multi-step sequences that combine legitimate reads and writes to exfiltrate sensitive data. AgentFlow demonstrates that expressing and enforcing flow and path constraints can block such multi-hop exfiltration patterns and detect policy-authoring mistakes before deployment. However, attackers may still exploit avenues outside the model such as bypassing the monitor, exploiting covert channels, or inducing risky behaviour that does not trigger a modelled sink. AgentFlow is therefore most useful for threat modelling, penetration testing and hardening of the policy-visible attack surface in agent ecosystems.