Plan-First IFC Locks Down Persistent LLM Agents

Problem

The paper studies security for persistent large language model agents that plan, call external tools, and retain state across multiple user queries. Untrusted webpages, documents, tool outputs and tool metadata can carry adversarial content that (1) influences control flow during planning, (2) becomes arguments to security-sensitive tools at execution, or (3) persists and becomes actionable in later queries. Existing defences that protect only planning or individual tool calls do not fully address these cross-query threats.

Approach

SPA is a plan-first architecture that generates a complete, executable plan once per user query in a restricted declarative domain-specific language. Plans make data and control dependencies explicit. SPA applies a dual-lattice information-flow control that tracks confidentiality and integrity labels through both explicit data flows and implicit control dependencies. Execution occurs only after static verification; the executor is a deterministic interpreter that cannot change the plan. Results are persisted as labelled artifacts split into three views: planner-visible metadata, sealed values, and stored labels. Later planners see metadata only; concrete values and their labels re-enter the session only during execution via explicit retrieve steps. SPA supports two planner modes: concrete (planner sees installed tool metadata) and abstract (planner synthesises abstract tool capabilities and a separate mapping stage binds them to installed tools after planning). Untrusted text is processed only by a quarantined LLM during execution; its outputs inherit input labels and cannot raise integrity or lower confidentiality.

Key Findings

• Dual-lattice IFC substantially reduces prompt-injection success under the evaluated attack: attack success falls to 0.0% on single-query AgentDojo and to 0.2% on multi-query AgentDojo-MQ under the tool_knowledge attack.
• Strong integrity enforcement imposes a utility cost: enabling IFC lowers baseline utility from 53.0% to 29.0% on AgentDojo and from 62.5% to 35.3% on AgentDojo-MQ in concrete planner mode.
• Label-preserving persistence maintains high reuse while hiding payloads: when a required producer artifact is available, later turns retrieve it in 95.4% of reuse opportunities without IFC and 89.9% with IFC (soft-hit reuse), with strict reuse around 80.1% in the best configuration.
• Abstract planning reduces exposure to malicious tool metadata but suffers frequent mapping failures: about 75% of abstract trials fail during abstract-to-concrete tool mapping, limiting execution coverage and utility.

Limitations

The evaluation is limited to AgentDojo and a constructed multi-query extension, so it does not exhaustively characterise persistence-specific attacks. The strict Biba-style integrity policy rejects many legitimate workflows that rely on externally sourced low-integrity data unless endorsements or finer-grained labelling are employed. SPA depends on trusted deployment configuration: lattices, per-tool policies and tool bindings are in the trusted computing base. The work excludes model-level jailbreaks and side channels below the trusted base.

Implications

From an offensive perspective, adversaries who control tool metadata, tool implementations, tool outputs or external ingested content can attempt three classes of attacks: cause malicious plans by biasing planning with crafted metadata, cause data-flow attacks by supplying attacker-controlled values to high-impact tools, or plant dormant payloads that later turn a benign-seeming interaction into a security breach. Persistence creates delayed planning and delayed execution attack paths: stored adversarial payloads may influence later planners or be retrieved as arguments to sensitive calls. SPA’s plan-first, label-preserving design curtails many of these avenues, but attackers can still exploit gaps where integrity checks are relaxed, where abstract-to-concrete mapping fails, or by designing attacks specifically targeting delayed persistence that were not fully exercised by the evaluated threat model.