{"id":"https://openalex.org/W7204807916","doi":"https://doi.org/10.21203/rs.3.rs-10889863/v1","title":"Capability-Mediated Perimeters for Secure AI Agent Tool Execution: Conditional Non-Escalation Invariants and Empirical Evaluation Against Indirect Prompt Injection","display_name":"Capability-Mediated Perimeters for Secure AI Agent Tool Execution: Conditional Non-Escalation Invariants and Empirical Evaluation Against Indirect Prompt Injection","publication_year":2026,"publication_date":"2026-09-02","ids":{"openalex":"https://openalex.org/W7204807916","doi":"https://doi.org/10.21203/rs.3.rs-10889863/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-10889863/v1","doi":"https://doi.org/10.21203/rs.3.rs-10889863/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10889863/v1","pdf_url":"https://www.researchsquare.com/article/rs-10889863/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-10889863/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148621879","display_name":"Rudraneel Das","orcid":"https://orcid.org/0009-0009-6173-0262","observed_orcids":["https://orcid.org/0009-0009-6173-0262"]},"institutions":[{"id":"https://openalex.org/I170979836","display_name":"Jadavpur University","ror":"https://ror.org/02af4h012","country_code":"IN","type":"education","lineage":["https://openalex.org/I170979836"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Rudraneel Das","raw_affiliation_strings":["Jadavpur University"],"raw_orcid":"https://orcid.org/0009-0009-6173-0262","affiliations":[{"raw_affiliation_string":"Jadavpur University","institution_ids":["https://openalex.org/I170979836"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5148621879"],"corresponding_institution_ids":["https://openalex.org/I170979836"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5435000061988831,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5435000061988831,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.4413999915122986,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.008200000040233135,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.6129999756813049},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.7289999723434448},{"id":"https://openalex.org/keywords/capability-based-security","display_name":"capability-based security","score":0.6340000033378601},{"id":"https://openalex.org/keywords/reference-monitor","display_name":"reference monitor","score":0.593999981880188},{"id":"https://openalex.org/keywords/least-privilege","display_name":"least privilege","score":0.7250000238418579},{"id":"https://openalex.org/keywords/data-exfiltration","display_name":"data exfiltration","score":0.6299999952316284},{"id":"https://openalex.org/keywords/ai-agent-security","display_name":"AI agent security","score":0.5049999952316284},{"id":"https://openalex.org/keywords/model-context-protocol","display_name":"Model Context Protocol","score":0.5440000295639038},{"id":"https://openalex.org/keywords/trusted-computing-base","display_name":"trusted computing base","score":0.5149999856948853},{"id":"https://openalex.org/keywords/enterprise-ai-security","display_name":"enterprise AI security","score":0.3720000088214874}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7534999847412109},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.5123000144958496},{"id":"https://openalex.org/C147346212","wikidata":"https://www.wikidata.org/wiki/Q5492632","display_name":"Trusted computing base","level":4,"score":0.48809999227523804},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4875999987125397},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4431000053882599},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.4422000050544739},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3799000084400177},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37529999017715454},{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.35929998755455017},{"id":"https://openalex.org/C190470478","wikidata":"https://www.wikidata.org/wiki/Q2370229","display_name":"Invariant (physics)","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.33739998936653137},{"id":"https://openalex.org/C150202949","wikidata":"https://www.wikidata.org/wiki/Q107602","display_name":"Pointer (user interface)","level":2,"score":0.3343999981880188},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.320499986410141},{"id":"https://openalex.org/C171018156","wikidata":"https://www.wikidata.org/wiki/Q7370306","display_name":"Rotation formalisms in three dimensions","level":2,"score":0.30230000615119934},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.29269999265670776},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2802000045776367},{"id":"https://openalex.org/C2780012671","wikidata":"https://www.wikidata.org/wiki/Q1343870","display_name":"Corollary","level":2,"score":0.27549999952316284},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.27469998598098755},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.2660999894142151},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C204806902","wikidata":"https://www.wikidata.org/wiki/Q2333581","display_name":"Semantic security","level":5,"score":0.25060001015663147}],"mesh":[],"locations_count":24,"locations":[{"id":"doi:10.21203/rs.3.rs-10889863/v1","doi":"https://doi.org/10.21203/rs.3.rs-10889863/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10889863/v1","pdf_url":"https://www.researchsquare.com/article/rs-10889863/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},{"id":"doi:10.5281/zenodo.22179415","doi":"https://doi.org/10.5281/zenodo.22179415","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22179415","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22179416","doi":"https://doi.org/10.5281/zenodo.22179416","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22179416","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22179605","doi":"https://doi.org/10.5281/zenodo.22179605","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22179605","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181445","doi":"https://doi.org/10.5281/zenodo.22181445","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181445","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181562","doi":"https://doi.org/10.5281/zenodo.22181562","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181562","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181719","doi":"https://doi.org/10.5281/zenodo.22181719","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181719","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181792","doi":"https://doi.org/10.5281/zenodo.22181792","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181792","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181828","doi":"https://doi.org/10.5281/zenodo.22181828","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181828","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22181867","doi":"https://doi.org/10.5281/zenodo.22181867","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22181867","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22182182","doi":"https://doi.org/10.5281/zenodo.22182182","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22182182","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22182326","doi":"https://doi.org/10.5281/zenodo.22182326","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22182326","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22182355","doi":"https://doi.org/10.5281/zenodo.22182355","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22182355","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22206627","doi":"https://doi.org/10.5281/zenodo.22206627","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22206627","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22463320","doi":"https://doi.org/10.5281/zenodo.22463320","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22463320","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22501491","doi":"https://doi.org/10.5281/zenodo.22501491","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22501491","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22817295","doi":"https://doi.org/10.5281/zenodo.22817295","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22817295","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22817836","doi":"https://doi.org/10.5281/zenodo.22817836","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22817836","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22817882","doi":"https://doi.org/10.5281/zenodo.22817882","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22817882","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22818063","doi":"https://doi.org/10.5281/zenodo.22818063","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22818063","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22818379","doi":"https://doi.org/10.5281/zenodo.22818379","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22818379","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22818886","doi":"https://doi.org/10.5281/zenodo.22818886","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22818886","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22832871","doi":"https://doi.org/10.5281/zenodo.22832871","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22832871","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.22895043","doi":"https://doi.org/10.5281/zenodo.22895043","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22895043","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-10889863/v1","doi":"https://doi.org/10.21203/rs.3.rs-10889863/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10889863/v1","pdf_url":"https://www.researchsquare.com/article/rs-10889863/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204807916.pdf","grobid_xml":"https://content.openalex.org/works/W7204807916.grobid-xml"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W1873763122","https://openalex.org/W1904738922","https://openalex.org/W1977764760","https://openalex.org/W1995945562","https://openalex.org/W2084413241","https://openalex.org/W2094873755","https://openalex.org/W2095881341","https://openalex.org/W2117489143","https://openalex.org/W2136296832","https://openalex.org/W2147929033","https://openalex.org/W2342083136","https://openalex.org/W2473418344","https://openalex.org/W2535690855","https://openalex.org/W2736601468","https://openalex.org/W2963351448","https://openalex.org/W4309395891","https://openalex.org/W4385019259","https://openalex.org/W4385374425","https://openalex.org/W4386555960","https://openalex.org/W4387725416","https://openalex.org/W4388886073","https://openalex.org/W4389518965","https://openalex.org/W4389713766","https://openalex.org/W4389984066","https://openalex.org/W4391871694","https://openalex.org/W4395064792","https://openalex.org/W4402670146","https://openalex.org/W4402952666","https://openalex.org/W4405655184","https://openalex.org/W4406231153","https://openalex.org/W4416549384","https://openalex.org/W7143279223"],"related_works":["https://openalex.org/W7204964789","https://openalex.org/W7204690097","https://openalex.org/W7202132333","https://openalex.org/W7214576473","https://openalex.org/W7171371499","https://openalex.org/W7134839784","https://openalex.org/W7172000952","https://openalex.org/W7223512052","https://openalex.org/W7203949808","https://openalex.org/W7214974942"],"abstract_inverted_index":{"Abstract":[0],"Autonomous":[1],"artificial":[2],"intelligence":[3],"agents":[4,60],"executing":[5,45],"over":[6,20,133,151],"extensible":[7],"tool":[8,139],"interfaces":[9],"(such":[10],"as":[11,64,74,85,145,323],"Anthropic's":[12],"Model":[13],"Context":[14],"Protocol)":[15],"operate":[16],"with":[17,216,241,284],"ambient":[18],"authority":[19,94],"connected":[21],"tools.":[22],"Because":[23],"autoregressive":[24],"Transformers":[25],"ingest":[26],"instructions":[27],"and":[28,110,122,183,220,270,334],"untrusted":[29,67],"third-party":[30,335],"data":[31],"within":[32],"a":[33,75,86],"single":[34],"homogeneous":[35],"context":[36],"window,":[37],"adversarial":[38,336],"observations":[39],"can":[40],"manipulate":[41],"the":[42,81,91,134,152,190,199,217],"model":[43,83],"into":[44],"unintended":[46],"privileged":[47],"actions\u2014the":[48],"classic":[49],"Confused":[50],"Deputy":[51],"problem.":[52],"In":[53,168,222],"this":[54],"paper,":[55],"we":[56],"argue":[57],"that":[58],"LLM":[59],"should":[61],"be":[62],"treated":[63],"potentially":[65],"compromised,":[66],"principals":[68],".":[69,95],"We":[70,157],"present":[71],"Mastyf":[72,223,318],"Guard":[73,224,319],"deterministic-first":[76],"security":[77,93,328],"architecture":[78],"in":[79,202],"which":[80],"neural":[82,252,262],"functions":[84],"semantic":[87],"fallback":[88,253],"rather":[89],"than":[90],"final":[92],"Tool":[96],"dispatch":[97],"is":[98,321],"governed":[99],"by":[100,306],"an":[101,249,300,324],"external":[102],"reference":[103],"monitor":[104,304],"enforcing":[105],"complete":[106,129],"mediation,":[107],"least":[108],"privilege,":[109],"four":[111],"typed":[112],"relational":[113,234],"argument":[114],"invariants":[115],"(destination":[116],"containment,":[117],"scope":[118],"boundedness,":[119],"privilege":[120],"monotonicity,":[121],"aggregate":[123],"monetary":[124],"clamping).":[125],"Under":[126],"stated":[127],"reference-monitor":[128],"mediation":[130],"axioms":[131],"(A1\u2013A6)":[132],"trusted":[135],"computing":[136],"base,":[137],"out-of-scope":[138],"execution":[140],"has":[141],"zero":[142],"probability":[143],"(formalized":[144],"Theorem":[146],"1:":[147],"Conditional":[148],"Non-Escalation":[149],"Invariant":[150],"Trusted":[153],"Computing":[154],"Base":[155],").":[156],"report":[158],"two":[159],"distinct":[160],"experimental":[161],"benchmarks":[162],"to":[163],"avoid":[164],"architectural":[165],"conflation:":[166],"(1)":[167],"historical":[169],"v1":[170],"macro":[171],"evaluation":[172,226],"across":[173,227,274],"50,000":[174],"balanced":[175,229],"instances":[176,231],"(25,000":[177],"academic":[178],"attacks":[179,197,240],"from":[180],"InjecAgent,":[181],"BIPIA,":[182],"Garak":[184],"vs.":[185],"25,000":[186],"authentic":[187],"developer":[188],"traces),":[189],"baseline":[191],"capability":[192],"perimeter":[193],"filtered":[194],"82.40%":[195],"of":[196,239,256,312],"at":[198,208,244],"transport":[200],"boundary":[201],"0.003":[203],"ms,":[204],"reaching":[205],"99.33%":[206],"recall":[207],"0.005":[209],"ms":[210],"amortized":[211],"fast-path":[212],"overhead":[213],"when":[214],"paired":[215],"initial":[218],"classifier;":[219],"(2)":[221],"2.0":[225,320],"3,000":[228],"enterprise":[230,277],",":[232],"deterministic":[233],"leaf-walking":[235],"alone":[236],"catches":[237],"75.00%":[238],"0.00%":[242,271,288],"FPR":[243,273],"17.3":[245],"\u03bcs":[246],"latency,":[247],"while":[248],"evidence-conditioned":[250],"1.5B":[251],"recovers":[254],"475":[255],"500":[257],"structural":[258],"misses":[259],"(":[260],"V":[261],"=":[263,287],"95.0%),":[264],"yielding":[265],"97.50%":[266],"net":[267],"hybrid":[268],"coverage":[269],"observed":[272],"2,000":[275],"benign":[276],"operations":[278],"(Wilson":[279],"95%":[280],"CI:":[281],"[0.00%,":[282],"0.19%])":[283],"P":[285],"(fallback)":[286],"on":[289],"routine":[290],"traffic.":[291],"For":[292],"cross-tool":[293],"exfiltration":[294],"where":[295],"target":[296],"sinks":[297],"are":[298],"authorized,":[299],"explicit-flow":[301],"dynamic":[302],"taint":[303],"inspired":[305],"DIFC":[307],"(Theorem":[308],"2)":[309],"intercepted":[310],"100%":[311],"1,152":[313],"evaluated":[314,326],"cases":[315],"without":[316],"leaks.":[317],"scoped":[322],"empirically":[325],"pre-production":[327],"architecture;":[329],"broader":[330],"independent":[331],"live-agent,":[332],"production-environment,":[333],"validation":[337],"remain":[338],"outstanding.":[339]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-09-01T00:00:00"}