{"id":"https://openalex.org/W7204948690","doi":"https://doi.org/10.48550/arxiv.2608.29942","title":"Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents","display_name":"Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents","publication_year":2026,"publication_date":"2026-08-30","ids":{"openalex":"https://openalex.org/W7204948690","doi":"https://doi.org/10.48550/arxiv.2608.29942"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.29942","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29942","pdf_url":"https://arxiv.org/pdf/2608.29942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.29942","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125570942","display_name":"Tanzim Ahad","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I164936912","display_name":"The University of Texas at El Paso","ror":"https://ror.org/04d5vba33","country_code":"US","type":"education","lineage":["https://openalex.org/I164936912"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ahad, Tanzim","raw_affiliation_strings":["Department of Computer Science , University of Texas at El Paso , TX , USA 79902"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Texas at El Paso , TX , USA 79902","institution_ids":["https://openalex.org/I164936912"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125552872","display_name":"Ismail Hossain","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I164936912","display_name":"The University of Texas at El Paso","ror":"https://ror.org/04d5vba33","country_code":"US","type":"education","lineage":["https://openalex.org/I164936912"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hossain, Ismail","raw_affiliation_strings":["Department of Computer Science , University of Texas at El Paso , TX , USA 79902"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Texas at El Paso , TX , USA 79902","institution_ids":["https://openalex.org/I164936912"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125505332","display_name":"Md Jahangir Alam","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Alam, Md Jahangir","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072307876","display_name":"Sai Puppala","orcid":"https://orcid.org/0009-0008-0334-5756","observed_orcids":["https://orcid.org/0009-0008-0334-5756"]},"institutions":[{"id":"https://openalex.org/I207123951","display_name":"New Mexico Institute of Mining and Technology","ror":"https://ror.org/005p9kw61","country_code":"US","type":"education","lineage":["https://openalex.org/I207123951"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Puppala, Sai","raw_affiliation_strings":["Department of Computer Science and Engineering , New Mexico Tech , Socorro , NM , USA 87801"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering , New Mexico Tech , Socorro , NM , USA 87801","institution_ids":["https://openalex.org/I207123951"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135554148","display_name":"Syed Bahauddin Alam","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alam, Syed Bahauddin","raw_affiliation_strings":["University of Illinois Urbana-Champaign , IL , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois Urbana-Champaign , IL , USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5014369148","display_name":"Sajedul Karim Talukder","orcid":"https://orcid.org/0000-0001-8054-9770","observed_orcids":["https://orcid.org/0000-0001-8054-9770"]},"institutions":[{"id":"https://openalex.org/I164936912","display_name":"The University of Texas at El Paso","ror":"https://ror.org/04d5vba33","country_code":"US","type":"education","lineage":["https://openalex.org/I164936912"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Talukder, Sajedul","raw_affiliation_strings":["Department of Computer Science , University of Texas at El Paso , TX , USA 79902"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science , University of Texas at El Paso , TX , USA 79902","institution_ids":["https://openalex.org/I164936912"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9003999829292297,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9003999829292297,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.05460000038146973,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.01899999938905239,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-guardrails","display_name":"LLM guardrails","score":0.6439999938011169},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.5040000081062317},{"id":"https://openalex.org/keywords/security-decision-making","display_name":"security decision-making","score":0.32499998807907104},{"id":"https://openalex.org/keywords/reference-construction","display_name":"reference construction","score":0.4129999876022339},{"id":"https://openalex.org/keywords/llama","display_name":"llamas","score":0.43799999356269836},{"id":"https://openalex.org/keywords/gemma","display_name":"Gemma","score":0.9959999918937683}],"concepts":[{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.6753000020980835},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.6674000024795532},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.614300012588501},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5722000002861023},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4772999882698059},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.45320001244544983},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.32440000772476196},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.31150001287460327},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.30720001459121704},{"id":"https://openalex.org/C2779019381","wikidata":"https://www.wikidata.org/wiki/Q3499564","display_name":"Relocation","level":2,"score":0.2978000044822693},{"id":"https://openalex.org/C126780896","wikidata":"https://www.wikidata.org/wiki/Q899871","display_name":"Distortion (music)","level":4,"score":0.28769999742507935},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2793000042438507},{"id":"https://openalex.org/C35651441","wikidata":"https://www.wikidata.org/wiki/Q625303","display_name":"Independence (probability theory)","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.2623000144958496}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.29942","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29942","pdf_url":"https://arxiv.org/pdf/2608.29942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.29942","doi":"https://doi.org/10.48550/arxiv.2608.29942","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.29942","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.29942","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.29942","pdf_url":"https://arxiv.org/pdf/2608.29942","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.833299994468689,"display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204948690.pdf","grobid_xml":"https://content.openalex.org/works/W7204948690.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7212428651","https://openalex.org/W7214974942","https://openalex.org/W7162791588","https://openalex.org/W7223512052","https://openalex.org/W7172000952","https://openalex.org/W7220154847","https://openalex.org/W7170461370","https://openalex.org/W7166722659","https://openalex.org/W7204807916","https://openalex.org/W7223214628"],"abstract_inverted_index":{"The":[0],"key":[1],"limitation":[2,51],"of":[3,56,194,208],"current":[4],"state-of-the-art":[5],"influence-based":[6],"guardrails":[7],"is":[8,162,166],"that":[9,125,214,233],"they":[10],"do":[11],"not":[12,185],"reliably":[13,225],"distinguish":[14],"a":[15,20,83,91,135,157],"legitimate,":[16],"user-authorized":[17],"action":[18,23,97,223,229],"from":[19,60,87],"malicious,":[21],"unauthorized":[22,122,188,195],"when":[24],"both":[25,116],"rely":[26],"on":[27],"external":[28],"tool":[29,93],"information.":[30],"This":[31],"ambiguity":[32],"can":[33],"cause":[34],"benign":[35,132],"actions":[36,189],"to":[37,240],"trigger":[38],"unnecessary":[39],"verification":[40],"and":[41,45,75,118,164,171,232,236],"intervention,":[42],"reducing":[43],"utility":[44,165],"adding":[46],"latency.":[47],"We":[48],"expose":[49],"this":[50,100,150],"through":[52,153],"an":[53,222],"authorization-equivalence":[54],"audit":[55],"96":[57],"conditions":[58],"derived":[59],"24":[61,113],"base":[62],"cases.":[63],"Within":[64],"matched":[65,187],"source":[66],"comparisons,":[67],"we":[68],"hold":[69],"authorization,":[70],"the":[71,88,96,104,108,126,131,141,201,215,228,241],"exact":[72],"committed":[73],"action,":[74],"its":[76],"intended":[77],"effect":[78],"fixed,":[79],"changing":[80],"only":[81],"whether":[82,227],"required":[84],"value":[85],"comes":[86],"user":[89],"or":[90],"legitimate":[92],"result.":[94],"Although":[95],"remains":[98,128],"unchanged,":[99],"harmless":[101,181],"relocation":[102,133],"shifts":[103],"causal":[105,217],"signal":[106,127,218],"toward":[107],"attack":[109,160],"region":[110],"in":[111,144],"all":[112],"cases":[114],"under":[115],"Llama":[117],"Gemma":[119],"scorers.":[120],"Matched":[121],"controls":[123],"show":[124,213],"attack-sensitive,":[129],"yet":[130,183],"produces":[134],"larger":[136],"average":[137],"score":[138],"shift":[139],"than":[140],"actual":[142],"change":[143],"authorization.":[145],"Architecture-level":[146],"evaluation":[147],"shows":[148],"how":[149],"mismatch":[151],"propagates":[152],"guardrail":[154,177],"designs.":[155],"With":[156],"semantic":[158],"monitor,":[159],"success":[161],"0%":[163],"28%,":[167],"compared":[168,205],"with":[169,206],"16%":[170],"60%":[172],"without":[173,224],"it.":[174],"A":[175],"shadow-based":[176],"allows":[178],"every":[179],"tested":[180],"run,":[182],"does":[184],"reject":[186],"more":[190],"often":[191],"overall:":[192],"57.5%":[193],"runs":[196],"pass":[197],"automatically":[198],"before":[199],"reaching":[200],"later":[202],"security":[203,243],"check,":[204],"29.2%":[207],"authorized":[209],"runs.":[210],"These":[211],"results":[212],"studied":[216],"reveals":[219],"what":[220],"shaped":[221],"encoding":[226],"was":[230],"authorized,":[231],"reference":[234],"construction":[235],"routing":[237],"are":[238],"integral":[239],"effective":[242],"decision.":[244]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-09-02T00:00:00"}