{"id":"https://openalex.org/W7160999798","doi":"https://doi.org/10.48550/arxiv.2605.11039","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","display_name":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","publication_year":2026,"publication_date":"2026-05-11","ids":{"openalex":"https://openalex.org/W7160999798","doi":"https://doi.org/10.48550/arxiv.2605.11039"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.11039","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11039","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.11039","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136055587","display_name":"Linfeng Fan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fan, Linfeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136074843","display_name":"Ziwei Li","orcid":"https://orcid.org/0000-0001-5907-2939"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Ziwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136028873","display_name":"Yuan Tian","orcid":"https://orcid.org/0000-0001-6057-8101"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tian, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136085104","display_name":"YICHEN WANG","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Yichen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136065184","display_name":"Rongsheng Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Rongsheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136079119","display_name":"Xiong Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Xiong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.7497000098228455,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.7497000098228455,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.05620000138878822,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.030799999833106995,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/bottleneck","display_name":"Bottleneck","score":0.583299994468689},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.5745000243186951},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5501000285148621},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4925999939441681},{"id":"https://openalex.org/keywords/oracle","display_name":"Oracle","score":0.45649999380111694},{"id":"https://openalex.org/keywords/enforcement","display_name":"Enforcement","score":0.4250999987125397},{"id":"https://openalex.org/keywords/granularity","display_name":"Granularity","score":0.424699991941452},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.4059999883174896},{"id":"https://openalex.org/keywords/forcing","display_name":"Forcing (mathematics)","score":0.39579999446868896},{"id":"https://openalex.org/keywords/false-positives-and-false-negatives","display_name":"False positives and false negatives","score":0.3718999922275543}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7415000200271606},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5921000242233276},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.583299994468689},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.5745000243186951},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5501000285148621},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4925999939441681},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.45649999380111694},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.4250999987125397},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.424699991941452},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.4059999883174896},{"id":"https://openalex.org/C197115733","wikidata":"https://www.wikidata.org/wiki/Q1003136","display_name":"Forcing (mathematics)","level":2,"score":0.39579999446868896},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.3718999922275543},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.35670000314712524},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.3528999984264374},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.33719998598098755},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.33399999141693115},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.326200008392334},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.32280001044273376},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.31610000133514404},{"id":"https://openalex.org/C2780049196","wikidata":"https://www.wikidata.org/wiki/Q23582628","display_name":"Provenance","level":2,"score":0.3075000047683716},{"id":"https://openalex.org/C72648740","wikidata":"https://www.wikidata.org/wiki/Q658476","display_name":"Public key infrastructure","level":4,"score":0.3043999969959259},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.29989999532699585},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.2978000044822693},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.2906999886035919},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2903999984264374},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.28769999742507935},{"id":"https://openalex.org/C159023740","wikidata":"https://www.wikidata.org/wiki/Q623276","display_name":"Deadlock","level":2,"score":0.28439998626708984},{"id":"https://openalex.org/C70437156","wikidata":"https://www.wikidata.org/wiki/Q7228652","display_name":"Pooling","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.27459999918937683},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.2702000141143799},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2632000148296356},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.2599000036716461},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.2549999952316284}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.11039","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11039","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.11039","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11039","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7342698574066162,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Tool-using":[0],"LLM":[1],"agents":[2],"must":[3],"act":[4],"on":[5,130,155],"untrusted":[6,75],"webpages,":[7],"emails,":[8],"files,":[9],"and":[10,45,55,109,127,180,192,201],"API":[11],"outputs":[12],"while":[13,134,160],"issuing":[14],"privileged":[15],"tool":[16,29,101],"calls.":[17],"Existing":[18],"defenses":[19],"often":[20],"mediate":[21],"trust":[22,118],"at":[23,169],"the":[24,53,156,170,194],"granularity":[25],"of":[26],"an":[27,84],"entire":[28],"invocation,":[30],"forcing":[31],"a":[32,43,93],"brittle":[33],"choice":[34],"in":[35,78],"mixed-trust":[36,131],"workflows:":[37],"allow":[38],"external":[39],"content":[40,76],"to":[41,100,198],"influence":[42],"call":[44,54],"risk":[46],"hijacked":[47],"destinations":[48],"or":[49,51,141],"commands,":[50],"quarantine":[52],"block":[56],"benign":[57],"retrieval-then-act":[58],"behavior.":[59],"The":[60],"key":[61],"observation":[62],"behind":[63],"this":[64],"paper":[65],"is":[66],"that":[67,96,176],"indirect":[68],"prompt":[69],"injection":[70],"becomes":[71],"dangerous":[72],"not":[73],"when":[74,81],"appears":[77],"context,":[79],"but":[80],"it":[82],"determines":[83],"authority-bearing":[85],"argument.":[86],"We":[87],"present":[88],"\\textsc{PACT}":[89,123,151,185],"(\\emph{Provenance-Aware":[90],"Capability":[91],"Contracts}),":[92],"runtime":[94],"monitor":[95],"assigns":[97],"semantic":[98,178],"roles":[99,179],"arguments,":[102],"tracks":[103],"value":[104],"provenance":[105,182,199],"across":[106,148],"replanning":[107],"steps,":[108],"checks":[110],"whether":[111],"each":[112],"argument's":[113],"origin":[114],"satisfies":[115],"its":[116],"role-specific":[117],"contract.":[119],"Under":[120],"oracle":[121],"provenance,":[122],"achieves":[124],"100\\%":[125,128,153],"utility":[126],"security":[129,154,172,188],"diagnostic":[132],"suites,":[133],"flat":[135],"invocation-level":[136],"monitors":[137],"incur":[138],"false":[139,142],"positives":[140],"negatives.":[143],"In":[144],"full":[145],"AgentDojo":[146],"deployments":[147],"five":[149],"models,":[150],"reaches":[152],"three":[157],"strongest":[158],"models":[159],"recovering":[161],"38.1--46.4\\%":[162],"utility,":[163],"8--16":[164],"percentage":[165],"points":[166],"above":[167],"CaMeL":[168],"same":[171],"level.":[173],"Ablations":[174],"show":[175],"both":[177],"cross-step":[181],"are":[183],"necessary.":[184],"reframes":[186],"agent":[187],"as":[189],"authority":[190],"binding,":[191],"isolates":[193],"remaining":[195],"deployment":[196],"bottleneck":[197],"inference":[200],"contract":[202],"synthesis.":[203]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-14T00:00:00"}