Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.27620

Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Anmol Pandey·Aditya Jain·Liang Chen·Carsten Maple
View original source ↗Read source document ↗Export metadata ↓

Abstract

Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation. We characterize CAFs along two axes, expressiveness (single-trace safety versus relational k-safety) and observability (a ladder of monitor profiles). Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false alarm detects none of them, independent of the underlying model or decision procedure; they become visible only under cross-execution monitoring, which none of the six guardrails we survey implements. We make this constructive with AL-SYNTH, a SAT/SMT synthesizer (using no language model) that emits minimal CAF witnesses, each checked against an exhaustive oracle. The empirical signature is sharp: across nine LLM judges the per-action view approves the synthesized witness almost without exception, blocking it at a rate comparable to a benign control, yet the same models flag it when shown the two executions together. Per-action authorization is therefore structurally insufficient for relational policy conjuncts not reducible to single-trace safety: to bound them, a monitor must compare executions or accept false alarms.

Explore related subjects

cs.CRcs.AIcs.LO

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple. 2026-10-20. Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents. https://arxiv.org/abs/2610.27620

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

SweepMark: Query-Free and High-Fidelity Attacks on Robust Audio Watermarking

Audio watermarking embeds imperceptible signals into speech to trace misuse in text-to-speech (TTS) synthesis. Existing removal attacks may retain watermark-related artifacts or degrade speech quality when suppressing them. We propose SweepMark, a query-free black-box attack that targets these artifacts without access to target watermarking models or paired clean and watermarked samples. Our key insight is that watermark embedding introduces spectral patterns that are not fully aligned with natural speech, including persistent structures that conventional speech enhancement may retain. Diverse Artifact Learning extracts complementary stationary and non-stationary patterns, using customized spectral artifacts added to public speech to learn persistent structures without target watermark examples. Adaptive Artifact Scaling then combines and amplifies these patterns for subtraction while constraining distortion. Across two speech datasets and four watermarking methods, SweepMark achieves average attack success rates of 92% and 96%, with higher perceptual quality scores overall than the evaluated adaptive attacks. Automatic speech recognition evaluation indicates that linguistic content is largely preserved. Further experiments with three TTS systems show high attack success against two synthesis-resistant watermarking methods in speech generated after fine-tuning on attacked recordings.

cs.CR↗
arXiv2026

CoSec: Benchmarking Agent Security in Communities

LLM agents operate in persistent collaborative environments involving multiple users, communities, memories, files, and tools. Community boundaries may remain fixed or evolve with changes in membership, roles, composition, and relationships. Agents must complete legitimate tasks and prevent unauthorized disclosure of protected information. Existing evaluations do not fully examine these risks in agent systems. We introduce \textbf{CoSec}, an executable benchmark for evaluating privacy and authorization enforcement in LLM agent systems operating within and across communities. CoSec contains 208 canonical scenarios spanning fixed and evolving boundaries, protected information belonging to the agent owner or other participants, and attacks through dialogue, environmental content, persistent memory, and composed workflows. CoSec executes complete agent systems with persistent sessions, memory, files and tools. It verifies information flows against the active authorization state using execution traces and artifacts. Across harness and model configurations, agents frequently complete benign tasks but violate privacy and authorization boundaries. Privacy behavior varies across harnesses, attack surfaces, and community states, revealing how memory, files, tools, and workflows can carry protected information beyond its authorized scope. These findings show that task utility does not imply privacy or authorization compliance and that authorization in community settings remains an unresolved security challenge for persistent LLM agents.

cs.CR↗
arXiv2026

Beyond Tokens: NumAnchor for Address-Grounded Numeric Operand Representation in Assembly Language Models

Assembly language models (ALMs) are becoming important for automated binary analysis, yet their token-level interfaces often obscure numeric-like operands. In two corpora, such operands account for 45.7% and 40.9% of operand occurrences and may denote branch targets, global data, stack slots, constants, or unresolved pointer-derived values. Existing normalization strategies often lose their identities and structural relationships. We present NumAnchor, an input-boundary adapter that represents recoverable numeric-like operands as typed, canonicalized program entities. NumAnchor encodes code, data, and stack context in compact structural side descriptors, preserving entity identity and locality without increasing the host sequence length. These descriptors are fused into input embeddings before the first Transformer layer, while the host architecture, pretraining objectives, and downstream protocols remain unchanged. Probing frozen instruction-level embeddings yields 98.7% hierarchical-location accuracy and AUROC scores of 0.932 and 0.907 for jump and call target alignment, respectively, showing that the encoded structural information remains recoverable. Across multiple ALM families, NumAnchor achieves relative improvements of up to 35.0% in Recall@1 and 31.7% in MRR on 10k-candidate function retrieval, and improves execution-aware type recovery by up to 5.2 F1 points. Ablations show complementary gains from code, data, and stack descriptors with modest overhead.

cs.CR↗