Research map / Multi-agent systems and games / LLM agents

Securing AI Agents with Information-Flow Control

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FIDES, an information-flow-control agent planner with selective hiding of tool results in variables and a quarantined LLM with typed outputs, enforcing integrity and confidentiality policies deterministically, evaluated on AgentDojo.

Problem

Prompt injection attacks on tool-using LLM agents lack strong guarantees; it is unclear what security guarantees IFC can provide for agent planners and what tasks can be completed securely.

Approach

Combine dynamic taint-tracking of confidentiality/integrity labels with selective hiding of low-integrity tool results in variables, and a quarantined LLM whose constrained output types are folded into labels so low-capacity outputs can influence planning; policies P-T (trusted action) and P-F (permitted flow) are enforced deterministically.

Key results

• With policy checks, FIDES stops all policy-violating attacks in AgentDojo; gpt-4o ASR drops from 163 successful injections (Basic) to 24 without checks for FIDES, and 1 with checks.
• With policy checks and reasoning models, FIDES outperforms the Basic planner in task completion by up to 16.7% (o1).
• Prompt and interface tuning improves FIDES task completion by 8.2% absolute and about 24% over Basic across environments.

Surprising findings

• Without policy checks, a strict Variable Passing planner that never exposes low-integrity content already prevents all attacks in AgentDojo.
• With reasoning models, FIDES shows no utility loss relative to the Basic planner when policy checks are disabled.

Limitations

• Policies only check the most recent action, so text-to-text attacks that alter the final response are not stopped.
• Many data-independent tasks remain far from ideal utility due to failed quarantined LLM use and fallback variable expansion.
• Evaluation relies on heuristically inferred labels and a human-oracle task classification on AgentDojo.

Experimental setup

Datasets: AgentDojo

Benchmarks: AgentDojo

Metrics: Attack Success Rate Task Completion Rate

Baselines: Basic planner Variable Passing planner Tool Filter

Builds on: Dual LLM pattern ReAct Toolformer AgentDojo noninterference

Closest papers by meaning

• Optimizing Agent Planning for Security and Autonomy (ICLR 2026 · similarity 0.88)
• AI Agents May Always Fall for Prompt Injections (NeurIPS 2026 · similarity 0.86)
• Agent Security is a Systems Problem (NeurIPS 2026 · similarity 0.85)
• AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents (NeurIPS 2025 · similarity 0.84)
• Architecture Matters for Multi-Agent Security (ICML 2026 · similarity 0.84)
• Attack Selection In Agentic AI Control Evaluations Meaningfully Decreases Safety (NeurIPS 2026 · similarity 0.84)