Research map / Multi-agent systems and games / LLM agents

Language-Based Agent Control

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: LLM multi-agent collaboration and safety · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes language-based agent control (LBAC), embedding LLM agents in a pure typed host language (Haskell, implemented as TypeGuard) so type-checking enforces policies over agent-generated code, and evaluates on AgentDojo Slack against CaMeL.

Problem

Agent frameworks trade off expressiveness against control: tool-based systems are safe but inflexible, while sandboxed interpreters are expressive but cannot enforce application-level policies such as data provenance, information flow, and task-scoped capabilities.

Approach

Require agents to generate programs that are well-typed in the context of developer scaffolding within a pure, typed host language (Haskell); policies are expressed as types and effect types, so type-checking rejects violating code before execution, and recursive subagents inherit (or tighten) the same policies.

Key results

• Without policies, TypeGuard and CaMeL both complete 15/21 Slack tasks; with policies, 8 vs 7.
• Under direct attack with IFC policies, TypeGuard achieves 36/105 utility vs CaMeL 32/105, with 105/105 security for both.
• Under important instructions attack with policies, TypeGuard utility is 33/105 vs CaMeL 36/105, with 105/105 security for both; all 95% CIs for the utility difference include zero except none excluded.

Surprising findings

• With IFC policies enabled, both systems lose substantial utility, showing a utility cost of strict policies.
• Under important-instructions attack, CaMeL slightly outperforms TypeGuard in utility (36 vs 33), though the difference is not significant.

Limitations

• Strict policies conservatively reject flows that cannot be verified, reducing task utility.
• Relies on the host language's type system guarantees and safe-subset restrictions (e.g., excluding unsafePerformIO).
• Evaluated only on the AgentDojo Slack suite with a single model.

Experimental setup

Datasets: AgentDojo Slack suite

Benchmarks: AgentDojo

Metrics: utility (pass@1) security (injections resisted) 95% CI difference (Newcombe score)

Baselines: CaMeL AgentDojo default attacks

Builds on: CaMeL LIO Safe Haskell dual-LLM pattern

Closest papers by meaning

• SecureClaw: Clawing Back Control of LLM Agents (NeurIPS 2026 · similarity 0.84)
• AOrchestra: Automating Sub-Agent Creation for Agentic Orchestration (ICML 2026 · similarity 0.84)
• HACO: Hedged Agent Computing for Reliable LLM Systems (NeurIPS 2026 · similarity 0.84)
• Self-Challenging Language Model Agents (NeurIPS 2025 · similarity 0.84)
• GuardAgent: Safeguard LLM Agents via Knowledge-Enabled Reasoning (ICML 2025 · similarity 0.84)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents (NeurIPS 2025 · similarity 0.84)