Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
- ID: 2f5c584c
- 原文链接: https://arxiv.org/abs/2503.15547
- PDF: https://arxiv.org/pdf/2503.15547v2
- 作者: Juhee Kim, Woohyuk Choi, Byoungyoung Lee
- 日期: 2025-03-17
- 更新: 2025-04-21
- 分类: agents
- 标签: llm-agents, privilege-escalation, prompt-flow-integrity, agent-isolation, agent-security
- 质量评分: 4/5
- 抓取时间: 2026-07-26T12:28:07+08:00
一句话
Agent 权限升级防护需要追踪提示流，隔离用户意图与工具返回的不可信数据
中文导读
PFI 关注 LLM Agent 的提示流而不是单次提示：用户输入和工具返回数据都会在运行时改写 Agent 行为，从而产生权限升级风险论文给出三类缓解：Agent 隔离不可信数据安全处理权限升级护栏；其价值在于把工具调用权限问题转成可分析的系统安全控制面
关键要点
- 把 Agent / 工具调用系统的攻击面从“模型回答是否安全”推进到规划、权限、数据流与执行边界。
- arXiv 分类：cs.CR, cs.AI, cs.MA，适合放入 AAIF 的
agents频道继续追踪。 - 内容页由 arXiv 元数据与摘要回填，后续若需要精读可再补充实验细节、威胁模型图和 benchmark 表格。
English Summary
LLM agents combine models with tools, but their behavior is determined at runtime by natural-language prompts from users and tool data. The paper argues that this flexibility introduces privilege escalation risks and non-deterministic insecure interpretations of user prompts. It proposes Prompt Flow Integrity (PFI), a system-security solution with agent isolation, secure untrusted-data processing, and privilege-escalation guardrails; evaluation reports mitigation of privilege escalation while preserving agent utility.
Abstract
Large Language Models (LLMs) are combined with tools to create powerful LLM agents that provide a wide range of services. Unlike traditional software, LLM agent's behavior is determined at runtime by natural language prompts from either user or tool's data. This flexibility enables a new computing paradigm with unlimited capabilities and programmability, but also introduces new security risks, vulnerable to privilege escalation attacks. Moreover, user prompts are prone to be interpreted in an insecure way by LLM agents, creating non-deterministic behaviors that can be exploited by attackers. To address these security risks, we propose Prompt Flow Integrity (PFI), a system security-oriented solution to prevent privilege escalation in LLM agents. Analyzing the architectural characteristics of LLM agents, PFI features three mitigation techniques -- i.e., agent isolation, secure untrusted data processing, and privilege escalation guardrails. Our evaluation result shows that PFI effectively mitigates privilege escalation attacks while successfully preserving the utility of LLM agents.
Source Metadata
- arXiv ID:
2503.15547 - Primary category:
cs.CR - Categories:
cs.CR, cs.AI, cs.MA - Comment:
_Content backfilled by AAIF content-fetcher from OpenCLI arXiv metadata._