2025/05/29 by Manuel F. M. Costa, Manuel Costa, Costa, Manuel +16 · 3 voices · 43 citations
Computer Science · Social Sciences · #Access Control and Trust #Access control #Adversarial Robustness in Machine Learning #Class (philosophy) #Computer security model #Confidentiality #Construct (python library) #Control (management) #Planner #Security and Verification in Computing #Security testing
paper · pdf · doi:10.48550/arxiv.2505.23643
published in arXiv (Cornell University) (Cornell University)
openalex publication_date 2025/05/29 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05
As AI agents become increasingly autonomous and capable, ensuring their security against vulnerabilities such as prompt injection becomes critical. This paper explores the use of information-flow control (IFC) to provide security guarantees for AI agents. We present a formal model to reason about the security and expressiveness of agent planners. Using this model, we characterize the class of properties enforceable by dynamic taint-tracking and construct a taxonomy of tasks to evaluate security and utility trade-offs of planner designs. Informed by this exploration, we present Fides, a planner that tracks confidentiality and integrity labels, deterministically enforces security policies, and introduces novel primitives for selectively hiding information. Its evaluation in AgentDojo demonstrates that this approach enables us to complete a broad range of tasks with security guarantees. A tutorial to walk readers through the the concepts introduced in the paper can be found at https://github.com/microsoft/fides