SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control
What it is
SPA is a security architecture for LLM agents that uses a plan-first approach to generate executable plans in a declarative DSL. It applies dual-lattice information-flow control to track data confidentiality and integrity, and stores execution results as labeled artifacts to prevent re-exposing untrusted payloads to the planner in subsequent queries.
The problem it solves
Existing defenses for LLM agents typically protect only planning or individual tool interactions, leaving persistent agents vulnerable to attacker-controlled data altering control flow, entering sensitive tool arguments, or compromising later queries through state reuse.
What you could use it for
- Securing LLM agents that operate over untrusted webpages or documents
- Preventing prompt injection attacks that alter control flow in persistent agents
- Protecting security-sensitive tool arguments from attacker-controlled data
- Enforcing secure state reuse across multiple user queries
Read the source ↗Back to the library →
Summary written by an AI model from the source; check the source before you rely on it.