Securing AI Agents with Information-Flow Control
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866908516062593024 |
|---|---|
| author | Costa, Manuel Köpf, Boris Kolluri, Aashish Paverd, Andrew Russinovich, Mark Salem, Ahmed Tople, Shruti Wutschitz, Lukas Zanella-Béguelin, Santiago |
| author_facet | Costa, Manuel Köpf, Boris Kolluri, Aashish Paverd, Andrew Russinovich, Mark Salem, Ahmed Tople, Shruti Wutschitz, Lukas Zanella-Béguelin, Santiago |
| contents | As AI agents become increasingly autonomous and capable, ensuring their security against vulnerabilities such as prompt injection becomes critical. This paper explores the use of information-flow control (IFC) to provide security guarantees for AI agents. We present a formal model to reason about the security and expressiveness of agent planners. Using this model, we characterize the class of properties enforceable by dynamic taint-tracking and construct a taxonomy of tasks to evaluate security and utility trade-offs of planner designs. Informed by this exploration, we present Fides, a planner that tracks confidentiality and integrity labels, deterministically enforces security policies, and introduces novel primitives for selectively hiding information. Its evaluation in AgentDojo demonstrates that this approach enables us to complete a broad range of tasks with security guarantees. A tutorial to walk readers through the the concepts introduced in the paper can be found at https://github.com/microsoft/fides |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2505_23643 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Securing AI Agents with Information-Flow Control Costa, Manuel Köpf, Boris Kolluri, Aashish Paverd, Andrew Russinovich, Mark Salem, Ahmed Tople, Shruti Wutschitz, Lukas Zanella-Béguelin, Santiago Cryptography and Security Artificial Intelligence As AI agents become increasingly autonomous and capable, ensuring their security against vulnerabilities such as prompt injection becomes critical. This paper explores the use of information-flow control (IFC) to provide security guarantees for AI agents. We present a formal model to reason about the security and expressiveness of agent planners. Using this model, we characterize the class of properties enforceable by dynamic taint-tracking and construct a taxonomy of tasks to evaluate security and utility trade-offs of planner designs. Informed by this exploration, we present Fides, a planner that tracks confidentiality and integrity labels, deterministically enforces security policies, and introduces novel primitives for selectively hiding information. Its evaluation in AgentDojo demonstrates that this approach enables us to complete a broad range of tasks with security guarantees. A tutorial to walk readers through the the concepts introduced in the paper can be found at https://github.com/microsoft/fides |
| title | Securing AI Agents with Information-Flow Control |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2505.23643 |