Conflux：用主体上下文与系统级评估防范 LLM 智能体权限提升
Conflux: Preventing Privilege Escalation with Principal Contexts and System-Level Evaluation
AI 导读
arXiv 论文提出 Conflux，一种针对 LLM 智能体的主体上下文防御，将权限提升定义为系统级安全目标：仅当每个影响该动作的主体都允许时动作才可执行。其内核 ITES 基于来源溯源和组织现有访问控制系统，对所有影响主体的权限取交集，并证明了条件性权限限制定理。
正文 · 原文
Abstract:LLM agents combine information from multiple principals while acting externally. We formalise privilege escalation (PE) as the system-level security objective: an action may proceed only if every principal that influenced it would allow it. Model-level defences remain probabilistic, so enforcement must sit outside model judgement. We present Conflux, a principal-context defence. Its kernel, ITES, derives authority from provenance and the organisation's existing access-control system and intersects the permissions of every influencing principal. We prove a conditional authority-confinement theorem: under complete mediation, no-laundering provenance, a known non-empty decision context, fresh permission checks, and action binding, the kernel admits no action that escalates privilege with respect to any recorded influencing principal. The theorem covers the represented value-influence fragment; control influence from tool, branch, recipient, or plan-step selection remains a refinement obligation. Conflux extends the kernel with independent policy ports, argument-aware authorisation, disclosure, consent, delegation, restriction, and exposure planning. We describe two system- level evaluators. SLED is a black-box evaluator: it exhaustively explores a declared finite model of a defence up to a bound. SLED-V is a white-box evaluator: it checks a serialisable intermediate representation against security and provenance properties. The evidence is bounded and partial. The appendix reports retained AgentDojo, SLED, and SLED-V results, including the limits of those runs. No result in this paper is an unbounded deployment guarantee.
| Comments: | 17 pages excluding references and appendix |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2611.08768 [cs.CR] |
| (or arXiv:2611.08768v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.08768 arXiv-issued DOI via DataCite |
Submission history
From: Raya Buckley [view email]
[v1]
Thu, 5 Nov 2026 22:30:59 UTC (32 KB)
[v2]
Thu, 12 Nov 2026 17:25:51 UTC (33 KB)
来源：arXiv cs.AI · arxiv.org