AgentProv — Provenance-Aware Containment of Privileged Database Writes

Status: Pilot complete · scale-up pending · part of the agent-authorization and tool-security line of work.

The question

An LLM agent that reads untrusted content mid-task — a customer email, a support ticket, a retrieved note — may be asked, inside that content, to perform a privileged database write. The obvious defense is to ask the agent where its instruction came from. That fails by construction: a compromised agent can simply lie. AgentProv traces provenance outside the agent instead, so containment does not depend on the agent’s self-report.

Results so far

• Attack success falls from 1.00 to 0.00. Without provenance tracing, every poisoned task converts untrusted content into a privileged write. With it, none do.
• No measured utility cost. False-block rate is 0.0 on legitimate writes and 0.0 on benign reads — the defense did not learn to refuse everything.
• Run on Qwen2.5-1.5B-Instruct served through vLLM, with GPU memory utilization computed from live free memory on a shared machine.

The caveat worth stating is scale: this is a pilot with single-digit task counts per condition. The separation is clean and the mechanism is deterministic, but the interval around a 0.00 rate at this n is wide, and the scaled round is what would narrow it.