FlowGuard — Re-Deriving Labels Rather Than Trusting Them

Status: Full run complete · part of the agent-authorization and tool-security line of work.

The question

Provenance systems are usually evaluated on whether labels survive a pipeline. FlowGuard argues that is the wrong test, and demonstrates why: a lineage mechanism that faithfully computes and stores a label at every hop, but never consults that label before an action executes, offers zero protection over having no label at all — while an audit of its metadata reports complete provenance survival. The paper calls this tracking without enforcement.

Results so far

Across attack families spanning source poisoning, provenance laundering, authority amplification, replay/staleness and exfiltration:

• Three baselines fail identically and completely. No-provenance, prompt-only distrust, and source-ACL-only all record a policy-violation rate of 1.00 with an attack-blocked rate of 0.00.
• The source-ACL baseline is the damning one. Its provenance-survival rate is 1.00 — every label intact at every hop — and it still violates policy on every attack. Label persistence and label correctness are different properties, and a benchmark measuring only the first would score it as equivalent to a working defense.
• Static taint propagation is fooled wherever a self-report is involved, improving the authority-amplification rate only from 0.714 to 0.571.
• Re-deriving each hop’s label independently blocks every attack family with zero false blocks on clean traffic. Enforcement does not depend on the agent resisting the injection — which matters, because the underlying agent complies with the source-poisoning injection in every tested case.