Towards Security-Auditable LLM Agents: A Unified Graph Representation
Summary
This paper introduces Agent-BOM, a unified graph representation for security auditing in LLM-based agentic systems. It addresses the semantic gap in post-hoc auditing by modeling static capabilities and dynamic runtime states to detect complex attack chains like memory poisoning and tool misuse.
View Cached Full Text
Cached at: 05/11/26, 07:07 AM
# Towards Security-Auditable LLM Agents: A Unified Graph Representation Source: [https://arxiv.org/abs/2605.06812](https://arxiv.org/abs/2605.06812) Authors:[Chaofan Li](https://arxiv.org/search/cs?searchtype=author&query=Li,+C),[Lyuye Zhang](https://arxiv.org/search/cs?searchtype=author&query=Zhang,+L),[Jintao Zhai](https://arxiv.org/search/cs?searchtype=author&query=Zhai,+J),[Siyue Feng](https://arxiv.org/search/cs?searchtype=author&query=Feng,+S),[Xichun Yang](https://arxiv.org/search/cs?searchtype=author&query=Yang,+X),[Huahao Wang](https://arxiv.org/search/cs?searchtype=author&query=Wang,+H),[Shihan Dou](https://arxiv.org/search/cs?searchtype=author&query=Dou,+S),[Yu Ji](https://arxiv.org/search/cs?searchtype=author&query=Ji,+Y),[Yutao Hu](https://arxiv.org/search/cs?searchtype=author&query=Hu,+Y),[Yueming Wu](https://arxiv.org/search/cs?searchtype=author&query=Wu,+Y),[Yang Liu](https://arxiv.org/search/cs?searchtype=author&query=Liu,+Y),[Deqing Zou](https://arxiv.org/search/cs?searchtype=author&query=Zou,+D) [View PDF](https://arxiv.org/pdf/2605.06812) > Abstract:LLM\-based agentic systems are rapidly evolving to perform complex autonomous tasks through dynamic tool invocation, stateful memory management, and multi\-agent collaboration\. However, this semantics\-driven execution paradigm creates a severe semantic gap between low\-level physical events and high\-level execution intent, making post\-hoc security auditing fundamentally difficult\. Existing representation mechanisms, including static SBOMs and runtime logs, provide only fragmented evidence and fail to capture cognitive\-state evolution, capability bindings, persistent memory contamination, and cascading risk propagation across interacting agents\. To bridge this gap, we propose Agent\-BOM, a unified structural representation for agent security auditing\. Agent\-BOM models an agentic system as a hierarchical attributed directed graph that separates static capability bases, such as models, tools, and long\-term memory, from dynamic runtime semantic states, such as goals, reasoning trajectories, and actions\. These layers are connected through semantic edges and security attributes, transforming fragmented execution traces into queryable audit paths\. Building on Agent\-BOM, we develop a graph\-query\-based paradigm for path\-level risk assessment and instantiate it with the OWASP Agentic Top 10\. We further implement an auditing plugin in the OpenClaw environment to construct Agent\-BOM from live executions\. Evaluation on representative real\-world agentic attack scenarios shows that Agent\-BOM can reconstruct stealthy attack chains, including cross\-session memory poisoning and tool misuse, capability supply\-chain hijacking and unexpected code execution, multi\-agent ecosystem hijacking, and privilege and trust abuse\. These results demonstrate that Agent\-BOM provides a unified and auditable foundation for root\-cause analysis and security adjudication in complex agentic ecosystems\. ## Submission history From: Chaofan Li \[[view email](https://arxiv.org/show-email/9345ad8b/2605.06812)\] **\[v1\]**Thu, 7 May 2026 18:14:29 UTC \(5,277 KB\)
Similar Articles
Auditing Agent Harness Safety
This paper proposes HarnessAudit, a framework for auditing LLM agent execution trajectories beyond final outputs, focusing on boundary compliance, execution fidelity, and system stability. It introduces HarnessAudit-Bench with 210 tasks across eight domains and evaluates ten harness configurations, finding that task completion misaligns with safe execution and violations accumulate with trajectory length.
Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement
This survey paper reviews 38 studies on safe LLM agents, highlighting key challenges such as specification translation bottlenecks, incomplete safety guarantees from enforcement methods like runtime monitoring, and the verifier tax that impedes safe task completion.
Safeguarding LLM Agents from Misalignment through Provenance Analysis
This paper proposes a provenance-based framework and multi-stage pipeline, \tool, to detect misalignment in LLM agents' tool invocations before execution, reducing error rates significantly compared to LLM-as-a-judge baselines.
Which Models Are Our Models Built On? Auditing Invisible Dependencies in Modern LLMs
Introduces ModSleuth, an agentic system that recursively reconstructs large-scale dependency graphs for LLM development by analyzing public artifacts, revealing multi-hop license obligations and documentation inconsistencies.
State Contamination in Memory-Augmented LLM Agents
This paper identifies and studies 'memory laundering' in LLM agents, where toxic or adversarial context compressed into memory summaries evades standard toxicity detectors while still influencing future generations. It introduces the sub-threshold propagation gap (SPG) to measure hidden downstream influence and shows that sanitizing toxic state before summarization is more effective than post-hoc cleaning.