PROVISO: Provenance-Informed Action Selection for Secure LLM Agents

arXiv cs.AI Papers
llm-agents security provenance action-selection prompt-injection tool-use

Summary

PROVISO 是一个在 LLM agent 执行动作前进行溯源感知决策的控制器，通过将可信与外部观察编码为溯源类型记忆来平衡安全性与实用性，在多个 agent 安全基准上显著优于现有基线。

arXiv:2610.27115v1 Announce Type: new Abstract: LLM agents act on the external world through tools and third-party skills, so a single executed action can cause irreversible harm. Existing defenses judge a proposed action without tracking whether its content comes from the user or from external sources such as tool outputs, and they judge it in isolation rather than against an available alternative, which forces a trade-off between security and utility. We present PROVISO, a controller that decides which action to commit after the agent proposes an action and before it is executed. PROVISO encodes trusted observations, external observations, the proposed action, and an alternative into provenance-typed memory, relates them through role-specific queries, and commits the action with the highest calibrated value learned from outcomes. On four agent security tasks spanning the agent lifecycle, no baseline exceeds PROVISO in both security and utility. PROVISO improves F1 over the strongest baseline by 13.84 points on SkillsBench and by 7.07 points on ToolSafe, and it reaches 88-99 F1 on three additional skill detection benchmarks.
Original Article
View Cached Full Text

Cached at: 10/21/26, 06:45 AM 

# PROVISO: Provenance-Informed Action Selection for Secure LLM Agents
Source: [https://arxiv.org/abs/2610.27115](https://arxiv.org/abs/2610.27115)
[View PDF](https://arxiv.org/pdf/2610.27115)[HTML \(experimental\)](https://arxiv.org/html/2610.27115v1)

> Abstract:LLM agents act on the external world through tools and third\-party skills, so a single executed action can cause irreversible harm\. Existing defenses judge a proposed action without tracking whether its content comes from the user or from external sources such as tool outputs, and they judge it in isolation rather than against an available alternative, which forces a trade\-off between security and utility\. We present PROVISO, a controller that decides which action to commit after the agent proposes an action and before it is executed\. PROVISO encodes trusted observations, external observations, the proposed action, and an alternative into provenance\-typed memory, relates them through role\-specific queries, and commits the action with the highest calibrated value learned from outcomes\. On four agent security tasks spanning the agent lifecycle, no baseline exceeds PROVISO in both security and utility\. PROVISO improves F1 over the strongest baseline by 13\.84 points on SkillsBench and by 7\.07 points on ToolSafe, and it reaches 88\-99 F1 on three additional skill detection benchmarks\.

## Submission history

From: Qi Zhang \[[view email](https://arxiv.org/show-email/30e857e2/2610.27115)\] **\[v1\]**Mon, 19 Oct 2026 18:13:53 UTC \(260 KB\)

Similar Articles

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

arXiv cs.LG

PropGuard is a propagation-aware framework for safeguarding LLM-based multi-agent systems (LLM-MAS) from malicious instructions that propagate across agents and rounds. It constructs a dual-view spatio-temporal graph and uses a GE-GRPO trained inspector to detect and remediate suspicious propagation subgraphs.

PORA: Learning When More Reasoning Pays Off for LLM Agents

arXiv cs.AI

PORA 提出了一种配对结果引导的推理分配方法，让 LLM 智能体学习在何种状态与剩余预算下使用长推理更划算，在 BFCL memory 等任务上大幅提升性能并显著节省 token 与模型请求。