{"id":"9799f302-3802-4f2e-bd28-2a99bcdab0ea","arxiv_id":"2607.24625","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Engine-managed context branching plus prospective label checks confine taint in LLM agents, cutting exfiltration to 0–7% ASR while recovering much of the utility pure taint tracking forfeits.","lead":"APPA is an information-flow control system for LLM agents that isolates untrusted reads in disposable child contexts so the main agent is not permanently locked out of tools. It matters because mixed-confidentiality agent workflows today either leak data under prompt injection or lose utility under classical taint tracking.","discovery_kind":"new_method","skeptic_critique":{"model":"moonshotai/kimi-k3","headline":"The headline utility-recovery result may be definitional: up to 9 of the 39 utility episodes per arm are in scenarios the authors describe as structurally unwinnable without branching, and the measured fork-vs-no-fork gains (6–10 episodes) fit almost entirely inside that set.","rationale":"The reader identified contract/TCB completeness as the weakest assumption; that is real and self-reported, but it bounds the security guarantee's scope rather than threatening the central claim as stated, since the claim is explicitly conditioned on declared contracts (§7–§8 admit the residual breaches as contract gaps, not bypasses). I locate the more load-bearing soft spot in the empirical utility claim: the ablation isolating branching is clean in mechanics but its effect size can be almost entirely attributed to scenarios constructed to be unwinnable without the ablated mechanism. This does not contradict the reader's verdict — the reader already conditioned on \"broader workloads\" and flagged the synthetic benchmark in the rationale, and agreement is partial because their named weakest assumption is a different one — but it sharpens what the condition should be: per-scenario reporting and evaluation on tasks not co-designed with the defense, plus the already-flagged artifact release. The formal half of the claim (Theorem 6.1) is elementary but sound as algebra; its real dependency is harness-level transcript isolation, which is unverifiable without the promised artifact — another reason the reader's CONDITIONAL pending artifact release is the right posture. Nothing here warrants moving to REJECT or ACCEPT; the honest reading is UNCHANGED with a strengthened empirical condition.","tokens_in":21809,"tokens_out":3190,"duration_ms":96446,"concrete_test":"Obtain or compute the per-scenario utility breakdown (the paper reports only arm aggregates and remedy totals) and recompute the APPA vs APPA-no-fork utility gap after excluding the three structurally branch-dependent scenarios. If the residual gap is near zero for Qwen (currently +7) and Gemini (+6), and shrinks to ~1 episode for Luna (+10), the utility-recovery headline reduces to \"branching wins tasks that require branching\"; in that case the paper should report the per-scenario table and add bench-corp scenarios where branching is optional but useful, to measure the non-definitional benefit.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The empirical half of the strongest claim — \"branching recovers a substantial share of the utility that taint tracking alone forfeits on three of four models\" — rests on bench-corp, which the authors themselves co-designed with the defense. §7 states that three scenarios (reply-and-file-ticket, email-onboarding-buddy, review-then-notify) are \"structurally branch-dependent (unwinnable without context branching)\" under APPA's policy. That is 3 scenarios × 3 repetitions = 9 of the 39 utility episodes per arm that the APPA-no-fork arm cannot win by construction. Now compare with the reported fork gains: GPT-5.6 Luna gains 10 episodes (27→37), Qwen 3.6 35B gains 7 (21→28), Gemini 3.5 Flash-Lite gains 6 (11→17), GPT-4o nets 0. For Qwen and Gemini the entire gain, and for Luna all but ~1 episode, can be fully accounted for by the scenarios engineered to require branching. So the causal ablation is clean in design (same binary, same policy, only --max-forks differs) but the effect size is measured on a denominator that includes tasks built to make the ablated mechanism necessary. The same co-design issue touches the ASR half more mildly: six \"native-expressiveness\" scenarios isolate distinctions APPA's state model natively represents, and Fides's identical 29% ASR across all four models is admitted to be deterministic policy mismatch on author-selected scenarios — so Table 3's security comparison measures scenario-policy alignment, not differential robustness. To the paper's credit, all of this is self-reported in §7's taxonomy and methodological-scope paragraphs, and the residual APPA breaches are disclosed honestly. The concern is not concealment; it is that the topline numbers in the abstract and Table 3 aggregate over a task mix whose headline effects are partly built in, so the claim generalizes weakly to settings where branching is helpful but not necessary.","agreement_with_reader":"partial"},"referee_report":{"model":"moonshotai/kimi-k3","summary":"The paper presents APPA, a dynamic information-flow-control framework for LLM agents that addresses label creep via two mechanisms: (i) engine-managed context branching, in which restrictive reads are executed in label-seeded child trajectories whose checked exits merge only adequate or sanitized derivatives into the parent, and (ii) prospective acquisition enforcement, in which pre-dispatch checks on label descents and unmet tool requirements produce executable remedy plans (Authorize/Accept) and advisory Redispatch/Branch recommendations. A two-monoid model (restrictive-meet label actions × free event-log monoid with a committed-effect projection) supports five formal results proved in Appendix A: fold collapse (Prop. 3.1), monotone descent and settlement (Prop. 3.2), remedy completeness over a modeled transition system (Thm. 4.1), call-scoped release (Thm. 5.1), and branch taint confinement (Thm. 6.1). Empirically, the authors build bench-corp (14 multi-turn corporate-assistant scenarios, declarative end-state scoring) and evaluate four models across five arms; APPA reduces exfiltration ASR from 31%–50% (open) to 0%–7%, and the APPA vs APPA-no-fork ablation (same binary and policy, differing only in --max-forks) shows utility gains of 6–10 episodes on three of four models.","tokens_in":22275,"tokens_out":5988,"duration_ms":258467,"significance":"Label creep is a genuine and recognized usability bottleneck for agent IFC (Fides, CaMeL), and a mechanism that confines taint to disposable child trajectories while preserving the parent label is a useful conceptual contribution. The manuscript has uncommon strengths for this venue: the algebra is parameterized only by the deployment's reader sets and trust chain (no fitted constants), the appendix proofs are complete and correctly scoped to the stated primary model, the planner's empty-verdict completeness is cross-checked by property-based testing against an independent reference implementation, the empirical design includes a genuinely causal ablation (identical binary/policy, one flag), scoring is declarative rather than LLM-judged, residual breaches are honestly attributed to contract gaps rather than hidden, and the AgentDojo instrumentation (§7) is a valuable negative result showing that benchmark cannot discriminate branching on current-generation models. If the empirical claims are recalibrated as requested below, this would be a solid contribution.","major_comments":[{"comment":"The headline utility-recovery claim needs a decomposition it currently does not receive. §7 states that three scenarios (reply-and-file-ticket, email-onboarding-buddy, review-then-notify) are 'structurally branch-dependent (unwinnable without context branching)' under APPA's policy — i.e., 9 of the 39 utility episodes per arm are unwinnable for the APPA-no-fork arm by construction. The reported fork gains are +10 (Luna, 27→37), +7 (Qwen, 21→28), +6 (Gemini, 11→17), and 0 net (GPT-4o). Since the no-fork arm's ceiling on the remaining 30 episodes is 30, the implied gains outside the engineered set are at most +1 (Luna), and are negative for Qwen (19/30 vs 21/30 winnable) and Gemini (8/30 vs 11/30 winnable); GPT-4o's 'nets four fewer elsewhere to mediation overhead' is consistent with this. In other words, the entire measured utility-recovery effect is concentrated in scenarios the benchmar","section":"§7, Table 3; Abstract and §1 contributions"},{"comment":"The cross-system security comparison against Fides is structurally stacked and should be reframed. Six of the fourteen scenarios are 'native-expressiveness' probes designed to isolate distinctions APPA's state model represents and Fides's does not (audience intersection vs ordinal ceilings, one-shot history predicates, intermediate trust ranks, pre-dispatch vs post-effect labeling). Fides's ASR is identical at 12/42 (29%) across all four models, which the text concedes is 'a deterministic policy mismatch rather than model-dependent susceptibility.' Table 3 therefore measures scenario–policy alignment on author-selected scenarios, not differential robustness, and a reader scanning the table will draw a comparative-security conclusion the design cannot support. The text hedges ('not a feature-equivalent one'), but the table itself should carry the caveat (e.g., a footnote on the Fides ASR","section":"§7, Table 3 (Fides rows)"},{"comment":"The main-text statement of Theorem 4.1 names only one hypothesis — observational atomicity of a pending-cast success checkpoint and its value finalization — but the proof's scope bounds in Appendix A additionally exclude sanitizer argument substitution, compiled composites, cast resolution of Unknown dimensions, runs in which another checked call interleaves between a DispatchSucceeded checkpoint and value admission, and reported-success closes that withhold their value. As stated in §4, the theorem reads stronger than what is proved. Please enumerate the exclusions (or an explicit pointer and summary) in the main-text statement so the claimed completeness matches the proved coverage; the appendix's careful treatment suggests this is a presentation gap rather than a proof gap.","section":"§4, Theorem 4.1 vs Appendix A ('Scope bounds')"},{"comment":"With 3 repetitions per scenario (42 episodes per arm), the security cells underlying the headline '0%–7% ASR' are 0/42, 1/42, and 3/42 — pairwise indistinguishable at any conventional confidence level — and the smallest fork gain (Gemini, +6 episodes) is only twice the reported run-to-run variation of 'at most three episodes' (whose metric and direction are unspecified). Please report Wilson or exact binomial confidence intervals for the ASR and utility cells in Table 3, state precisely what 'varied by at most three episodes' measures, and consider additional repetitions for the cells that carry the abstract's quantitative claims.","section":"§7, Table 3 (statistical power)"}],"minor_comments":[{"comment":"Typo: 'judgestructure' (missing space) in the paragraph on static structural restrictions.","section":"§1"},{"comment":"The text refers to 'NeuroTaint [6]', but reference [6] is titled 'Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents' — please align the system name with the cited title. Reference [49] contains a stray space: 'Semantics-A ware'.","section":"§2 and References"},{"comment":"Please state explicitly that the utility denominator (39) excludes one security-only scenario, define the Remedies column (totals over 42 episodes; clarify what remedy calls mean in the no-fork arm, where Gemini shows the same count of 32 as the fork arm), and note that the identical Fides ASR across models is deterministic.","section":"Table 3 caption"},{"comment":"Of the 32 GPT-4o AgentDojo tasks failing under enforcement, 24 are attributed to 'mediation overhead in our harness.' Since analogous overhead appears in bench-corp (GPT-4o's −4 episodes), please quantify mediation overhead separately from policy blocks in the bench-corp arms so utility costs are attributable.","section":"§7 (AgentDojo analysis)"},{"comment":"Definition 3.3 forward-references Theorem 6.1 (§6); consider a forward pointer or reordering for readers proceeding linearly.","section":"§3, Definition 3.3"},{"comment":"The 'Response-sink rule' and the later 'User-assistant trust boundary' paragraph describe the root response sink in slightly different terms (a hard no-ruling rule vs. a structural adequacy bar with mediation out of scope); please reconcile the two statements.","section":"§5"},{"comment":"Including the full scenario prompts is welcome. Please also release the declarative scoring predicates, the policy/contracts used per scenario, and the harness (or a replication package), since the paper's empirical claims are otherwise difficult to audit independently.","section":"Appendix B / reproducibility"}],"recommendation":"major_revision","confidential_remarks":"All authors are at a single industry lab, and the benchmark providing all empirical evidence was co-designed with the defense; the authors disclose this (§7 'Methodological scope'), but the headline framing still leans on it harder than the data support. The formal core is sound and the engineering is careful; the needed work is recalibration of the empirical claims (decomposition of fork gains, reframing of the Fides comparison, scoping of Thm. 4.1) rather than new research, though adding non-engineered branching-beneficial scenarios would materially strengthen the paper. The evaluated model names appear to be near-future or anonymized versions, which limits independent replication regardless of code release."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"Punchline: this is a real systems paper on agent IFC usability, not a rebrand of Fides. The useful idea is the pairing of pre-dispatch acquisition checks (with Authorize/Accept remedy plans) and engine-managed, label-seeded child trajectories that absorb taint locally and merge only through a checked exit. Theorem 6.1 is the load-bearing formal claim—parent label preserved under abandon or adequate merge—and the appendix proofs match the stated model (restrictive meets, trajectory-local fold, shared log). That part is solid and worth reading if you care about harness design.\n\nWhat they do well: they name the actual bottleneck (label creep killing downstream tools), engage Fides and Dual-LLM/CaMeL honestly, and run a clean causal arm—same binary and policy, only --max-forks 0. ASR drop from open baselines (31–50% → 0–7%) is consistent across four models. Residual breaches are disclosed as contract gaps, not magic bypasses. Limitations section is unusually straight.\n\nSoft spots, in proportion. The stress-test note is mostly right: three scenarios are structurally unwinnable without branching (9 of 39 utility episodes). Fork gains on three models (6–10 episodes) sit almost entirely inside that set, so “branching recovers substantial utility” is true on their mix and weaker as a general claim. Fides’s flat 29% ASR is admitted policy mismatch on author-chosen expressiveness probes, not a head-to-head robustness contest. No artifacts shipped. Security is only as good as declared contracts and TCB sanitizers—they say so.\n\nNone of that sinks the core design. The algebra is coherent, the confinement story is the right shape for production harnesses, and the paper is self-aware about synthetic scope. This is for people building or reviewing agent runtimes and IFC, not a general ML audience. I would send it to peer review; referees should demand artifact release, a utility split that separates branch-necessary vs branch-optional tasks, and tighter write-side contract completeness. Worth engaging if agent security is on your plate.","headline":"Clean engineering of prospective IFC plus label-seeded branches, with honest proofs and a real ablation—but the headline utility recovery is partly baked into the benchmark design.","tokens_in":22544,"tokens_out":538,"would_cite":true,"duration_ms":17429,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"APPA keeps LLM agent contexts usable under information-flow control by confining taint to disposable child branches instead of permanently polluting the main trajectory.","keywords":["LLM agents","prompt injection","information flow control","taint tracking","declassification","context branching","confused deputy","agent security"],"falsifier":"On the paper's own bench-corp suite, disable branching (APPA-no-fork) and check whether parent-label pollution returns and utility collapses back toward the no-fork numbers, or whether attack success stays near the open-baseline 31–50% when contracts are complete—if either fails to match the reported pattern, the central confinement claim does not hold.","tokens_in":22229,"feed_emoji":"🔒","tokens_out":959,"duration_ms":20307,"temperature":0.7,"pith_summary":"LLM agents that mix private data with untrusted tool outputs face exfiltration and policy breaches from prompt injection and ordinary reasoning errors. Classic dynamic taint tracking stops the leaks but permanently raises the agent's confidentiality level after any sensitive read, locking out later tools and destroying utility. APPA fixes that bottleneck with two engine mechanisms: prospective checks that block risky acquisitions before they run and propose remedy plans (Authorize or Accept), and label-seeded child trajectories that absorb the taint locally so a trusted sanitizer can return only a bounded derivative to an unchanged parent. A two-monoid model over security labels and a shared event log underpins formal proofs that the parent label is preserved and merges stay confined. On a multi-turn corporate tool-chaining benchmark across four models, APPA cuts attack success from 31–50% to 0–7%, and on three of the four models branching recovers much of the utility that pure taint tracking forfeits.","feed_headline":"Branching confines taint so LLM agents stay usable","feed_subtitle":"Child contexts absorb sensitive reads; parent labels stay clean while exfiltration drops to near zero.","key_machinery":"Taint-confining branch (Definition 3.3 / Theorem 6.1): a child inherits the parent's label, folds further descent only locally, and may return a value only through a checked merge that meets the parent label with the return label—so an adequate exit leaves the parent exactly unchanged. Prospective acquisition checks and atomic Authorize/Accept remedy plans clear blocks without silent privilege creep.","core_discovery":"Engine-managed, label-seeded context branching plus prospective acquisition enforcement lets dynamic information-flow control confine taint to child trajectories: the parent label is preserved under abandonment or an adequate sanitized merge, while exfiltration is suppressed and substantial downstream utility is retained compared with permanent taint tracking alone.","pith_inferences":["Production value hinges on policy-authoring quality: every new tool needs accurate deltas, emits, and sink requirements, or residual laundering paths reappear as in the paper's own residual breaches.","Prompt-cache-friendly snapshot inheritance may make branching cheaper at inference time than spawning fully isolated dual-LLM verifiers, a systems angle the evaluation only sketches.","The same prospective-remedy interface could surface human-in-the-loop approvals as first-class plans, turning approval fatigue into a measurable engine metric rather than an external process.","Extending committed-effect logging across sessions would bridge single-run confinement to persistent memory provenance without changing the core label monoid."],"forward_implications":["Agent harnesses can keep a clean primary context after inspecting untrusted or confidential tool outputs instead of permanently revoking downstream tools.","Policy blocks become structured Authorize/Accept remedy plans rather than silent failures or ad-hoc guardrails scattered through agent code.","Formal parent-preservation and merge-confinement proofs give structural guarantees independent of model behavior inside the trusted engine boundary.","Defense-in-depth is available by pairing trajectory branching with OS-level process sandboxes without requiring dual-LLM harness redesign.","Multi-turn tool-chaining tasks that were previously unwinnable under pure taint tracking become feasible when restrictive reads run in child branches."],"fun_headline_variants":["Context branching confines taint while preserving LLM agent utility","Child trajectories absorb taint; parent labels stay clean","APPA branches contexts to trap taint and cut exfiltration","Label-seeded branching keeps parent agents untainted","Prospective checks plus branching recover utility under IFC"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"Security holds only for flows that declared tool contracts and trusted sanitizers actually cover; undeclared write-side sinks or incomplete contracts still allow laundering even when the branching algebra is correct.","fun_headline_variants_meta":{"raw":{"variants":["Context branching confines taint while preserving LLM agent utility","Child trajectories absorb taint; parent labels stay clean","APPA branches contexts to trap taint and cut exfiltration","Label-seeded branching keeps parent agents untainted","Prospective checks plus branching recover utility under IFC"]},"model":"grok-4.5","effort":"low","cost_usd":0.005652,"raw_usage":{"total_tokens":1477,"prompt_tokens":748,"num_sources_used":0,"completion_tokens":61,"cost_in_usd_ticks":56524000,"prompt_tokens_details":{"text_tokens":748,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":668,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":748,"tokens_out":61,"duration_ms":11577,"temperature":1.0,"reasoning_tokens":668,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T10:17:52.030108+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"On the paper's own bench-corp suite, disable branching (APPA-no-fork) and check whether parent-label pollution returns and utility collapses back toward the no-fork numbers, or whether attack success stays near the open-baseline 31–50% when contracts are complete—if either fails to match the reported pattern, the central confinement claim does not hold.","supporting_citations":[],"review_version":1}