这篇论文讲了个新方法APPA，能让LLM Agent安全地处理混合敏感数据，既防提示注入又不牺牲太多功能。
arXiv论文提出APPA（Agentic Permissions Policy Algebra），一种动态信息流控制（IFC）框架，解决传统污点追踪在LLM Agent中因永久污染上下文导致效用下降的问题。APPA通过引擎管理的上下文分支和前瞻性获取执行，在读取未验证数据前评估标签降级并生成补救计划（授权、接受）。该框架在多项工具调用基准上对四个模型评估，将攻击成功率从31%-50%降至0%-7%，且分支机制恢复了大部分因污点追踪丢失的效用。
Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors. While dynamic Information Flow Control (IFC) provides structural security guarantees, traditional taint tracking permanently taints an agent's context upon reading unvetted data, severely restricting downstream utility. We present APPA (Agentic Permissions Policy Algebra), an IFC framework that resolves this usability bottleneck through engine-managed context branching and prospective acquisition enforcement. Before data acquisition occurs, APPA prospectively evaluates label descents and missing prerequisites, generating actionable remedy plans (Authorize, Accept). To inspect unvetted data without polluting the primary context, a label-seeded child trajectory is spawned, absorbing label descent locally and allowing a trusted sanitizer to return a bounded derivative to the unchanged parent. Governed by a two-monoid model over security labels and shared event logs, we formally prove parent label preservation and merge confinement. Finally, we evaluate APPA on a multi-turn tool-chaining benchmark across four models: it suppresses exfiltration (31%-50% down to 0%-7% attack success), and on three of the four, branching recovers a substantial share of the utility that taint tracking alone forfeits.