ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Kaiyuan Zhang, Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang
cs.CR · cs.AI
Quick verdict
ActGov cuts IPI ASR to ~0 on AgentDojo/AgentDyn via LLM-drafted, Z3-verified policies; weak baselines and unverified LLM extraction temper formal claims.
Summary
The paper presents ActGov, a runtime defense for LLM tool-calling agents against indirect prompt injection. The agent LLM only proposes tool calls and extracts bounded semantic records (argument provenance, target role); a deterministic monitor checks each call against a three-layer policy bundle of task permissions, hard invariants, and procedural obligations. Policies are drafted by an LLM from tool specs, benign traces, and attack traces, and each iteration is checked offline with the Z3 SMT solver against predefined safety assertions before deployment. On AgentDojo and AgentDyn test splits with four backends (Qwen3.6-flash, MiniMax-M2.5, DeepSeek-v4-pro, GPT-4o mini), ActGov reaches ASR 0.000 on AgentDojo and at most 0.007 on AgentDyn, at a utility cost (e.g., AgentDyn DeepSeek clean completion 0.767 to 0.600). Baselines (Progent, DRIFT, CaMeL, ACE) show far lower utility in this setup — CaMeL and ACE score 0.000 clean utility on AgentDyn — making comparisons hard to interpret. Policies are benchmark-specific: out-of-domain transfer keeps ASR 0.000 but collapses clean utility to 0.100. Main runs use GPT-5.5 policy generation with human review; no statistical testing and no code release are reported.
Review complete
Assessment at a glance
5
risk flags identified
● high 2
● medium 2
● low 1
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Mapping agent execution context into a finite 2D record space enables policies that are simultaneously LLM-generatable, Z3-verifiable offline, and deterministically enforceable at runtime.
- Iterating policies until Z3 returns UNSAT on all predefined security assertions guarantees the deployed bundle preserves those invariants before deployment.
- ActGov reduces indirect prompt-injection ASR to 0.000 on AgentDojo and at most 0.007 on AgentDyn across four backends while preserving competitive utility.
- ActGov outperforms Progent, DRIFT, CaMeL, and ACE, which either sacrifice far more utility or behave inconsistently across benchmarks and backends in the authors' setups.
- Policy quality depends on the generator LLM and training-split size, and policies do not yet generalize out of domain (clean utility collapses to 0.100, Table 5).
Strengths
Verified-offline / deterministic-online split
Z3 gating happens entirely in ActGov-Policy before deployment; ActGov-Runtime only evaluates records against the frozen bundle over a finite 2D schema (L1-L3 x 7 scopes, Table 1), so no online solver latency and a small, auditable decision space.
Unusually transparent artifacts
Tables 6-9 enumerate every deployed record and rule with layer, effect, and per-benchmark activation, and the appendix publishes full generation/refinement prompts with explicit anti-leakage invariants (no task-id whitelists; attack evidence may only remove authority).
Honest generalization analysis
Useful RQ3 ablations
Weaknesses
Baseline implementations look degraded
Formal guarantee has undefined scope
Benchmark-coupled policies
No statistical rigor
Operational claims unmeasured
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
ActGov (SUSTech; arXiv 2609.24446v2) is a runtime authorization framework for LLM tool-calling agents under indirect prompt injection (IPI). Its central claims: (1) a finite 2D record schema (formation levels L1-L3 x seven semantic scopes, Table 1) maps unstructured execution contexts into bounded, policy-checkable records; (2) an LLM can iteratively draft a three-layer policy bundle (Task-Permission, Hard-Invariants, Procedural-Obligations) with every iteration verified offline by Z3 against predefined safety assertions; (3) deterministic per-call enforcement yields near-zero IPI ASR with preserved utility, significantly outperforming Progent, DRIFT, CaMeL, and ACE. The threat model is clean and standard: trusted user instruction, attacker-controlled tool observations, unmodifiable enforcement layer.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is ActGov?
ActGov is a runtime security framework for LLM agents that call external tools. Before any tool call takes effect, the call and its context are abstracted into a finite set of structured records (such as argument provenance and target role), and a deterministic policy checker decides allow or block. Policies are drafted by an LLM but must pass Z3-based formal checks against predefined safety assertions before deployment.
How effective is ActGov against indirect prompt injection?
In the paper's experiments on the AgentDojo and AgentDyn benchmarks with four LLM backends, ActGov reduced attack success rate to 0.000 on AgentDojo and at most 0.007 on AgentDyn while retaining most task utility (for example, DeepSeek-v4-pro clean completion on AgentDyn dropped from 0.767 to 0.600). Out-of-domain policy transfer kept attacks blocked but collapsed clean utility to 0.100.
Does ActGov's formal verification prove the agent is safe?
No. The Z3 verification covers only the policy logic against a predefined set of safety assertions over a finite record space. The records themselves are partly produced by an LLM (argument provenance, target roles), and that extraction step is not formally verified; the paper also does not list the exact assertions, so the guarantee's scope is hard to assess.
Is ActGov's code available?
The reviewed text does not state a code release or provide an artifact link. It includes prompt templates and tables enumerating the deployed policy rules and records. The evaluation uses the public AgentDojo benchmark; the AgentDyn benchmark is a separate arXiv preprint (2602.03117).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 1 (architecture overview) survives only as garbled caption text; the diagram itself could not be analyzed.
- Tables 2 and 3 use an interleaved two-column layout; values were cross-checked against the narrative and Table 5, but minor transcription risk remains.
- The appendix appears to end midway through Table 9; any content after it was not reviewed.
- Benchmark internals (AgentDyn, arXiv 2602.03117) were not verified against the original publication.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.