CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
cs.CR · cs.AI
Quick verdict
CONTINUITY uses signed assume-guarantee contracts to preserve security context across LLM-agent components; rigorous but tested only on its synthetic suite.
Summary
The paper identifies 'security-context discontinuity' — the loss, widening, or rebinding of security-critical facts as requests cross LLM-agent components — and proposes CONTINUITY, a framework in which each component carries an assume-guarantee contract and every transition is witnessed by signed root grants, field-level provenance manifests, typed releases, transformation witnesses, role-bound receipts, and one-shot finality permits. It formalizes end-to-end consequence integrity (ECI): every external effect must be backed by a current, verifiable authorization witness, and proves composition-safety theorems under signature unforgeability and collision resistance. A 1.5-KLOC Python trusted core (no LLM invoked; the planner is assumed adversarial) is evaluated on a deterministic suite of 32 fault classes across four domains, yielding 2,560 attack instances plus 700 benign and 200 ambiguous tasks. The full configuration commits no harmful effect, completes all benign tasks, and escalates all ambiguous ones, while the strongest incomplete configuration (Gateway+Finality) still reaches 65.6% attack success; ablations reopen 4–24 classes. Median verification latency is 4.21 ms. The main limitations are acknowledged by the authors: the benchmark is self-designed rather than sampled from real attacks, the negative-control configurations are mechanism-level abstractions rather than reimplementations of CaMeL, Progent, CXI, or ARGUS, trusted validators' semantic correctness remains in the TCB, and the implementation is not formally verified.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Security-context discontinuity — loss, weakening, rebinding, or staleness of security-critical facts across component boundaries — is a distinct composition failure class that signatures and local per-component checks do not prevent (§2.3, §4).
- If composition conditions C1–C7 hold, every realized protected effect carries a valid, current authorization witness (Theorem 1, ECI), even with a fully adversarial planner, under signature unforgeability and collision resistance.
- The full CONTINUITY configuration contains all 128 fault–domain classes and commits no harmful effect across 2,560 attack instances, while the strongest incomplete configuration (Gateway+Finality) still reaches 65.6% effect ASR (Table 2).
- Utility is retained: all 700 benign tasks auto-complete — 300 of them via signed typed releases and a genuine directory-witnessed alias transformation — and all 200 unreleased ambiguous tasks escalate rather than execute (§8.2–8.3).
- Targeted ablations show each invariant's contribution is measurable: removing field provenance, contract conformance, or complete mediation reopens 24 classes each, while no single ablation reopens more (Table 3).
Strengths
Precise problem formalization with failure theorems
§4 Definition 1 defines security-context discontinuity with four operators (truncation, amplification, rebinding, staleness/replay); Theorems 2–4 (§5) give concrete results, e.g. Theorem 3 shows an unbound security field can be substituted while preserving all checked permit fields — the exact alias-swap scenario in §4.1.
Utility is preserved by design, not by forbidding change
§8.3: every benign trace performs a genuine alias-to-canonical destination transformation accepted only under a directory-signed witness (§6.5), and all 300 external-data tasks complete with signed typed releases bound to source identity, exact value digest, predicate, task, and expiry (§5.2, Definition 3).
Honest evaluation framing
Candid ablation interpretation
Unusually complete reproducibility apparatus
Weaknesses
Self-referential evaluation with no named-system baselines
Fault–defense circularity limits the headline result
Heavy TCB assumptions quietly carry the security argument
Prototype runtime far from deployment
No mechanical verification of the implementation
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
CONTINUITY (arXiv 2609.05269, cs.CR/cs.AI; Zheng & Yang, ZAST.AI) targets a composition problem rather than a model problem. Security-context discontinuity (§4, Definition 1) is the absence, weakening, reinterpretation, or staleness of a security-relevant fact at effect time, even when every intermediate object is signed. The claimed contributions (§1): a 32-class fault taxonomy; a formal model of end-to-end consequence integrity (ECI, Definition 6) with composition conditions C1–C7 and Theorems 1–4 plus Lemma proofs (§5, Appendix A); a reference design built from signed root grants, field-level provenance/context manifests, typed releases, transformation witnesses, role-bound receipts, and one-shot finality permits; an executable Python artifact; and a conformance evaluation. Scope is deliberately narrow and repeatedly stated: the planner is adversarial, semantic correctness of trusted validators is out of scope (§3.5, §12), and results are conformance statements, not attack-probability estimates.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is security-context discontinuity?
It is the failure where a security-relevant fact — a source label, an approved destination, a policy decision — is lost, weakened, reinterpreted under a different schema, or becomes stale as a request crosses the boundary between two components of an LLM agent system, even when every component is individually correct and every object is cryptographically signed.
Does CONTINUITY stop prompt injection?
Not by itself. The paper explicitly assumes the LLM planner is already compromised and adversarial. CONTINUITY's guarantee is structural: a harmful proposal cannot become an external effect (send email, move money, deploy code) without a complete, current authorization witness. It does not measure or prevent the model producing harmful text, bad recommendations, or denial of service.
What are the paper's main results?
On a deterministic conformance suite of 2,560 attack instances (32 fault classes × 4 domains × 20 parameterizations), the full system committed no harmful effect, completed all 700 benign tasks, and escalated all 200 ambiguous tasks. The strongest incomplete configuration still had a 65.6% attack success rate. Median proof verification took 4.21 ms on the recorded host.
Is the code and data available?
Yes. The paper points to a public artifact at github.com/zast-ai/continuity containing a 1,523-line Python trusted core (MIT license per §7.7), 30 regression tests, deterministic fault-injection scripts, raw CSV results, ablations, and a claim-to-evidence map; the paper text is marked CC BY 4.0.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure graphics (Figs. 1, 3–5) are extracted as interleaved axis-label text rather than images; all quantitative values they display are also present in Tables 2–4 and the prose, so no data is missing.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.