APPA Framework Cuts Prompt Injection Leaks in LLM Agents Near Zero

Researchers introduced APPA (Agentic Permissions Policy Algebra), a new information flow control (IFC) framework designed to protect autonomous LLM agents handling mixed-confidentiality data from prompt injection attacks. Traditional taint tracking permanently contaminates an agent's entire context once unvetted data is read, severely limiting downstream usability.

APPA addresses this by prospectively evaluating label descents and missing prerequisites before data acquisition, generating actionable remedy plans such as Authorize and Accept. To inspect unvetted data safely, it spawns a label-seeded child trajectory that absorbs label descent locally, letting a trusted sanitizer return a bounded derivative to the unchanged parent context. The system is governed by a two-monoid model over security labels and shared event logs, with formal proofs guaranteeing parent label preservation and merge confinement.

Evaluated on a multi-turn tool-chaining benchmark across four models, APPA suppressed exfiltration attack success rates from 31-50% down to 0-7%, and on three of the four models, context branching recovered a substantial share of the utility that pure taint tracking would have forfeited. The results suggest engineers can enforce strong agent security without severely sacrificing task performance.