PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance

Rabimba Karanjai; Yang Lu; Richard Williamson; Hemanth Hm; Prakhar Mehrotra; Lei Xu; Weidong; Shi

cs.CRAug 18, 2026

PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance

Authors: Rabimba Karanjai, Yang Lu, Richard Williamson, Hemanth Hm, Prakhar Mehrotra, Lei Xu, Weidong, Shi

Organizations: Larry · University of Houston, USA · PayPal, USA · Kent State University, USA

Abstract

Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution. PACE introduces typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection. A Solidity smart account enforces PDR signatures on-chain with a measured overhead of 29,826-31,822 gas. We evaluate PACE against six baselines on 40 tasks spanning four attack categories plus benign utility (2,800 trials, 10 seeds). In our deterministic sandbox, PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline. Ablation studies identify permissive policy settings (+57.5 pp) and the touched-contract allowlist (+12.5 pp) as the dominant safety components. To test whether the same deterministic floor holds for real model outputs, the artifact additionally provides a three-model live-LLM evaluation over the full task suite with repeated runs. A mainnet-fork harness is included for archive-RPC deployments, but fork results are reported only when the corresponding artifacts are generated. These auxiliary studies are separate from, and never substitute for, the deterministic benchmark. We frame our claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.

Figures & tables

Figure 1: The Pace pipeline. The LLM agent and the intent it emits are untrusted ; the simulator, policy verifier, and PDR are deterministic and never consult the LLM; the smart account re-checks the signed PDR on-chain before any external call. The user policy is the only trusted input that shapes the decision.

Figure 2: On-chain enforcement in executePDR . Any failed check reverts; the nonce is consumed before the external call, so a re-entrant call cannot replay the PDR.

Agent	Correct%	Unsafe Exec	Atk Success	Dangerous Block Rate	FP Rate
Raw	20.0%	0.80	1.00	0.00	0.00
Prompt-Only	41.2%	0.59	0.73	0.27	0.00
Sim-Only	27.5%	0.72	0.91	0.09	0.00
WalletGuard	75.0%	0.25	0.31	0.69	0.00
StaticGuard	95.0%	0.05	0.06	0.94	0.00
SimGuard	97.5%	0.03	0.03	0.97	0.00

Table 1: Agent comparison (2,800 trials, 10 seeds). Correct and unsafe execution rates use all trials; attack success and dangerous block rates use attack trials; false-positive rate uses benign trials.

Variant	Correct%	Unsafe Exec Rate	Reject Rate	FP Rate
pace_baseline	100.0%	0.000	0.800	0.000
pace_no_sim	95.0%	0.050	0.750	0.000
pace_no_metadata	100.0%	0.000	0.800	0.000
pace_no_touched	87.5%	0.125	0.675	0.000
pace_no_calldata_bind	97.5%	0.025	0.775	0.000
pace_no_freshness	97.5%	0.025	0.775	0.000

Table 2: Ablation: unsafe execution rate when each component is removed. The baseline uses the same task policies and task-specific simulators as the main PACE experiment. The reject rate is all rejected decisions over all ablation trials, not the dangerous block rate.

Model	Correct%	LLM-Only Atk Succ	PACE Atk Succ	FP Rate
gemini-3.1-flash-lite	97.5	0.000	0.000	0.125
DeepSeek-V4-Flash	97.4	0.026	0.000	0.128
gpt-4o	99.0	0.069	0.000	0.050

Table 3: Live multi-model evaluation. Correct rate, model-alone vs. Pace -guarded attack-success rate, and benign false-positive rate. Generated from results/runs/live_suite/ .

Agent	Evasion blocked	Policy-valid harm admitted
PACE	8/8 (1.00)	8/8 (1.00)
SimGuard	7/8 (0.88)	8/8 (1.00)
StaticGuard	7/8 (0.88)	8/8 (1.00)
WalletGuard	2/8 (0.25)	8/8 (1.00)

Table 4: Adaptive adversary with full policy knowledge (seed 0). Evasion attacks are policy-violating (lower-left is better); policy-valid-harmful transactions stay within the policy, and every guard admits them all.

Explore similar work

Sep 10, 2026

DeFiFlowBench: Benchmarking and Improving Safe Executability in Natural-Language DeFi Workflow Synthesis

A structurally valid DeFi workflow can still authorize a costly trade. We introduce DeFiFlowBench, a benchmark of 207 team-authored prompts for natural-language DeFi workflow synthesis. It measures graph coverage, configuration completeness, and declared safety predicates, then tests supported trade configurations on a local EVM. Direct, constrained, and few-shot prompting produce 14-19 unsafe held-out executions per configuration under a fixed 5% price-impact cap. A slippage bound derived from a quote does not prevent the price impact of the order itself. We propose Koan-Safe, which combines a prompt-only intent parser, a replaceable generator, and structural repair with default safety parameters. On 75 held-out workflow prompts, its hybrid variant scores 0.67 on the static safety proxy, compared with 0.33 for the best baseline. Koan-Safe records no unsafe executions on the saved benchmark outputs. A matched-candidate ablation produces 14-17 unsafe executions when enforcement is disabled. Additional tests expose the limits of default injection: permissive existing thresholds can still authorize unsafe trades. A separately evaluated policy cap addresses this failure on a 36-case diagnostic grid. These results support explicit trade protections and execution-based evaluation, while distinguishing declared safety from a general guarantee.

Abhinav Rajeev Kumar, Harshit Arora, Varun Singh +1

SRM Institute of Science and Technology

LLM Safety Benchmarks LLM Guardrails Decentralized Finance LLM Safety Evaluation

Ask PDF

Jul 29, 2026

FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs

Large language model (LLM) agents autonomously interleave semantic reasoning with complex system operations. In these dynamic environments, static tool-level permissions are fundamentally insufficient; safe authorization is highly context-dependent and heavily reliant on evolving runtime states and data flows. We present FAVA (Formal Authorization for Verified Agents), a permission-carrying authorization framework for agent execution. FAVA utilizes an LLM-guided Permission Intermediate Representation (IR) to translate ambiguous natural-language tasks into structured constraints. A deterministic lowering pass then converts this IR into an evidence-backed permission graph that explicitly tracks data flows, dependencies, and contextual labels. To provide strict security guarantees, a Satisfiability Modulo Theories (SMT) authorizer mathematically verifies the current graph against security policies before any effectful action executes. A runtime gateway then enforces the solver's result, either authorizing the execution or intercepting it with a precise counterexample. We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios. Our evaluation demonstrates that FAVA achieves a 90.5% Decision Compliance Rate (DCR) over the aggregate dataset, successfully intercepting dynamic violating traces in the evaluated trace-conditioned scenarios.

Yifan Zhang, Xinkui Zhao, Sai Liu +3

Zhejiang University

LLM Agent Security Tool Access Control for LLM Agents

Ask PDF

Aug 7, 2026

NiyamAI - An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs

Giving an AI agent the ability to send emails, query databases, or execute commands is useful--until the agent is tricked into doing something it shouldn't. Prompt injection, hallucinated reasoning, and unsafe tool calls form the primary attack surface for autonomous LLM agents. Existing defenses rely on software checks like system prompts or policy filters running on the same machine the attacker targets, offering no verifiable proof of execution. We introduce Niyam-AI, a framework that makes safety enforcement provable. At session start, permitted tools and constraints are locked into an Intent Contract committed via SHA-256. Every tool call is intercepted and validated by an isolated Judge model; upon passing, a zk-SNARK proof is generated via EZKL. The tool executes only after proof verification, allowing third parties to confirm enforcement without accessing Judge model weights. Evaluating Niyam-AI on 2,000 real-world scenarios from Agent-SafetyBench against NeMo Guardrails, Meta's Llama Prompt Guard 2, and OpenAI's GPT-OSS-Safeguard using 5-fold stratified cross-validation yields an F1 score of 88.5% with a 1.1% false-positive rate (bootstrap 95% CI: [85.19%, 91.88%], N=1000). McNemar's exact paired test confirms significant improvement: Niyam-AI wins 390 discordant scenarios against NeMo (vs 20 losses), 115 against Prompt Guard 2 (vs 13), and 384 against GPT-OSS-Safeguard (vs 19) with p < 0.0001 in all cases. Proof generation adds 2260.6 +/- 218.4 ms per approved action, while verification takes 53.1 +/- 11.8 ms. Niyam-AI provides a guardrail that is both highly accurate and mathematically verifiable--though this reflects a classifier adapted to Agent-SafetyBench evaluated against zero-shot baselines, a distinction discussed in Section IV.C.

Aditya Katkar, Om Karkele, Kartik Mandhane +2

Department of Computer Engineering, Vishwakarma Institute of Technology, Pune, Maharashtra, India

Tool-Augmented Language Model Agents LLM Guardrails Safety Filtering Runtime Enforcement for AI Agents Prompt Injection Defense Prompt Injection Attacks on LLMs+1

Ask PDF