CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Chris Zheng; Geng Yang

cs.CRSep 4, 2026

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Authors: Chris Zheng, Geng Yang

Abstract

LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries. We identify this failure mode as security-context discontinuity and introduce CONTINUITY, a framework for verifiable composition of agent security controls. CONTINUITY models each component with an assume-guarantee contract and carries authenticated security context across transitions using signed root grants, provenance commitments, role-bound transition receipts, bounded typed releases, transformation witnesses, and effect-bound execution permits. We formalize end-to-end consequence integrity, requiring every realized external effect to be backed by a valid and current authorization witness linking the principal, task, provenance, delegation, policy state, canonical action, and finality boundary. We implement a reference verifier and deterministic cross-layer fault-injection suite covering 32 fault classes across four application domains. In 2,560 parameterized attack instances spanning 128 fault-domain classes, the full CONTINUITY configuration commits no harmful external effect, while completing all 700 benign tasks and escalating all 200 ambiguous cases. These results show that secure agent execution requires not only sound individual controls, but explicit contracts that preserve their guarantees across the complete instruction-to-effect path.

Figures & tables

Family	Fault classes	Violated obligation
Root and grant	Untrusted root producer; root authority exceeded; root scope exceeded; root field-constraint bypass	Accepted ingress/issuer, authenticated root grant, bounded operation/resource/field constraints
Provenance and release	Untrusted field binding; provenance drop; provenance value substitution; memory laundering; release predicate bypass; release value substitution; expired release	Signed manifest, leaf-value binding, source continuity, source/value/path/predicate/issuer/expiry-bound release
Identity and topology	Principal substitution; unauthorized stage signer; receipt/producer mismatch	Principal continuity, stage–identity–contract binding, authorized predecessor and receipt producer
Authority and policy	Authority amplification; delegation widening; taint downgrade; policy downgrade; context-root omission	Non-amplification, scope monotonicity, taint monotonicity, policy freshness, model-context commitment
Action semantics	Argument mutation; destination substitution; tool-server swap; effect-class downgrade	Leaf preservation, exact tool/manifest/server binding, exact effect classification
Transform contracts	Missing transform witness; invalid transform witness; contract-guarantee violation	Declared relation, trusted witness, before/after binding, postcondition satisfaction

Table 1: Fault classes in the conformance suite. Each class is instantiated in four domains.

Panel of Figure 1 — Figure 1: Continuity architecture. The planner is outside the trusted path and may propose arbitrary actions. Security comes from authenticated roots, proof-carrying transitions, and a revalidating finality boundary.

Configuration	Effect ASR	Classes	Benign	Ambig.
Pass-through	100.0%	0	100%	0%
Tool allowlist	100.0%	0	100%	0%
Gateway policy	96.9%	4	100%	0%
Provenance gateway	84.4%	20	100%	100%
Effect-bound permit	81.3%	24	100%	0%
Gateway + finality	65.6%	44	100%	100%

Table 2: Main conformance results. “Classes” is the number of contained fault–domain pairs out of 128.

Figure 3: Harmful-effect success and benign auto-completion. The full system preserves benign completion while incomplete compositions remain vulnerable to cross-layer faults.

Ablation	Reopened classes
No field provenance	24
No contract conformance	24
Incomplete mediation	24
No root authentication	16
No release validation	12
No transform-witness validation	8

Table 3: Targeted ablations over 128 fault–domain classes. Zero for one check can indicate redundant containment by another invariant, not irrelevance to the sufficient-condition theorem.

Figure 4: Effect ASR under nonzero targeted ablations. Full CSV results retain the zero-valued redundant ablations.

Operation	p50	p95
Proof verification	4.21 ms	4.91 ms
End-to-end transition + finality	7.17 ms	8.07 ms

Table 4: Reference-prototype latency.

Figure 5: Proof-verification latency versus signed transitions.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Reason family	Meaning
E_UNTRUSTED_ROOT	Chain origin not in trusted ingress set
E_ROOT_*_EXCEEDED	Root authority, scope, class, or field bound exceeded
E_PROVENANCE_VALUE_MISMATCH	Resolved leaf differs from signed manifest claim
E_UNRELEASED_FIELD	Untrusted protected field needs validation/escalation
E_INVALID_RELEASE	Source, value, predicate, task, tool, or expiry check failed
E_UNAUTHORISED_STAGE_SIGNER	Key is not configured for stage/contract

Appendix

Table 9

Claim	Artifact evidence
Root and role enforcement	core.py ; root/role regression tests
Leaf provenance	JSON Pointer tests; provenance substitution tests
Typed release	predicate/value/expiry tests and 300 utility cases
Legitimate transformation	alias witness tests; every normal trace
Effect containment	raw_results.csv , by_fault.csv
Ablations	ablation_raw.csv , ablation_summary.csv

Appendix

Table 10

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 332 papers

A Framework for Formalizing LLM Agent Security
Mar 19, 2026Vincent Siu, Jingxuan He, Kyle Montgomery +4LLM Agent Security Prompt Injection Attacks on AI Agents
UC Santa Cruz · UC Berkeley · Duke University
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany
Agent-Sentry: Bounding LLM Agents via Execution Provenance
Mar 24, 2026Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1Computer-Use Agent Safety AI Agent Security
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA

Mar 19, 2026J/K move · Enter open · S save

A Framework for Formalizing LLM Agent Security

Vincent Siu, Jingxuan He, Kyle Montgomery, Zhun Wang+3

UC Santa Cruz · UC Berkeley · Duke University

LLM Agent Security Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

Security in LLM agents is inherently contextual. For example, the same action taken by an agent may represent legitimate behavior or a security violation depending on whose instruction led to the action, what objective is being pursued, and whether the action serves that objective. However, existing definitions of security attacks against LLM agents often fail to capture this contextual nature. As a result, defenses face a fundamental utility-security tradeoff: applying defenses uniformly across all contexts can lead to significant utility loss, while applying defenses in insufficient or inappropriate contexts can result in security vulnerabilities. In this work, we present a framework that systematizes existing attacks and defenses from the perspective of contextual security. To this end, we propose four security properties that capture contextual security for LLM agents: task alignment (pursuing authorized objectives), action alignment (individual actions serving those objectives), source authorization (executing commands from authenticated sources), and data isolation (ensuring information flows respect privilege boundaries). We further introduce a set of oracle functions that enable verification of whether these security properties are violated as an agent executes a user task. Using this framework, we reformalize existing attacks, such as indirect prompt injection, direct prompt injection, jailbreak, task drift, and memory poisoning, as violations of one or more security properties, thereby providing precise and contextual definitions of these attacks. Similarly, we reformalize defenses as mechanisms that strengthen oracle functions or perform security property checks. Finally, we discuss several important future research directions enabled by our framework.

Abstract

LLM Agent Security

Explore similar work

A Framework for Formalizing LLM Agent Security

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

Agent-Sentry: Bounding LLM Agents via Execution Provenance