Information Flow Control

Follow this topic Ask about this topic

Information flow control studies how to prevent sensitive or untrusted data from reaching unauthorized destinations or influencing unsafe actions. Systems label data and track its provenance using techniques such as taint analysis, security lattices, capabilities, and type systems, then enforce rules with runtime monitors or policy-aware data infrastructure. For AI agents, these controls can cover tool use, prompt-injection risks, retrieval, persistent memory, and communication between agents, with carefully scoped declassification allowing permitted disclosures. A central challenge is maintaining strong, compositional guarantees across changing workflows and recipients without blocking useful work; benchmarks and formal methods are still catching up with these complex settings.

Latest papers

28 papers7 papers in the last four weeks, up 133% on the four weeks before. 0.0% of all new papers.

SPIDES: Information-Flow Control for Browser Agents
Oct 16, 2026Egor Zverev, Juhee Kim, Leon Trampert +4LLM Agent Security Information Flow Control
ISTA · Microsoft · CISPA Helmholtz Center for Information Security
CascadeLedger: Counterfactual Auditing of Information and Resource Integrity in LLM Cascades
Oct 14, 2026Miaobo Hu, Shuhao Hu, Xiaobo Guo +3Language Model Cascading LLM Auditing
School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China · Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
Oct 12, 2026Sunday Oyinlola Ogundoyin, Muhammad IkramMulti-Agent LLM Systems AI Agent Security
Macquarie University Sydney, NSW, Australia
Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks
Oct 5, 2026James Peters-Gill, Avi Semler, Henning Bartsch +2AI Agent Security Benchmarks Information Flow Control
Independent · University of Oxford · MATS Research +1
G-CARB: Graph-Localized Conformal Agent Risk Budget for Compositional Harm
Oct 4, 2026Zijun Yu, Yu Gu, Vahid Partovi Nia +1AI Agent Safety Conformal Risk Control
Department of Mathematics and Statistics McGill University Montréal, QC, Canada · Department of Mathematics and Industrial Engineering Polytechnique de Montréal Montréal, QC, Canada
Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems
Sep 30, 2026Yunbei Zhang, Saiyue Lyu, Janet Wang +4Multi-Agent Collaboration Information Flow Control
Tulane University · University of British Columbia · Independent Researcher +1
Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle
Sep 28, 2026Sibo LiuLLM Agent Memory Privacy Leakage in Language Models
Independent Researcher
AkasicMEM: Governed Enterprise Memory for Agents
Sep 22, 2026Jeongmin Bae, Yongjae Kim, Kyoung Hur +2Agent Memory Agent Memory Governance
GraphAI Seoul, Republic of Korea
Environment Steering: Using Data Flow Control to Improve Agent Utility and Safety
Sep 19, 2026Charlie Summers, Prajwal Raghunath, Aaditya Pai +4AI Agent Security LLM Agent Safety
Columbia University · University at Buffalo
Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control
Sep 12, 2026Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula +4LLM Agent Security Privacy Leakage in Language Models
University of California, Irvine · University of California, Santa Cruz · University of California, Davis +1
Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
Aug 30, 2026Wujie Xiong, Rabimba Karanjai, Yang Lu +2LLM Agent Security Information Flow Control
Kent State Univeristy · PayPal AI Labs · University of Houston
MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2Multi-Agent LLM Systems LLM Agent Security
1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1
Assuming You Knew: Fixing an Epistemic Semantics for Flow Policies Using Agentic AI
Aug 1, 2026David A. NaumannLogical Reasoning Formal Verification
Stevens Institute of Technology, USA
SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
Jul 28, 2026Haowen Dai, Zonghao Ying, Wenfeng Li +10AI Agent Safety Information Flow Control
University of Nottingham Ningbo China · Beihang University · Shandong University +6
Coordinated Networking for On-Device Agent-Augmented Real-Time Communication
Jul 24, 2026Goodsol Lee, Juheon Yi, Jinglu Wang +3Information Flow Control
Seoul National University · Microsoft Research Asia
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Jul 9, 2026Corban Villa, Alp Eren Ozdarendeli, Sijun Tan +1LLM Agent Security Information Flow Control
UC Berkeley
Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies
Jul 3, 2026Chris Schneider, Kriti Faujdar, Philipp Schoenegger +1LLM Agent Security Information Flow Control
1Microsoft AI · 2Microsoft
Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
Jun 25, 2026Nada Lahjouji, Ashwin Gerard ColacoPrivacy Leakage in Language Models Information Flow Control
University of California, Irvine Irvine, California, USA
AOHP: An Open-Source OS-Level Agent Harness for Personalized, Efficient and Secure Interaction
Jun 22, 2026Shanhui Zhao, Jiacheng Liu, Guohong Liu +13Computer-Use Agents AI Agent Security
Tsinghua University · Peking University · The University of Hong Kong
GIF: Locally Sound Geometric Information Flow Control for LLMs
Jun 22, 2026Adam Storek, Nikolaus Holzer, Zhuo Zhang +1Privacy Leakage in Language Models LLM Security
Columbia University
Data Flow Control: Data Safety Policies for AI Agents
Jun 4, 2026Charlie Summers, Eugene WuAI Agent Security Information Flow Control
Columbia University New York, New York, USA
Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control
May 26, 2026Zhe Yu, Wenpeng Xing, Gaolei Li +4RAG Poisoning Attacks Information Flow Control
Binjiang Institute of Zhejiang University · Zhejiang University · Shanghai Jiao Tong University +3
An Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress
May 20, 2026Alfredo MetereLLM Agent Security AI Agent Monitoring
Enclawed, LLC, California, USA
Language-Based Agent Control
May 13, 2026Timothy Zhou, Loris D'Antoni, Nadia PolikarpovaAI Agent Security Information Flow Control
The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
May 11, 2026Linfeng Fan, Ziwei Li, Yuan Tian +3LLM Agent Security Information Flow Control
Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China · King Abdullah University of Science and Technology, Thuwal, Saudi Arabia · Dongbei University of Finance and Economics, Dalian, China +1
An AI Agent Execution Environment to Safeguard User Data
Apr 21, 2026Robert Stanley, Avi Verma, Lillian Tsai +2AI Agent Security Privacy Leakage in Language Models
University of California, Los Angeles · Google
Free Information Disrupts Even Bayesian Crowds
Apr 2, 2026Jonas Stein, Shannon Cruz, Davide Grossi +1Information Flow Control Opinion Dynamics
Faculty of Behavioural and Social Sciences, University of Groningen, The Netherlands. · Department of Communication Arts and Sciences, The Pennsylvania State University, USA · Bernoulli Institute for Mathematics, Computer Science and Artificial Intelligence, University of Groningen; Amsterdam Center for Law & Economics, University of Amsterdam; Institute for Logic, Language and Computation, University of Amsterdam, The Netherlands. +1
Tracking Capabilities for Safer Agents
Mar 1, 2026Martin Odersky, Yaoyu Zhao, Yichen Xu +2AI Agent Safety Tool Access Control for LLM Agents
EPFL Lausanne, Switzerland

Oct 16, 2026J/K move · Enter open · S save

SPIDES: Information-Flow Control for Browser Agents

Egor Zverev, Juhee Kim, Leon Trampert, Boris Köpf+3

ISTA · Microsoft · CISPA Helmholtz Center for Information Security

LLM Agent Security Information Flow Control Privacy Protection for LLM Agents Prompt Injection Defense AI Agent Security Benchmarks

Open paper AskPDF arXiv

Browser agents automate complex workflows by reading and acting on arbitrary page content, but this flexibility exposes them to prompt injection attacks and unintended data exfiltration. Recent work argues that LLM-driven browser agents erode traditional web security boundaries such as the Same-Origin Policy (SOP) by acting across origins with the user's authority and no built-in isolation. We argue that restoring SOP is neither sufficient (a same-origin public sink can leak private data) nor necessary (legitimate tasks require authorized cross-origin flows) for protecting the security of users. We propose SPIDES, which instead enforces information-flow control by gating primitive browser actions such as typing, clicking and navigating on labels propagated from element-level HTML confidentiality and integrity annotations. Untrusted and confidential content is masked from the agent's context, while policies block unauthorized flows, providing security guarantees against both prompt injection and data exfiltration that hold independently of the model driving the agent. To evaluate SPIDES and baseline defenses under a common threat model, we build MicroNet, a closed ecosystem of 28 interlinked websites with element-level ground-truth labels and paired benign/adversarial tasks. SPIDES achieves 0% attack success rate by design while retaining high task completion rate and autonomy. Our findings demonstrate that information-flow control is an effective technique to extend web security to browser agents, gaining on autonomy and utility against state-of-the-art baselines. The source code and data are openly accessible at https://github.com/microsoft/SPIDES.