4 papers
Instruction Self-Arbitration Is Not a Trust Boundary: Configuration-Dependent Tool Calls and External Enforcement in LLM Agents
Jun Wen Leong
LLM agents receive instructions from system prompts, users, memory and tools, and labels inside a shared context are not an enforceable trust boundary. We study how measurement and…
Retrieval Observability Bounds on Provenance Detection for Agent Memory Poisoning: Measured Coverage and a Falsified Standalone Detector
Jun Wen Leong
Whether a trajectory-based detector can observe the retrieval provenance of an agent memory-poisoning attack is governed by one architectural variable: retrieval observability, whe…
Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers
Jun Wen Leong
We study three failure modes of deployed safety classifiers: distribution shift, targeted evasion, and invalid scores from reasoning-model monitors. A reduced 800-cell subset of a…
Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
Jun Wen Leong
In LLM agents with persistent memory, whether a model stores an injected instruction and whether it later acts on it are separable safety properties. We call this the injection-exe…