Showing cs.CRShow all
3 papers · 1 filter
cs.CR2026
Instruction Self-Arbitration Is Not a Trust Boundary: Configuration-Dependent Tool Calls and External Enforcement in LLM Agents
Jun Wen Leong
LLM agents receive instructions from system prompts, users, memory and tools, and labels inside a shared context are not an enforceable trust boundary. We study how measurement and…
cs.CR2026
Retrieval Observability Bounds on Provenance Detection for Agent Memory Poisoning: Measured Coverage and a Falsified Standalone Detector
Jun Wen Leong
Whether a trajectory-based detector can observe the retrieval provenance of an agent memory-poisoning attack is governed by one architectural variable: retrieval observability, whe…
cs.CR2026
Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
Jun Wen Leong
In LLM agents with persistent memory, whether a model stores an injected instruction and whether it later acts on it are separable safety properties. We call this the injection-exe…