Tenant isolation improves security for large language model tools
The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents
Cryptography and SecurityArtificial IntelligenceDatabasesSoftware Engineering
Summary
When large language model (LLM) agents use tools shared by multiple users, making sure each user sees only their own data is tricky. The authors identify a security issue where attackers can trick the system by sneaking tenant info inside instructions. They propose a new design that removes tenant identifiers from the messages passed to tools and instead uses verified credentials to control access. Their experiments show this method blocks many attempts to access data outside a user's scope, but emphasize that cryptographic protections are needed to fully keep interfaces safe.
What this means in practice
- •For cloud service engineers: Build multi-tenant AI tools that reliably prevent user data leakage by removing tenant identifiers from requests and verifying credentials instead.
- •For database administrators: Optimize tool response times for tenant-scoped queries by using indexed JSON_TABLE lateral joins instead of set-valued scopes under function-wrapped membership tests.
Authors
Mirza Samad Ahmed Baig, Syeda Anshrah Gillani, Asher Ali, Muhammad Hamzah Siddiqui
Abstract
Multi-tenant tools commonly accept a tenant identifier and validate it against the caller's entitlement. For a large language model (LLM) agent, that pattern delegates resource selection to a process whose context may contain attacker controlled instructions. We formalize this stochastic deputy problem and present a structural defense: remove tenant identity from the Model Context Protocol (MCP) tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation across eight model configurations and two transports, a correctly validated tenant parameter served every out-of-scope attempt: 26 of 26, or 26 of 41 plausible-pretext trials overall. With the parameter removed, no tool signature could express the read. Twelve of 56 trials instead escaped the interface by forging writable scope, showing that interface invariance requires cryptographically protected context. On a production dataset containing multiple GBs of data, set-valued scope caused a measured $57\times$ latency ratio under function-wrapped membership predicates; a JSON_TABLE lateral join recovered index access where the tenant key was indexed. The evaluation also exposes deployment limits, including an entitlement-size query-planner cliff and incomplete index coverage. The result is a tenant-isolation argument that depends on enforceable interfaces and credentials rather than model compliance.