LeaseGuard prevents unauthorized resource takeover by privileged AI agents
LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents
Cryptography and Security
Summary
Sometimes, powerful AI programs can take control of files or resources that other healthy programs are using, causing problems. The authors created LeaseGuard, a system that carefully checks whether an AI agent should be allowed to take over these resources, protecting the current users. It uses special resource 'leases' and health checks to decide who can run tasks. Tests show it stops nearly all unauthorized takeovers while still letting AI tasks finish safely. This helps keep important programs running smoothly alongside advanced AI helpers.
What this means in practice
- •For system software developers: Control AI task access to shared system resources to avoid disrupting healthy running programs.
- •For cloud infrastructure teams: Improve resource scheduling to prevent AI jobs from preempting important processes in shared environments.
Authors
Junru Zhu, Yixin Yang, Xiaoqing Ding, Ruoyu Qi
Abstract
Privileged language-model agents can satisfy a new system task by displacing a healthy incumbent that depends on the same file, process, socket, lock, or capacity allocation. This failure arises because execution privilege determines whether an operation can run, not whether the requester may preempt the current resource owner. We present LeaseGuard, a deterministic admission layer that represents preemption authority through canonical resource leases, incumbent-health checks, effect-aware admission, coexistence limits, safe alternatives, and resource-scoped overrides before adapter execution. We evaluate it on a frozen benchmark of 60 newly authored conflict scenarios with matched controls across two local model families. Relative to a preservation prompt, LeaseGuard reduces unauthorized preemption from 73.3% to 0.0% and increases safe completion by 70.0 percentage points (scenario-clustered 95% CI [60.8, 79.2]). Requested-task success changes by -3.3 points (95% CI [-9.2, 2.5]). The fully evaluated v0.2 broker also rejects a forged incumbent task identity in a hash-linked stress audit. Expiry-only reclamation can still expose a healthy incumbent after missed renewal. The evidence supports incumbent-preserving admission when effects are completely mediated, task ownership is authenticated, and lease expiry reflects incumbent liveness.