LLM-agent security shows identical attack failure rates but different guarantees
The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security
Cryptography and SecurityComputation and Language
Summary
LLM-agent security uses different methods to protect AI assistants, but it’s unclear what each method really guarantees. The authors used a special classification system to compare 22 defenses and tested two defense setups in many attack scenarios. They found that two setups both stopped attacks, but only one kept helping normal users work efficiently. This shows that having zero attacks doesn’t always mean the same level of security, depending on the defense’s underlying guarantees.
What this means in practice
- •For ai security engineers: Choose and combine security defenses for AI agents based on clear guarantees, improving trust in deployed protections under attack.
- •For software testers: Design realistic testing scenarios for adaptive attacks to evaluate AI agent defenses' true effectiveness beyond just zero attack outcomes.
Authors
YaJie Yin
Abstract
LLM-agent security has produced a dense landscape of defenses - prompt hardening, content filters, permission gates, sandboxes - yet no framework tells a deployer what a defense actually guarantees, or where that guarantee comes from. We apply Verification Autonomy Levels (VAL) - L0: LLM self-declaration; L1: deterministic rules; L2: objective ground truth; L3/L4: decidable completeness; L5: impossible - to 22 agent-security defenses; the taxonomy is falsifiable (10/10 prediction hits on frozen cards, flagged). We run the first controlled deployment-value comparison: at equal budget, a VAL-guided stack (confirmation gate + schema sandbox) versus a mainstream intuition stack (prompt hardening + keyword filter), 50 scenarios, 12 attack variants, adaptive/white-box/PAIR escalation (~7,000 testbed calls; ~10,000 harness calls on AgentDojo/JADE). The VAL stack holds 0.000 attack success at 1.000 benign success (0.5% ASR at 79.7% utility on AgentDojo banking vs 4.3% undefended); the intuition stack reaches 0.000 ASR but kills all benign actions - security by model-behavior luck, not structure. Across testbeds of rising attack-surface hardness the intuition stack's zero drifts (0->1.9%->6.2%, n=16 on JADE) while the VAL stack's holds within its ODD (0->0->0), its only breach a disclosed out-of-ODD password gap (0.5%). The same zero, two different guarantees: zero is an outcome, not a guarantee.