Researchers from Southern University of Science and Technology (SUSTech) unveiled ActGov (arXiv:2609.24446), a runtime policy-constrained governance framework designed to enforce strict authorization boundaries over LLM agent tool executions. When agents execute multi-step workflows, untrusted web outputs or file contents often trigger indirect prompt injection attacks, exceeding user intent. Rather than relying on fragile LLM-based self-policing, ActGov pairs an iterative SMT-verified policy compiler (ActGov-Policy) with a lightweight runtime validator (ActGov-Runtime). In evaluations across AgentDojo and AgentDyn benchmarks, ActGov near-completely neutralizes prompt injection threats while preserving full task utility, outperforming static guardrails without latency penalties.

Key Takeaways

  • ✓SMT-verified policy synthesis: ActGov-Policy generates conflict-free authorization policies verified through SMT counterexample checking
  • ✓Pre-execution runtime interception: abstracts tool calls into finite policy records, blocking unauthorized side effects before external impact
  • ✓Model-agnostic determinism: eliminates reliance on LLMs to self-detect malicious instructions, enforcing external formal guarantees
  • ✓Superior safety benchmarks: reduces indirect prompt-injection success rates by over 92% across AgentDojo and AgentDyn with zero utility loss
  • ✓Long-horizon resilience: maintains dynamic task-scoped authorization boundaries across deep multi-step agent execution branches
🔗

Project Links & Resources

Direct Access
Direct access to official project resources and documentation
🌐
ArXiv Preprint (2609.24446)
arxiv.org/abs/2609.24446
↗
🌐
Hugging Face Paper Page
huggingface.co/papers/2609.24446
↗
🔬

In-Depth Technical Analysis

Core Background & Industry Pain Points Autonomous AI agents executing multi-step tool calls routinely process untrusted outputs from web pages, files, and emails. Attackers exploit these channels via indirect prompt injection to hijack agent execution and exceed user authorization. Current defenses either isolate text or employ secondary LLM evaluators—approaches that are easily bypassed by obfuscated adversarial prompts and impose unacceptable latency. ### Architecture Highlights & Internals ActGov introduces an SMT-backed policy enforcement architecture for agent runtimes: 1. Semantic Authorization Model: Maps user intent, tool schemas, and security boundaries into formal declarative constraints; 2. ActGov-Policy (SMT Synthesis): Derives sound, conflict-free policy rules verified through automated SMT (Satisfiability Modulo Theories) counterexample validation; 3. ActGov-Runtime (Pre-Execution Interception): Projects pending tool calls into finite policy records before execution, rejecting any action that violates the task-scoped authorization boundary. ### Authoritative Benchmarks & Measured Scores - Attack Neutralization: Across AgentDojo and AgentDyn benchmarks, ActGov depresses indirect prompt injection success rates from 86.4% down to 1.8%; - Utility Retention: Retains 100% benign task completion accuracy without triggering false-positive lockouts; - Runtime Latency: Interception decision overhead averages under 1.4ms per tool invocation, contributing negligible (<0.02%) runtime friction. ### Developer Hands-on Guide ActGov integrates as a Python decorator around standard agent dispatchers to intercept and validate tool payloads against verified .smt2 policy definitions. Paper: arXiv:2609.24446.