Skip to content

Back to the catalog

Only What You've Signed up For: Secure Workflows with Constrained Diffusion Agents
arxiv.orgpaper

Only What You've Signed up For: Secure Workflows with Constrained Diffusion Agents

Introduces Policy-Constrained Diffusion Agents (CoDA), which enforces task-dependent security policies inside the denoising process of diffusion language models. At each step, token distributions are projected onto a policy-compliant set, so constraints hold throughout generation instead of relying on detecting injected instructions. Evaluated across several dLLM families under static and adaptive prompt-injection attacks, it reports substantially lower attack success rates with competitive task utility and practical inference overhead.

TL;DR CoDA constrains diffusion LLM agents during denoising to enforce security policies, cutting prompt-injection attack success including adaptive attacks.
Open original ↗
Document

What it is

CoDA (Policy-Constrained Diffusion Agents) is a training-free decoding-time defense against prompt injection for tool-using agents built on diffusion language models (dLLMs). It does not try to spot the injection. It enforces a task-level policy on the tool call the model emits, so a hijacked call is excluded from the allowed output set.

How it works

  • A policy S_u is derived from the trusted user task and context only, never from untrusted tool output. It allows or disallows tools and their security-sensitive arguments, such as recipients, destinations, URLs and accessed resources. It does not say how to complete the task.
  • At each reverse denoising step, CoDA takes the model's clean-state prediction and identifies the policy-relevant token span (for example, the recipient field). It projects that span's token distributions onto policy-compliant values and feeds the corrected proposal into the next reverse update.
  • Unconstrained parts of the output evolve normally, and constrained spans can be revised repeatedly. The paper argues this is the advantage over autoregressive decoding, which can only enforce prefix-compatible constraints left to right.
  • It covers masked diffusion (absorbing [MASK] state) and uniform diffusion (positions stay revisable). The paper says it uses "architecture-specific regeneration mechanisms" for each, and the fetched text does not detail them.
  • The paper's example is a user asking to share a Q3 report with Alice as view-only. An injected instruction asks for a public link with edit access for an external address. The projection forces recipient=Alice, permission=view_only, scope=private.

Preconditions / Affected

  • You must run a dLLM and control its decoding loop. The paper names LLaDA2 and DiffusionGemma as model families in this space. It does not say which models it evaluated.
  • You need a policy generator that produces correct task-level policies from the trusted user instruction. CoDA treats policy construction as an upstream input.
  • Coverage is limited to what the policy expresses: tool choice and security-relevant arguments.

Caveats

  • The headline result, 0% attack success rate including under adaptive attacks, holds with oracle policies, or "when the policy generator is accurate."
  • With LLM-selected policies the paper describes a security-utility frontier. Policy selection errors cost either security or utility. The fetched text does not give those figures.
  • The page text is truncated mid-method, so the projection operators, benchmarks, overhead numbers and model list were not available to check.
  • The paper says it is the first work to enforce behavioral security policies inside dLLM decoding. That claim is the authors' own.

Organisations named here

  • adaptive attacks
  • CoDA
  • Policy-Constrained Diffusion Agents

Technologies named here

  • Agentic AI systems
  • diffusion language models

Techniques named here

  • Policy-constrained denoising
  • Prompt Injection

Related in AI Security