Skip to content

Back to the catalog

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
arxiv.orgpaper

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

This paper identifies security-context discontinuity, a failure mode where individually correct LLM agent security mechanisms such as provenance tracking, authorization, policy enforcement, and protocol adapters fail to compose safely because security-critical context gets dropped, widened, rebound, or reinterpreted as actions cross component boundaries. The authors introduce CONTINUITY, a framework modeling each component with assume-guarantee contracts and carrying authenticated context via signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits, formalizing end-to-end consequence integrity. A reference verifier and cross-layer fault-injection suite covering 32 fault classes across four domains was evaluated on 2560 attack instances, 700 benign tasks, and 200 ambiguous cases, with the full configuration blocking all harmful effects while passing benign tasks and correctly escalating ambiguous ones.

TL;DR A formal contract-based framework for verifiably composing LLM agent security controls so context is not lost or reinterpreted across component boundaries.
Open original ↗
Document

What it is

Paper by Chris Zheng and Geng Yang (ZAST.AI), September 2026, arXiv:2609.05269. The existing summary has the thesis. What it omits: the artifact is at github.com/zast-ai/continuity (CC BY 4.0), a dependency-light Python implementation with a 1.5-KLOC trusted core, 30 regression tests, seven reference configurations, and reproducibility scripts. If you are evaluating whether to build on this, that's the thing to clone.

How it works

The trusted core rests on concrete primitives, not abstractions: Ed25519 signatures and SHA-256 (the stated crypto assumptions — the adversary cannot forge under an uncompromised key or break collision resistance), JSON Pointer (RFC 6901) leaf paths, and a restricted deterministic JSON encoding with RFC 8785 named as the interoperability target (not yet implemented). A key is trusted only for its configured role — holding a registered component key does not let it originate a chain, issue a root grant, or sign a release.

The load-bearing idea is the transformation witness. In the paper's payment example, a gateway approves payment.transfer to alias:merchant:9; an adapter resolves the alias. A name-based tool allowlist and an after-the-fact action-bound permit both pass even if the adapter emits bankacct:attacker, because the operation name is unchanged. Continuity instead requires an independent directory witness binding before-value, after-value, relation, component, contract, task, and expiry — a compromised adapter cannot forge one. This is why the design does not simply forbid all field changes.

The numbers the summary drops

  • The strongest incomplete reference configuration commits a harmful effect in 65.6% of attack instances — the headline argument for why composition, not individual controls, is the problem.
  • Targeted ablations reopen 4–24 fault–domain classes depending on the omitted invariant.
  • Full evaluation: 3,460 scenarios / 24,220 system–scenario runs, across 128 fault–domain classes.
  • Performance: median proof verification 4.21 ms; median end-to-end (transition production, verification, permit issuance, finality) 7.17 ms on the recorded host.

Caveats (stated by the authors)

  • These are deterministic conformance results under an explicit TCB model, explicitly not an estimate of real-world attack probability and not a claim to solve semantic correctness or prompt injection. A malicious planner can still produce harmful text, bad advice, or DoS.
  • The directory issuer's mapping semantics are inside the TCB — the verifier checks the attested mapping satisfies the configured relation, it does not discover the true alias mapping itself. Compromise of a root/origin key defeats everything rooted in it.
  • The artifact is protocol-neutral and claims no production integration with MCP or OWASP's Agent Control Standard.

Technologies named here

  • CONTINUITY
  • CONTINUITY reference verifier
  • Deterministic cross-layer fault-injection suite
  • LLM

Techniques named here

  • Security-context discontinuity

Related in AI Security