Blindfold: Keeping the Audit Coin Secret from LLM Agents

Summary

Audit-based certification bounds an LLM agent's violation rate by auditing a random fraction of actions, but its validity also depends on the audit coin staying hidden from the agent before the action commits. The authors call this pre-commit noninterference (PNI), measure its violation by the total-variation distance D_A between the agent's views under the two coin values, and show the worst-case bias is (1-ε)D_A. In experiments, a visible audit notice let a real LLM agent detect audits and follow an injection that named it, so the plain certificate failed, while a silent audit restored validity.

Mitigation

A fresh coin per audited call closes the timing channel; padding only narrows it.

Related items

• InfoProgram-Level Adversarial Co-Adaptive Self-Play for Robotic SecuritySimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoNameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable NamesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoWildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image ProcessingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoWhere AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden VulnerabilitiesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)