ai-research-survey

scan.json (24728B)

---

 {
   "paper": {
     "title": "SoK: Trust-Authorization Mismatch in LLM Agent Interactions",
     "authors": [
       "Guanquan Shi",
       "Haohua Du",
       "Zhiqiang Wang",
       "Xiaoyu Liang",
       "Weiwenpei Liu",
       "Song Bian",
       "Zhenyu Guan"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.06914",
     "doi": "10.48550/arXiv.2512.06914"
   },
   "scan_version": 2,
   "active_modules": ["survey_methodology"],
   "methodology_tags": ["meta-analysis", "theoretical"],
   "key_findings": "The paper identifies a fundamental 'Trust-Authorization Mismatch' in LLM agent systems where static permissions are decoupled from runtime trustworthiness. It proposes the Belief-Intention-Permission (B-I-P) framework decomposing agent execution into Belief Formation, Intent Generation, and Permission Grant stages, with a Safety Margin Ratio (SMR) invariant. Surveying 87 papers (from 248 candidates), they find defenses are heavily skewed toward early stages (Belief/Intent) while neglecting the authorization bottleneck. Two case studies demonstrate the framework's analytical utility versus static permission baselines.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides anonymous artifact repositories at https://anonymous.4open.science/r/Paper-76DE/ and https://anonymous.4open.science/r/sok-76C8/ containing the dataset, CSV with bibliographic metadata, and access links."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states 'we have made our complete dataset and artifacts publicly available' including a 'comprehensive CSV file containing the raw bibliographic information and extracted metadata' and literature access links (Sec. 2.5 and Sec. 8)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, dependency files, or software requirements are mentioned. The artifacts are data-only (CSV, links)."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The artifacts are released but there is no README or procedure described for reproducing the systematization or coding results."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey/SoK paper that does not run quantitative experiments. Paper counts and distributions are reported but no statistical estimation is performed."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "No statistical hypothesis testing is conducted; the paper is a systematization of knowledge, not an experimental study."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No effect sizes are relevant; the paper categorizes and maps existing literature rather than measuring effects."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "No quantitative experiments are conducted that would require sample size justification."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experimental runs are performed; variance reporting is not applicable to a survey paper."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares the B-I-P framework against a 'Static Permission Baseline' (SPB) in both case studies (Sec. 5.1.1, 5.2.1), representing the prevailing access control paradigm."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The static permission baseline represents current Android/iOS access control paradigms, which is the contemporary state of practice the paper argues against."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "The B-I-P framework is a conceptual analytical lens, not a system with separable components to ablate."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not run quantitative evaluations with metrics; the case studies are qualitative analyses using the B-I-P framework."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is not relevant to this systematization of knowledge paper."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No quantitative evaluation is performed that would require train/test splits."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Fig. 4 provides a distribution of surveyed papers across B-I-P framework stages (A-S1 through A-S3, D-S1 through D-S3) with counts per category. Table 1 maps literature to trust dimensions."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 ('Opportunities and Fundamental Challenges') discusses where current defenses fail, identifying that defenses are skewed toward early stages and neglect authorization (Sec. 6.3). Sec. 2.4 proves formal failure of static and semi-static permission models."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports negative findings: current defenses fail to bridge the trust-authorization mismatch, defenses are skewed toward Belief/Intent stages while neglecting Authorization (Sec. 6), and semi-static permission models fundamentally reduce to the Halting Problem."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims: (1) surveying 200+ papers — the methodology section describes 248 candidates yielding 87 included; (2) B-I-P framework — formalized in Sec. 3; (3) gap analysis showing defenses skewed toward early stages — supported by Fig. 4 distribution. The '200 representative papers' claim in the abstract is somewhat inflated given 87 included in final corpus, but 'more than 200' may include the broader initial set."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'diverse threats...share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries.' This is an analytical argument, not empirically tested. The B-I-P case studies claim the framework would prevent attacks, but these are hypothetical walk-throughs, not empirical demonstrations."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper's scope statement (Sec. 2.5) bounds to 'runtime interaction security,' but claims like 'permission management is the most practical approach for verifiable constraints' (Sec. 8) and the B-I-P framework are presented as general solutions without bounding to the specific 87 papers analyzed or the specific protocols studied."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents the trust-authorization mismatch as the root cause of agent security failures without considering alternative framings (e.g., that the problem might be better modeled as a capability control problem, an alignment problem, or an information flow problem that doesn't require the B-I-P decomposition)."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper proposes the Safety Margin Ratio (SMR) as a quantifiable security metric but assigns specific numeric values in case studies (e.g., tprov=0.1, treturn=0.2) without discussing how these numbers would be obtained in practice or whether the proxy calculations reflect actual security. The gap between the formal metric and operational security is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use any LLM or AI model in its own methodology; it surveys papers about agent security."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "No prompting is used in the paper's methodology."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments requiring hyperparameters are conducted."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used in the paper's methodology."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A describes the search strategy, inclusion/exclusion criteria, de-duplication process (248 → 184 unique → 81 included), PRISMA-style flow, and coding scheme. The filtering criteria at each stage are stated."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 (Conclusion & Discussion) contains a dedicated 'Limitations' paragraph discussing grey literature reliance, time-sensitivity of ecosystem counts, and the framework's intended scope."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.3 discusses specific threats: venue bias (security incidents in grey literature), temporal drift (ecosystem evolves quickly), and selection bias (mitigated via snowballing). These are specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.5 explicitly states scope: 'We study runtime interaction security of LLM-based agents' and explicitly excludes 'Training-time poisoning/model theft...unless they directly mediate runtime decisions.' The threat model assumptions are also stated."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The paper releases the complete CSV with raw bibliographic data, metadata, and access links at an anonymous repository, enabling independent verification of the corpus."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.3 describes the search strategy: Google Scholar with specific keywords, venues searched (IEEE S&P, USENIX, CCS, NeurIPS, etc.), time window (Jan 2023-Nov 2025), and complementary snowballing."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; the 'sample' is a corpus of academic papers, and data source description is covered under data_collection_described."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.3 documents the pipeline: 279 retrieved → automated de-duplication → 211 unique → title/abstract screening by two reviewers → full-text screening → 102 included → supplemented with 104 from prior surveys. Counts at each stage are provided."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed (BUAA, USTC) with email addresses on the first page."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate any pre-trained model on benchmarks; it is a survey/SoK paper."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "No model evaluation is performed; contamination concerns do not apply to a survey."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No benchmark evaluation is conducted in this survey paper."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey paper."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper's ethics section confirms: 'This work does not involve human subjects at any stage.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Paper inclusion/exclusion criteria are covered under data_integrity."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey/theoretical paper; no system is deployed or evaluated."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey/theoretical paper with no computational experiments."
       }
     },
     "survey_methodology": {
       "prisma_or_structured_protocol": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A describes a PRISMA-style flow (279→211→102), reproducible search strings, venue coverage, inclusion/exclusion criteria, and coding scheme. The paper explicitly mentions 'PRISMA-style flowchart' in Sec. 2.5."
       },
       "quality_assessment_of_sources": {
         "applies": true,
         "answer": false,
         "justification": "The paper categorizes sources by B-I-P stage and records 'evidence level' in the coding scheme, but does not apply a quality scoring rubric or risk-of-bias assessment to included papers. All papers are treated as equally valid within their categories."
       },
       "publication_bias_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of publication bias, funnel plots, or whether the surveyed literature skews toward successful attacks/defenses. The threats to validity (Appendix A.3) mention venue bias and selection bias but not publication bias specifically."
       }
     }
   },
   "claims": [
     {
       "claim": "Static permission sets are undecidable for verifying safety properties of LLM agents (Theorem 1).",
       "evidence": "Formal proof by reduction from the Halting Problem in Sec. 2.4.1. Constructs agent AM,w that executes DELETE_ROOT iff Turing machine M halts on input w.",
       "supported": "moderate"
     },
     {
       "claim": "Semi-static (context-aware) permission models also fail because they reduce to the Halting Problem for a specific input.",
       "evidence": "Argument in Sec. 2.4.2 that predicting multi-step action sequences requires simulating the full execution trajectory. Cites Rice's Theorem for the instruction-as-data problem.",
       "supported": "moderate"
     },
     {
       "claim": "Current defenses are skewed toward early B-I-P stages (Belief/Intent) while neglecting Authorization.",
       "evidence": "Fig. 4 shows paper distribution across stages. Table 1 shows 'N/A (Addressed by Policy)' for all three Stage III defense cells, indicating no concrete defense mechanisms exist for the permission stage.",
       "supported": "strong"
     },
     {
       "claim": "The B-I-P framework would have prevented the Doubao AI Phone account-freezing incident.",
       "evidence": "Case Study I (Sec. 5.1) walks through the scenario, computing SMR=0.2 < θsafe=1.2, which would have blocked the high-frequency clicks. However, this is a hypothetical analysis, not an empirical test.",
       "supported": "weak"
     },
     {
       "claim": "The B-I-P framework would neutralize visual indirect prompt injection attacks.",
       "evidence": "Case Study II (Sec. 5.2) computes SMR=0.027 < θcritical=1.5. Again hypothetical — the numeric values (tprov=0.1, TI=0.3) are assigned by the authors without empirical calibration.",
       "supported": "weak"
     },
     {
       "claim": "The paper surveyed more than 200 representative papers.",
       "evidence": "Abstract says '200 representative papers.' Sec. 2.5 reports 248 candidates, 184 after de-duplication, 81 included in final corpus. Appendix A.3 mentions supplementing with 104 from prior surveys to reach the consolidated set.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Inflated survey count",
       "detail": "The abstract claims 'more than 200 representative papers' but the systematic search yielded only 81 included papers (from 248 candidates). The count reaches 200+ only by adding 104 papers from prior surveys and domain knowledge, which undermines the systematization methodology — these additions bypass the stated inclusion/exclusion criteria."
     },
     {
       "flag": "Hypothetical case studies presented as validation",
       "detail": "Both case studies (Sec. 5) are hypothetical walk-throughs where the authors assign numeric trust/risk values without empirical calibration. The SMR calculations (0.2, 0.027) use author-chosen parameters, making the 'validation' circular — the framework works because the authors chose values that make it work."
     },
     {
       "flag": "Underdefined formalism",
       "detail": "The B-I-P framework's core metrics (tprov, tconf, tcons, ttool, treturn, rconf, rrev, rscope) are defined conceptually but lack operational definitions for computation. The SMR equation T(B,I)/R(P) ≥ θ requires numeric values that the paper does not show how to derive from real systems."
     },
     {
       "flag": "No quality assessment of surveyed papers",
       "detail": "The SoK maps papers to B-I-P stages and records evidence levels but does not assess the methodological quality of included studies. This means weak demonstrations and rigorous empirical work are treated equally in the systematization."
     },
     {
       "flag": "Inconsistent corpus numbers",
       "detail": "Multiple conflicting corpus sizes appear: '248 candidates,' '184 unique items,' '81 papers in final corpus,' '104 papers from prior surveys,' and 'more than 200 representative papers' and 'over 200 papers' in the abstract/conclusion. Appendix says '279 retrieved records' then '211 de-duplicated' then '102 included.' These numbers don't reconcile across sections."
     }
   ],
   "cited_papers": [
     {
       "title": "Large multimodal agents: A survey",
       "authors": ["Junlin Xie", "Zhihong Chen", "Ruifei Zhang", "Xiang Wan", "Guanbin Li"],
       "year": 2024,
       "arxiv_id": "2402.15116",
       "relevance": "Survey of LLM-based multimodal agents, directly relevant to understanding agent capabilities and architectures."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-using agents, key evaluation resource for agent security."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic"],
       "year": 2024,
       "relevance": "Dynamic evaluation environment for agent security, directly relevant to benchmarking agent defenses."
     },
     {
       "title": "AI agents under threat: A survey of key security challenges and future pathways",
       "authors": ["Zehang Deng", "Yongjian Guo", "Changzhou Han"],
       "year": 2025,
       "relevance": "Comprehensive survey of AI agent security challenges, primary related work for this SoK."
     },
     {
       "title": "Trustworthy LLMs: a survey and guideline for evaluating large language models' alignment",
       "authors": ["Yang Liu", "Yuanshun Yao", "Jean-Francois Ton"],
       "year": 2023,
       "arxiv_id": "2308.05374",
       "relevance": "Survey on LLM trustworthiness and alignment evaluation, foundational for the trust dimension of B-I-P."
     },
     {
       "title": "Exploiting programmatic behavior of LLMs: Dual-use through standard security attacks",
       "authors": ["Daniel Kang", "Xuechen Li", "Ion Stoica"],
       "year": 2024,
       "relevance": "Demonstrates Turing completeness of LLM agent loops, key theoretical foundation for the undecidability argument."
     },
     {
       "title": "MCP-Bench: Benchmarking tool-using LLM agents with complex real-world tasks via MCP servers",
       "authors": ["Zhenting Wang", "Qi Chang", "Hemani Patel"],
       "year": 2025,
       "arxiv_id": "2508.20453",
       "relevance": "Benchmark for MCP-based tool-using agents, used in the paper to instantiate tool provenance trust metrics."
     },
     {
       "title": "Gorilla: Large language model connected with massive APIs",
       "authors": ["Shishir G Patil", "Tianjun Zhang", "Xin Wang", "Joseph E Gonzalez"],
       "year": 2024,
       "relevance": "Foundational work on LLM-API integration relevant to tool invocation security."
     },
     {
       "title": "ChatInject: Abusing chat templates for prompt injection in LLM agents",
       "authors": ["Hwan Chang", "Yonghyun Jun", "Hwanhee Lee"],
       "year": 2025,
       "arxiv_id": "2509.22830",
       "relevance": "Demonstrates chat template exploitation for prompt injection, relevant to agent security evaluation."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra"],
       "year": 2023,
       "relevance": "Seminal work on indirect prompt injection in LLM applications, foundational attack vector for agent security."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Key work on adversarial attacks against aligned LLMs, relevant to jailbreak and safety evaluation."
     },
     {
       "title": "HaluEval: A large-scale hallucination evaluation benchmark for large language models",
       "authors": ["Junyi Li", "Xiaoxue Cheng", "Wayne Xin Zhao"],
       "year": 2023,
       "arxiv_id": "2305.11747",
       "relevance": "Hallucination evaluation benchmark used to instantiate the cognitive certainty (tconf) metric."
     }
   ]
 }