Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework

TL;DR

This paper introduces SEAgent, a mandatory access control framework that enhances security in LLM-based agent systems by preventing privilege escalation attacks through attribute-based monitoring and policy enforcement.

Contribution

It presents a formal model of privilege escalation in LLM agents and proposes SEAgent, a novel MAC framework utilizing attribute-based access control to mitigate these vulnerabilities.

Findings

SEAgent effectively blocks privilege escalation attacks.

Maintains low false positive rate.

Negligible system overhead.

Abstract

Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks but remain vulnerable to natural language-based attacks that exploit over-privileged tool use. This paper aims to understand and mitigate such attacks through the lens of privilege escalation, defined as agent actions exceeding the least privilege required for a user's intended task. Based on a formal model of LLM agent systems, we identify novel privilege escalation scenarios, particularly in multi-agent systems, including a variant akin to the classic confused deputy problem. To defend against both known and newly demonstrated privilege escalation, we propose SEAgent, a mandatory access control (MAC) framework built upon attribute-based access control (ABAC). SEAgent monitors agent-tool interactions via an information flow graph and enforces customizable security policies based on entity attributes. Our evaluations show that SEAgent effectively blocks various privilege escalation while maintaining a low false positive rate and negligible system overhead. This demonstrates its robustness and adaptability in securing LLM-based agent systems.