ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore

TL;DR

ACRFence is a framework-agnostic solution designed to prevent semantic rollback attacks in LLM agent checkpoint-restore processes by recording irreversible effects and enforcing replay or fork semantics.

Contribution

The paper introduces ACRFence, a novel mitigation framework that addresses semantic rollback attacks in LLM agents by tracking irreversible effects and ensuring safe re-execution.

Findings

Validated two attack classes: Action Replay and Authority Resurrection.

Demonstrated that semantic rollback attacks can cause irreversible side effects.

ACRFence effectively prevents these attacks by enforcing replay-or-fork semantics.

Abstract

LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects; we term these semantic rollback attacks. We identify two attack classes, Action Replay and Authority Resurrection, validate them in a proof of concept experiment, and confirm that the problem has been independently acknowledged by framework maintainers. We propose ACRFence, a framework-agnostic mitigation that records irreversible tool effects and enforces replay-or-fork semantics upon restoration