SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

SEAD. A State-Based Perspective on Attack and Defense in Tool-Using Agents. By Xinjie Shen and three others, from the Georgia Institute of Technology. Published on the twenty-eighth of September. Its code repository is worked out: about two hundred and fifty source files, with a readme and a licence.

Language-model agents increasingly use tools to act on external systems. Earlier actions can alter files, permissions, database records, or other state, and that can make a later, routine-looking action harmful. Yet the visible interaction may not reveal the underlying state needed to judge that action. Looking at the request alone, the harm cannot be seen.

SEAD formulates attack and defense together, as control of a partially observed state, and derives the design requirements of each side from the execution process they share. Two asymmetries follow. Attackers supply instructions, but the target chooses the concrete actions. And the defender has to decide before an action executes, with incomplete evidence about the state. The attacker cannot dictate actions, only shape the instructions that lead to them. The defender cannot wait to see the result, and cannot see the whole state when it decides. Each system is designed around its own side of that gap.

Each side gets its own system. On the attack side, DART decomposes a harmful goal into steps that each look plausible locally, and uses feedback from actual tool execution to guide its search over trajectories. On the defense side, SAGE investigates the relevant state through read-only queries before it allows or blocks each action, including actions proposed after an earlier block. To test both, the authors construct a dataset that can be verified in the environment, combining controlled initial states, replayable tool environments, and executable checks specific to each task.

Across four target models, DART improves semantic attack success by between eighteen point eight and thirty-five point nine percentage points over the competing baseline, and the gains hold under executable verification.

On recorded trajectories, SAGE preserves ninety-five point seven nine percent of benign trajectories, while intercepting ninety-two point seven three percent of harmful paths by the harm-enabling boundary. In online evaluation against DART, it cuts executable attack success from forty-eight percent to four percent. SAGE stays effective across four attack methods, and generalizes to environments outside its domain. The same defender, in other words, cuts the authors' own attack to a small fraction of its success while leaving nearly all benign work alone.

Both halves rest on one point. The harm sits in the state, not in the wording of any one step, so an attacker can spread it across steps and a defender has to go and look before letting an action through. SAGE's read-only queries are that looking, made explicit.