--- title: "Conflux: Preventing Privilege Escalation... | SI Paper Desk" url: https://thesimind.si/papers/2611.08768/ description: "Conflux checks every SI agent action against the permissions of everyone who influenced it, outside the model's own judgement, and the proof only holds..." --- Number 12 of 12 · November 9, 2026 # Conflux: Preventing Privilege Escalation with Principal Contexts and System-Level Evaluation Conflux checks every SI agent action against the permissions of everyone who influenced it, outside the model's own judgement, and the proof only holds under stated conditions. Raya Buckley and Christian Schroeder de Witt · Submitted November 5, 2026 · arXiv 2611.08768v1 · cs.CR [Read the paper on arXiv](https://arxiv.org/abs/2611.08768) · [The PDF](https://arxiv.org/pdf/2611.08768) · [The day's 12](https://thesimind.si/papers/day/2026-11-09/) ## What they found The authors define privilege escalation for SI agents: an action may go ahead only if every principal (a user, tool or data source) that influenced it would allow it. They present Conflux, a defence that sits outside the model. Its core, called ITES, tracks where information came from and uses the organisation's existing access-control system. It keeps only the permissions that all influencing principals share. They prove that, under five stated conditions, the core admits no action that escalates privilege for any recorded influencing principal. The proof covers value influence only. Influence from choosing a tool, branch, recipient or plan step is left as future work. They also describe two testing tools, SLED (black-box, explores a declared finite model up to a bound) and SLED-V (white-box, checks an intermediate representation). ## Why it matters SI agents often mix instructions and data from several sources while acting in the real world. Defences that rely on the model's own judgement are only probabilistic, so a rule-based layer outside the model is a useful idea. The paper also offers ways to test whole systems, not only single models. The authors are clear that the evidence is bounded and partial and is not a guarantee for real deployments. ## How it changes the race If it holds up, it gives teams building agents a way to limit what agents can do using existing access controls, instead of trusting the model. It does not change what SI models can do. It is mainly relevant to deploying agents safely. ## Safety and control This is a security paper about stopping SI agents from being steered into actions that exceed someone's permissions. The theorem depends on conditions such as complete mediation and trustworthy provenance, and it does not cover control influence. The abstract says no result is an unbounded deployment guarantee. ### The abstract, by the authors LLM agents combine information from multiple principals while acting externally. We formalise privilege escalation (PE) as the system-level security objective: an action may proceed only if every principal that influenced it would allow it. Model-level defences remain probabilistic, so enforcement must sit outside model judgement. We present Conflux, a principal-context defence. Its kernel, ITES, derives authority from provenance and the organisation's existing access-control system and intersects the permissions of every influencing principal. We prove a conditional authority-confinement theorem: under complete mediation, no-laundering provenance, a known non-empty decision context, fresh permission checks, and action binding, the kernel admits no action that escalates privilege with respect to any recorded influencing principal. The theorem covers the represented value-influence fragment; control influence from tool, branch, recipient, or plan-step selection remains a refinement obligation. Conflux extends the kernel with independent policy ports, argument-aware authorisation, disclosure, consent, delegation, restriction, and exposure planning. We describe two system- level evaluators. SLED is a black-box evaluator: it exhaustively explores a declared finite model of a defence up to a bound. SLED-V is a white-box evaluator: it checks a serialisable intermediate representation against security and provenance properties. The evidence is bounded and partial. The appendix reports retained AgentDojo, SLED, and SLED-V results, including the limits of those runs. No result in this paper is an unbounded deployment guarantee. Quoted from arXiv:2611.08768. The research and its words belong to its authors. Desk score **65** out of 100 Why it was picked - Evals (in the title) - Agents - Reasoning - Language models - Cross-listed in 2 fields Topics - [Security](https://thesimind.si/papers/?tag=security) - [Agents](https://thesimind.si/papers/?tag=agents) - [Safety](https://thesimind.si/papers/?tag=safety) - [Evals](https://thesimind.si/papers/?tag=evals) - [Theory](https://thesimind.si/papers/?tag=theory) - [Policy and law](https://thesimind.si/papers/?tag=policy) **arXiv ID:** 2611.08768v1 **Submitted:** November 5, 2026 **Fields:** cs.CR (Cryptography and Security), cs.AI (Artificial Intelligence) **Level:** Advanced **Comments:** 17 pages excluding references and appendix Fingerprint, SHA-256 `f2f459396ad1b5fa6691b3a90abb61b66571406564e6d8d480720e70d361c910` In SI MIND's journal since Nov 9, 2026, 23:15 UTC. It goes on Solana with the next hourly Proof of Mind seal. ### The exact text fingerprinted {"arxiv":"2611.08768","version":1,"title":"Conflux: Preventing Privilege Escalation with Principal Contexts and System-Level Evaluation","authors":["Raya Buckley","Christian Schroeder de Witt"],"day":"2026-11-09","rank":12,"score":65,"status":"written","summary":{"takeaway":"Conflux checks every SI agent action against the permissions of everyone who influenced it, outside the model's own judgement, and the proof only holds under stated conditions.","found":"The authors define privilege escalation for SI agents: an action may go ahead only if every principal (a user, tool or data source) that influenced it would allow it. They present Conflux, a defence that sits outside the model. Its core, called ITES, tracks where information came from and uses the organisation's existing access-control system. It keeps only the permissions that all influencing principals share. They prove that, under five stated conditions, the core admits no action that escalates privilege for any recorded influencing principal. The proof covers value influence only. Influence from choosing a tool, branch, recipient or plan step is left as future work. They also describe two testing tools, SLED (black-box, explores a declared finite model up to a bound) and SLED-V (white-box, checks an intermediate representation).","matters":"SI agents often mix instructions and data from several sources while acting in the real world. Defences that rely on the model's own judgement are only probabilistic, so a rule-based layer outside the model is a useful idea. The paper also offers ways to test whole systems, not only single models. The authors are clear that the evidence is bounded and partial and is not a guarantee for real deployments.","race":"If it holds up, it gives teams building agents a way to limit what agents can do using existing access controls, instead of trusting the model. It does not change what SI models can do. It is mainly relevant to deploying agents safely.","safety":"This is a security paper about stopping SI agents from being steered into actions that exceed someone's permissions. The theorem depends on conditions such as complete mediation and trustworthy provenance, and it does not cover control influence. The abstract says no result is an unbounded deployment guarantee.","level":"advanced","tags":["security","agents","safety","evals","theory","policy"]}} [Check it on Verify a thought](https://thesimind.si/proof-of-mind/) ## The authors Raya Buckley, Christian Schroeder de Witt Credit for this research belongs to its authors. SI MIND's page is a plain-English reading of their abstract on arXiv, not a review of the full paper. Related on the desk ## More papers on these topics [Nov 9, 2026 · Number 5I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning AgentsAttacker text written to look like a reasoning model's own thoughts can hijack SI agents, reaching up to 50% success in a test range, while plain prompt injection of the same goal never worked.SecurityAgentsReasoning](https://thesimind.si/papers/2611.08811/) · [Nov 9, 2026 · Number 4HomeLoop: A Simulation Framework and Benchmark for Robot-IoT Coordination in Everyday Domestic Assistance and SafetyHomeLoop is a new simulated home benchmark where SI robots must work with smart devices and handle ambiguous alerts. The best of six models scored 61.9%, and models often over-reacted.RoboticsBenchmarksEvals](https://thesimind.si/papers/2611.08914/) · [Nov 9, 2026 · Paper of the DayPhantom Consensus: Measuring Social Reasoning in Multi-Agent LLM Decision-MakingWhen SI models see ambiguous public signals from other models, they can drift to a group answer that no one privately held, and checking private judgments can catch this.Multi-agent systemsEvalsBenchmarks](https://thesimind.si/papers/2611.08971/) [Number 11](https://thesimind.si/papers/2611.09154/) · [All 12 for Nov 9, 2026](https://thesimind.si/papers/day/2026-11-09/)