Towards Security-Auditable LLM Agents: A Unified Graph Representation
Chaofan Li, Lyuye Zhang, Jintao Zhai, Siyue Feng, Xichun Yang, Huahao Wang, Shihan Dou, Yu Ji, Yutao Hu, Yueming Wu, Yang Liu, Deqing Zou
Why It Matters
What makes this one worth your time
As LLM-based systems become more complex and autonomous, ensuring their security through effective auditing mechanisms is crucial for preventing and understanding security breaches.
Agent-BOM provides a unified graph-based framework for auditing security in LLM-based agentic systems.
Summary
The paper introduces Agent-BOM, a unified graph representation for security auditing of LLM-based agentic systems, addressing the semantic gap between low-level events and high-level execution intent. It models agentic systems as hierarchical attributed directed graphs, enabling path-level risk assessment and root-cause analysis of security incidents.
Key contributions
- Proposing Agent-BOM, a unified structural representation for security auditing.
- Developing a graph-query-based paradigm for path-level risk assessment.
- Implementing an auditing plugin in the OpenClaw environment to construct Agent-BOM from live executions.
Notable insights
- The use of a hierarchical attributed directed graph to separate static and dynamic components of agentic systems for security auditing.
- The transformation of fragmented execution traces into queryable audit paths for comprehensive risk assessment.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2605.06812v1 Announce Type: new Abstract: LLM-based agentic systems are rapidly evolving to perform complex autonomous tasks through dynamic tool invocation, stateful memory management, and multi-agent collaboration. However, this semantics-driven execution paradigm creates a severe semantic gap between low-level physical events and high-level execution intent, making post-hoc security auditing fundamentally difficult. Existing representation mechanisms, including static SBOMs and runtime logs, provide only fragmented evidence and fail to capture cognitive-state evolution, capability bindings, persistent memory contamination, and cascading risk propagation across interacting agents. To bridge this gap, we propose Agent-BOM, a unified structural representation for agent security auditing. Agent-BOM models an agentic system as a hierarchical attributed directed graph that separates static capability bases, such as models, tools, and long-term memory, from dynamic runtime semantic states, such as goals, reasoning trajectories, and actions. These layers are connected through semantic edges and security attributes, transforming fragmented execution traces into queryable audit paths. Building on Agent-BOM, we develop a graph-query-based paradigm for path-level risk assessment and instantiate it with the OWASP Agentic Top 10. We further implement an auditing plugin in the OpenClaw environment to construct Agent-BOM from live executions. Evaluation on representative real-world agentic attack scenarios shows that Agent-BOM can reconstruct stealthy attack chains, including cross-session memory poisoning and tool misuse, capability supply-chain hijacking and unexpected code execution, multi-agent ecosystem hijacking, and privilege and trust abuse. These results demonstrate that Agent-BOM provides a unified and auditable foundation for root-cause analysis and security adjudication in complex agentic ecosystems.