Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions
Huihao Jing, Wenbin Hu, Shaojin Chen, Haochen Shi, Sirui Zhang, Hanyu Yang, Changxuan Fan, Zhongwei Xie, Hongyu Luo, Wun Yu Chan, Wei Fan, Haoran Li, Yangqiu Song
Why It Matters
What makes this one worth your time
Understanding and improving the safety of LLM-agent systems is crucial as these systems become more integrated into real-world applications, where failures can have significant consequences.
Isolation is proposed as a key principle for LLM-agent system safety, with a boundary-centric taxonomy to address safety challenges.
Summary
The paper proposes treating isolation as a fundamental principle for ensuring the safety of LLM-agent systems, organizing the literature with a taxonomy based on five boundaries to identify where isolation loss occurs and how compromises propagate.
Key contributions
- Proposes isolation as a first-class principle for LLM-agent system safety.
- Develops a boundary-centric taxonomy to organize literature and identify safety challenges.
- Outlines a research agenda for isolation-by-construction in future agent systems.
Notable insights
- The paper introduces a boundary-centric taxonomy to systematically address safety issues in LLM-agent systems.
- Isolation is highlighted as a critical factor in preventing the spread of compromises across system boundaries.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2607.12406v1 Announce Type: new Abstract: The capability of LLM agents to function as the ``brain'' of a system fundamentally expands the scope of analysis beyond a standalone model. Consequently, safety is no longer only about input--output content alignment. It also concerns system behavior and real-world execution outcomes. However, the current literature is fragmented across attack types, applications, and benchmarks. This makes it hard to explain why failures such as prompt injection, tool misuse, and memory poisoning often share the same structural cause, and how they spread through an agent workflow. In this survey, we treat isolation as a first-class principle for LLM-agent system safety. By isolation, we refer to the separation of user inputs, tool access, execution channels, inter-agent communication, and environment-originated context. We organize the literature with a boundary-centric taxonomy of five boundaries: user-agent, agent-tool, agent-execution, agent-agent, and system-environment. This view helps identify where the loss of isolation first occurs, how compromise propagates across boundaries, and which defenses are most relevant at each interface. We also summarize cross-boundary failure paths, discuss open challenges, and outline a research agenda for isolation-by-construction in future agent systems.