CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents

2026-07-31

AI Summary

This work addresses the vulnerability of tool-augmented large language model agents to return-value binding errors and numerical perturbations during runtime authorization, which can lead to unsafe decisions. The authors propose CAGE, a novel framework that identifies, for the first time, the non-composability of independent certification across categorical and numerical channels, and introduces a joint certification approach that precisely enumerates discrete execution branches and certifies continuous perturbations within each branch. CAGE encompasses three techniques—CAGE-Exact (an exact strategy), CAGE-Lip (based on Lipschitz bounds), and CAGE-RS (leveraging randomized smoothing)—which collectively eliminate misauthorizations within prescribed budgets across diverse scenarios while preserving the agent’s decision autonomy, thereby demonstrating both strong safety guarantees and practical utility.

Abstract

Tool-using LLM agents act on typed tool returns, records pairing provenance and categorical fields with numerical values. Runtime permission gates generally authorize the observed return and action, leaving the decision unprotected against small errors in how the return was bound to its source. We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns: one admissible binding fault plus bounded numerical drift. We prove that certifying the categorical and numerical channels separately does not compose: perturbations that are safe on each channel alone can jointly turn the same action unsafe. CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly and certifying the continuous perturbation within each branch. Across synthetic, policy-as-code, regulatory, and real-transaction settings, CAGE removes the in-budget false allows that accurate pointwise gates admit, while keeping a useful fraction of decisions autonomous. When the policy is executable, CAGE-Exact certifies the policy itself; otherwise CAGE-Lip and CAGE-RS certify a learned gate under an explicit, measured fidelity assumption.

Problem

• tool-using agents
• authorization
• typed-return uncertainty
• binding fault
• numerical drift

Innovation

• certified authorization
• typed-return uncertainty
• joint perturbation certification
• tool-using agents
• compositional safety