A finance or travel assistant may use an authorized tool and nevertheless send it an attacker-chosen recipient. AuthorityFlow traces which source had authority to set each consequential field. It treats a retrieved document as evidence for content, not as permission to replace the original customer mandate. The 144 scenarios are synthetic and the authority…
Inspect the ClaimsCase · DiggingBeagle record
AuthorityFlow checked the authority behind tool arguments, not only tool selection
A simulated parameter-poisoning benchmark tested authorization of recipient and other consequential fields.
Public disclosure: Nov 3, 2026
Scope
Controlled parameter-poisoning tests in banking, workspace, travel and collaboration examples.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The authors measured attacks and utility on their 144 paired FactAuthBench cases; no independent bank deployment, calibrated authorization proof or external reproduction is presented. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AUTHORITYFLOW-TOOL-ARGUMENT-PROVENANCE-01 · CLM-ENR-AUTHORITYFLOW-TRADEOFF · Right Tool, Wrong Parameters: AuthorityFlow
At a glance
Correct tool identity does not prove a correct destination, amount or principal.
Read the implicationsThe 144 scenarios are synthetic and the authority map is inferred from selected task settings. Published percentages are not a universal guarantee against an adversary who can manipulate multiple apparently trusted sources.
Limits and uncertaintyFull account
A finance or travel assistant may use an authorized tool and nevertheless send it an attacker-chosen recipient. AuthorityFlow traces which source had authority to set each consequential field. It treats a retrieved document as evidence for content, not as permission to replace the original customer mandate.
The 144 scenarios are synthetic and the authority map is inferred from selected task settings. Published percentages are not a universal guarantee against an adversary who can manipulate multiple apparently trusted sources.
AuthorityFlow treats a tool call as a bundle of independently authorized arguments. An attacker may leave the transfer tool itself unchanged while introducing a recipient or account number through a low-trust document. On the paper's 144 paired FactAuthBench cases, the reported Qwen3.6-27B attack success rate fell from 93.06% to 9.03%, while clean-task utility fell from 90.28% to 82.64%. These are benchmark outcomes, not deployed bank-transfer controls; the utility cost and the method's source-authority judgments need separate review.
Mechanism and trust boundary
- 01
Supply a conflicting parameter value in lower-trust context.
- 02
Let the agent choose an otherwise approved tool.
- 03
Check whether the parameter was justified by a sufficiently authoritative source before dispatch.
Claims & evidence
CLM-ENR-AUTHORITYFLOW-TRADEOFFOn FactAuthBench, AuthorityFlow reduced Qwen3.6-27B parameter-poisoning attack success from 93.06% to 9.03%, while benign utility declined from 90.28% to 82.64%.supported
Basis: reported finding
- supportsRight Tool, Wrong Parameters: AuthorityFlowprimary disclosure
Results, Table 1: Overall effectiveness on FactAuthBench
CLM-AUTHORITYFLOW-TOOL-ARGUMENT-PROVENANCE-01AuthorityFlow’s reported tests on FactAuthBench reduced parameter-poisoning attack success for evaluated agent configurations, while losing some benign task completion.supported
Basis: reported finding
- supportsRight Tool, Wrong Parameters: AuthorityFlowprimary disclosure
Abstract; FactAuthBench results and comparison with CaMeL
Implications
Correct tool identity does not prove a correct destination, amount or principal.
Controls and mitigations
- Validate each consequential tool argument against the authenticated user request and external policy.
Unknowns and contradictions
- The 144 scenarios are synthetic and the authority map is inferred from selected task settings. Published percentages are not a universal guarantee against an adversary who can manipulate multiple apparently trusted sources.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229