Gong et al.: Authority–Inference Separation preprint

Evidence record

August 31 preprint of AIS framework; contains the 36/36, 20/36, zero/36 authorization comparison and ledger evidence boundary.

Read the original source ↗

Claim-level citations (5)

• supportsAgent-wallet tests blocked transaction effects despite successful prompt injection: The paper describes a local EVM proof of concept and author-designed tests, not real mainnet theft prevention, production audit results or resistance to malicious keys and policies.

  Preprint threat model, local EVM prototype, limitations; journal revision noted in supplied excerpt

• supportsAgent-wallet tests blocked transaction effects despite successful prompt injection: In the original synthetic authorization comparison, direct agent execution admitted 36/36 unauthorized effects, prompt-only policy admitted 20/36 and AIS admitted 0/36.

  Preprint experimental comparison: direct-agent, prompt-only and execution-bound AIS authorization

• supportsAgent-wallet tests blocked transaction effects despite successful prompt injection: The August preprint defines 48 fixed fixtures across four financial domains, including 36 unauthorized-intent attacks and eight admissible fixtures. It does not run a live language model in that original prototype comparison.

  Sections 3.4 and 7.1, scenario populations and prototype validity boundary

• supportsAgent-wallet tests blocked transaction effects despite successful prompt injection: The August AIS prototype rejected all four tested replay attempts and all eight recipient or rail substitutions, and withheld completion in four of four service-delivery failure fixtures. These are selected conformance checks, not observed production probabilities.

  Abstract; Sections 3.4 and 7.2; appendix scenario denominators

• supportsAgent-wallet tests blocked transaction effects despite successful prompt injection: An August preprint observability sample contained 1,700 address-transaction rows associated with public Base x402 facilitator addresses; 1,193 met the authors' candidate Base USDC EIP-3009 filter. Neither count establishes the number of autonomous agent purchases, underlying mandates or services delivered.

  Abstract and Sections 3.5 and 6, Base Blockscout sample construction and filtering