Reference implementation and evaluation artifact for Bounded Agents: Delegation Security for Multi-Agent AI Systems (arXiv:2608.15888).
This is the version that reproduces the results reported in the paper.
What is here
- ^Gpc/ ÔÇö zero-dependency core library: scope algebra, delegation budgets, and the six-condition policy decision point
- ests/ ÔÇö 215 tests covering the formal properties (Thm. 4.6, Thm. 4.7, Prop. 4.2)
- ^[vals/ ÔÇö six evaluation harnesses, 3,154 evaluation instances, with all result files committed
- scripts/ ÔÇö executable demo, latency benchmark, and paper-number verification
- paper/ ÔÇö the official arXiv-stamped PDF plus the LaTeX source submitted for this version
Reproducing
Requires Python 3.11+. No API keys are needed for the formal properties, the delegation-chain scenarios, the adaptive attacks, or either deterministic benchmark.
uv pip install -e ".[dev]"
pytest
python scripts/demo.py
python scripts/verify_numbers.py
verify_numbers.py cross-checks every headline figure against both the committed result files and paper/main.tex. The four deterministic harnesses regenerate their committed artifacts byte for byte, verified on Linux and Windows in CI.
Headline results
| Component | Cases | Key result |
|---|---|---|
| Delegation chains | 99 | 99/99, all six conditions validated |
| InjecAgent | 1,054 | Data-stealing ASR 100% -> 0% |
| ASB | 400 | Disruptive ASR 100% -> 0% |
| AgentDojo (utility) | 949 | Weighted delta interactive approx. -8.6 pp |
| AgentDojo (compromised) | 609 | Exfiltration 0% across all four suites |
| Adaptive | 43 | 23/24 prohibited-outcome variants blocked |
Session splitting is admitted by design: composition closure is defined over a single session's history. See the Limitations section of the README.
Licensed under Apache 2.0. Redistributed InjecAgent and ASB benchmark data remains under its upstream MIT licenses; see THIRD_PARTY_NOTICES.md.