Towards Security-Auditable LLM Agents: A Unified Graph Representation

2026-05-07

AI Summary

This work addresses the security auditing challenges in large language model (LLM) agent systems arising from the semantic execution paradigm, which introduces a gap between high-level intentions and low-level operations, thereby obscuring the tracking of cognitive state evolution, capability binding, memory contamination, and cross-agent risk propagation. To bridge this gap, the paper proposes Agent-BOM, a unified, auditable graph-based representation for LLM agents that separates static capability primitives from dynamic semantic states using a layered attributed directed graph. Semantic edges encode security-relevant attributes, enabling queryable audit trails. Agent-BOM is the first framework to integrate static and dynamic elements, supporting graph-query-driven, path-level risk assessment aligned with the OWASP Agentic Top 10 threats. In real-world attack scenarios, it successfully reconstructs stealthy attack chains—including memory poisoning, tool misuse, and multi-agent hijacking—enabling root-cause tracing and security adjudication.

Abstract

LLM-based agentic systems are rapidly evolving to perform complex autonomous tasks through dynamic tool invocation, stateful memory management, and multi-agent collaboration. However, this semantics-driven execution paradigm creates a severe semantic gap between low-level physical events and high-level execution intent, making post-hoc security auditing fundamentally difficult. Existing representation mechanisms, including static SBOMs and runtime logs, provide only fragmented evidence and fail to capture cognitive-state evolution, capability bindings, persistent memory contamination, and cascading risk propagation across interacting agents. To bridge this gap, we propose Agent-BOM, a unified structural representation for agent security auditing. Agent-BOM models an agentic system as a hierarchical attributed directed graph that separates static capability bases, such as models, tools, and long-term memory, from dynamic runtime semantic states, such as goals, reasoning trajectories, and actions. These layers are connected through semantic edges and security attributes, transforming fragmented execution traces into queryable audit paths. Building on Agent-BOM, we develop a graph-query-based paradigm for path-level risk assessment and instantiate it with the OWASP Agentic Top 10. We further implement an auditing plugin in the OpenClaw environment to construct Agent-BOM from live executions. Evaluation on representative real-world agentic attack scenarios shows that Agent-BOM can reconstruct stealthy attack chains, including cross-session memory poisoning and tool misuse, capability supply-chain hijacking and unexpected code execution, multi-agent ecosystem hijacking, and privilege and trust abuse. These results demonstrate that Agent-BOM provides a unified and auditable foundation for root-cause analysis and security adjudication in complex agentic ecosystems.

Problem

• security auditing
• semantic gap
• LLM agents
• risk propagation
• memory contamination

Innovation

• Agent-BOM
• security auditing
• graph representation
• LLM agents
• risk propagation