---
title: "Authorization-First Retrieval — paper by Namboothiri (2026)"
description: "It proposes Authorization-First Retrieval (AFR): permission checks must limit the candidate set before any learned component… 73 references."
authors: ["Rohith Namboothiri"]
year: 2026
venue: "Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)"
source: "https://aclanthology.org/2026.trustnlp-main.15/"
doi: "10.18653/v1/2026.trustnlp-main.15"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/namboothiri-2026-authorization-first-retrieval-enforcing-least/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/namboothiri-2026-authorization-first-retrieval-enforcing-least/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/22/) / Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems

# Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems

**Authors:** [Rohith Namboothiri](https://md.research.elamur.ai/free/en/authors/rohith-namboothiri/) · **Year:** 2026 · **Venue:** [Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)](https://md.research.elamur.ai/free/en/venues/trustnlp/) ([Workshop on Trustworthy NLP 2026](https://md.research.elamur.ai/free/en/venues/trustnlp/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.trustnlp-main.15/) · [PDF](https://aclanthology.org/2026.trustnlp-main.15.pdf) · [DOI 10.18653/v1/2026.trustnlp-main.15](https://doi.org/10.18653/v1/2026.trustnlp-main.15) · [OpenAlex](https://openalex.org/W7166877193)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary

When a RAG assistant serves many users under role-based access control, similarity search ignores permissions. Restricted chunks can therefore enter the LLM context before any downstream filter or guardrail acts. The paper treats this as a question of pipeline ordering. It proposes Authorization-First Retrieval (AFR): permission checks must limit the candidate set before any learned component sees the content. Using the classical non-interference property, the author proves AFR is required whenever the model is not non-interfering. Both tested LLMs fail that property. A further theorem extends the guarantee to multi-agent chains under inherited delegation, though experiments cover only a single-agent pipeline. The evaluation uses a controlled enterprise corpus with Gemini 2.0 Flash and GPT-4o-mini. It compares retrieve-then-filter (D3) with AFR (D6) and adds studies of negation framing, benign contamination, stale metadata tags, chunk size and retrieval depth. D3 leaks restricted context on most queries, and AFR removes structural leaks entirely. The takeaway is that authorization must be enforced architecturally rather than through model behavior.

## Key points

- **Corpus and queries:** 247 chunks from 232 documents, 12 enterprise roles and 9 domains. There are 431 base queries, plus 108 negation-exploitation and 45 parametric-probing queries, for 584 in total.
- **Leak rates:**
  - Retrieve-then-filter exposes unauthorized chunks on 371/431 base queries (86.1%) for both models. AFR exposes 0/431.
  - Answer-level leakage under D3 is 41.3% for Gemini 2.0 Flash and 29.5% for GPT-4o-mini.
- **Stale metadata tags:** Once a single policy update cycle has passed, relying on metadata tags for pre-filtering brings structural leaks back for 9.7% of queries.
- **Stress tests:** At k=150 (the full corpus), D3 structural exposure rises to 90.7%. AFR stays at 0% across five chunk sizes (30–200 words, 667–1,718 chunks) on both models.
- **Latency:** AFR was faster at k=10, cutting mean latency by about 23% (Gemini 1,976→1,524 ms; GPT-4o-mini 2,582→1,973 ms). The gain comes mostly from short refusals on deny queries.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Sociology and Political Science](https://md.research.elamur.ai/free/en/shelves/social-sciences/sociology-and-political-science/) · 577 works

🧭 Topics (1): [🔍 Information retrieval & search](https://md.research.elamur.ai/free/en/topics/information-retrieval/) · 473 works

## Cite

Cite as: Rohith Namboothiri. 2026. Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems. Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{namboothiri2026authorization,
  title = {{Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems}},
  author = {Rohith Namboothiri},
  booktitle = {Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)},
  year = {2026},
  doi = {10.18653/v1/2026.trustnlp-main.15},
  url = {https://doi.org/10.18653/v1/2026.trustnlp-main.15}
}
```

- [← previous AusKidTalk: Developing Transcription Guidelines for Continuous Australian English Child Speech](https://md.research.elamur.ai/free/en/papers/szalay-2026-auskidtalk-developing-transcription-guidelines-continuous/)
- [next → AuthorMix: Modular Authorship Style Transfer via Layer-wise Adapter Mixing](https://md.research.elamur.ai/free/en/papers/thillainathan-2026-authormix-modular-authorship-style-transfer/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/22/)

## References

73 references, 22 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. [2] Y. Gao et al., “[Retrieval-Augmented Generation for Large Language Models: A Survey](https://md.research.elamur.ai/free/en/papers/gao-2023-retrieval-augmented-generation-large-language/),” arXiv:2312.10997, 2024.
2. All experiments use a fully synthetic corpus with no real employee data, medical records, or finan- [3] V. Karpukhin et al., “Dense Passage Retrieval for cial information. The authorization failures we [Open-Domain Question Answering](https://md.research.elamur.ai/free/en/papers/chen-2020-open-domain-question-answering/),” in EMNLP, pp. 6769–6781, 2020. demonstrate are disclosed to motiv…
3. Use of AI Assistants [5] G. Izacard and E. Grave, “[Leveraging Passage Retrieval with Generative Models for Open Domain Question Answering](https://md.research.elamur.ai/free/en/papers/izacard-2021-leveraging-passage-retrieval-generative-models/),” in EACL, pp. 874–880, 2021.
4. We used large language models (Claude, Chat- [6] A. Asai et al., “Self-RAG: Learning to Retrieve, GPT) for grammar and language polishing of the Generate, and Critique through Self-Reflection,” in ICLR, 2024. [manuscript text](https://md.research.elamur.ai/free/en/papers/shuster-2021-retrieval-augmentation-reduces-hallucination-conversation/). We used coding assistance from these models for portions of the experiment…
5. [26] Q. Wu et al., “[AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation](https://md.research.elamur.ai/free/en/papers/wu-2023-autogen-enabling-next-gen-llm/),” arXiv:2308.08155, 2023.
6. [9] G. Mialon et al., “[Augmented Language Models: a Survey](https://md.research.elamur.ai/free/en/papers/mialon-2023-augmented-language-models-survey/),” arXiv:2302.07842, 2023.
7. [27] S. Hong et al., “[MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework](https://md.research.elamur.ai/free/en/papers/hong-2023-metagpt-meta-programming-multi/),” arXiv:2308.00352, 2023.
8. [10] J. Johnson et al., “Billion-Scale Similarity Search with GPUs,” IEEE Trans. Big Data, vol. 7, no. 3, pp. 535–547, 2021. [find](https://scholar.google.com/scholar?q=%5B10%5D+J%2E+Johnson+et+al%2E%2C+%E2%80%9CBillion%2DScale+Similarity+Search+with+GPUs%2C%E2%80%9D+IEEE+Trans%2E+Big+Data%2C+vol%2E+7%2C+no%2E+3%2C+pp%2E+535%E2%80%93547%2C+2021%2E)
9. [28] S. Yao et al., “[ReAct: Synergizing Reasoning and Acting in Language Models](https://md.research.elamur.ai/free/en/papers/yao-2022-react-synergizing-reasoning-acting-language/),” in ICLR, 2023.
10. [11] Y. A. Malkov and D. A. Yashunin, “Efficient and Robust Approximate Nearest Neighbor Using Hierarchical Navigable Small World Graphs,” IEEE TPAMI, vol. 42, no. 4, pp. 824–836, 2020. [find](https://scholar.google.com/scholar?q=%5B11%5D+Y%2E+A%2E+Malkov+and+D%2E+A%2E+Yashunin%2C+%E2%80%9CEfficient+and+Robust+Approximate+Nearest+Neighbor+Using+Hierarchical+Navigable+Small+World+Graphs%2C%E2%80%9D+IEEE+TPAMI%2C+vol%2E+42%2C+no%2E+4%2C+pp%2E+824%E2%80%93836%2C+2020%2E)
11. [12] R. S. Sandhu et al., “Role-Based Access Control Models,” IEEE Computer, vol. 29, no. 2, pp. 38–47, 1996. [find](https://scholar.google.com/scholar?q=%5B12%5D+R%2E+S%2E+Sandhu+et+al%2E%2C+%E2%80%9CRole%2DBased+Access+Control+Models%2C%E2%80%9D+IEEE+Computer%2C+vol%2E+29%2C+no%2E+2%2C+pp%2E+38%E2%80%9347%2C+1996%2E)
12. [29] T. Schick et al., “[Toolformer: Language Models Can Teach Themselves to Use Tools](https://md.research.elamur.ai/free/en/papers/schick-2023-toolformer-language-models-can-teach/),” in NeurIPS, vol. 36, 2024.
13. [30] S. G. Patil et al., “[Gorilla: Large Language Model Connected with Massive APIs](https://md.research.elamur.ai/free/en/papers/patil-2023-gorilla-large-language-model-connected/),” arXiv:2305.15334, 2023.
14. [31] J. S. Park et al., “Generative Agents: Interactive Simulacra of Human Behavior,” in UIST, pp. 1–22, 2023. [find](https://scholar.google.com/scholar?q=%5B31%5D+J%2E+S%2E+Park+et+al%2E%2C+%E2%80%9CGenerative+Agents%3A+Interactive+Simulacra+of+Human+Behavior%2C%E2%80%9D+in+UIST%2C+pp%2E+1%E2%80%9322%2C+2023%2E)
15. [13] D. F. Ferraiolo and D. R. Kuhn, “Role-Based Access Controls,” in 15th Nat. Comp. Sec. Conf., pp. 554–563, 1992. [find](https://scholar.google.com/scholar?q=%5B13%5D+D%2E+F%2E+Ferraiolo+and+D%2E+R%2E+Kuhn%2C+%E2%80%9CRole%2DBased+Access+Controls%2C%E2%80%9D+in+15th+Nat%2E+Comp%2E+Sec%2E+Conf%2E%2C+pp%2E+554%E2%80%93563%2C+1992%2E)
16. [14] V. C. Hu et al., “Guide to Attribute Based Access Control (ABAC) Definition and Considerations,” NIST SP 800-162, 2014. [find](https://scholar.google.com/scholar?q=%5B14%5D+V%2E+C%2E+Hu+et+al%2E%2C+%E2%80%9CGuide+to+Attribute+Based+Access+Control+%28ABAC%29+Definition+and+Considerations%2C%E2%80%9D+NIST+SP+800%2D162%2C+2014%2E)
17. [15] R. Pang et al., “Zanzibar: Google’s Consistent, Global Authorization System,” in USENIX ATC, pp. 33–46, 2019. [find](https://scholar.google.com/scholar?q=%5B15%5D+R%2E+Pang+et+al%2E%2C+%E2%80%9CZanzibar%3A+Google%E2%80%99s+Consistent%2C+Global+Authorization+System%2C%E2%80%9D+in+USENIX+ATC%2C+pp%2E+33%E2%80%9346%2C+2019%2E)
18. [16] P. Samarati and S. de Capitani di Vimercati, “Access Control: Policies, Models, and Mechanisms,” in FOSAD, LNCS 2171, pp. 137–196, 2001. [find](https://scholar.google.com/scholar?q=%5B16%5D+P%2E+Samarati+and+S%2E+de+Capitani+di+Vimercati%2C+%E2%80%9CAccess+Control%3A+Policies%2C+Models%2C+and+Mechanisms%2C%E2%80%9D+in+FOSAD%2C+LNCS+2171%2C+pp%2E+137%E2%80%93196%2C+2001%2E)
19. [17] B. W. Lampson, “Protection,” ACM SIGOPS OSR, vol. 8, no. 1, pp. 18–24, 1974. [find](https://scholar.google.com/scholar?q=%5B17%5D+B%2E+W%2E+Lampson%2C+%E2%80%9CProtection%2C%E2%80%9D+ACM+SIGOPS+OSR%2C+vol%2E+8%2C+no%2E+1%2C+pp%2E+18%E2%80%9324%2C+1974%2E)
20. [18] D. E. Bell and L. J. LaPadula, “Secure Computer Systems: Mathematical Foundations,” Tech. Rep. MTR-2547, MITRE, 1973. [find](https://scholar.google.com/scholar?q=%5B18%5D+D%2E+E%2E+Bell+and+L%2E+J%2E+LaPadula%2C+%E2%80%9CSecure+Computer+Systems%3A+Mathematical+Foundations%2C%E2%80%9D+Tech%2E+Rep%2E+MTR%2D2547%2C+MITRE%2C+1973%2E)
21. [19] D. D. Clark and D. R. Wilson, “A Comparison of Commercial and Military Computer Security Policies,” in IEEE S&P, pp. 184–194, 1987. [find](https://scholar.google.com/scholar?q=%5B19%5D+D%2E+D%2E+Clark+and+D%2E+R%2E+Wilson%2C+%E2%80%9CA+Comparison+of+Commercial+and+Military+Computer+Security+Policies%2C%E2%80%9D+in+IEEE+S%26P%2C+pp%2E+184%E2%80%93194%2C+1987%2E)
22. [20] R. S. Sandhu, “Role-Based Access Control,” in Advances in Computers, vol. 46, pp. 237–286, 1998. [find](https://scholar.google.com/scholar?q=%5B20%5D+R%2E+S%2E+Sandhu%2C+%E2%80%9CRole%2DBased+Access+Control%2C%E2%80%9D+in+Advances+in+Computers%2C+vol%2E+46%2C+pp%2E+237%E2%80%93286%2C+1998%2E)
23. [21] M. Y. Becker and P. Sewell, “Cassandra: Distributed Access Control Policies with Tunable Expressiveness,” in POLICY, pp. 159–168, 2004. [find](https://scholar.google.com/scholar?q=%5B21%5D+M%2E+Y%2E+Becker+and+P%2E+Sewell%2C+%E2%80%9CCassandra%3A+Distributed+Access+Control+Policies+with+Tunable+Expressiveness%2C%E2%80%9D+in+POLICY%2C+pp%2E+159%E2%80%93168%2C+2004%2E)
24. [32] G. Li et al., “CAMEL: Communicative Agents for ‘Mind’ Exploration of Large Language Model Society,” in NeurIPS, vol. 36, 2023. — [CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Society](https://md.research.elamur.ai/free/en/papers/li-2023-camel-communicative-agents-mind/)
25. [33] C. Qian et al., “Communicative Agents for Software Development,” in ACL, 2024. [find](https://scholar.google.com/scholar?q=%5B33%5D+C%2E+Qian+et+al%2E%2C+%E2%80%9CCommunicative+Agents+for+Software+Development%2C%E2%80%9D+in+ACL%2C+2024%2E)
26. [34] K. Hines et al., “Defending Against Indirect Prompt Injection Attacks With Spotlighting,” arXiv:2403.14720, 2024. — [arXiv:2403.14720](https://arxiv.org/abs/2403.14720) [find](https://scholar.google.com/scholar?q=%5B34%5D+K%2E+Hines+et+al%2E%2C+%E2%80%9CDefending+Against+Indirect+Prompt+Injection+Attacks+With+Spotlighting%2C%E2%80%9D+arXiv%3A2403%2E14720%2C+2024%2E+%E2%80%94+%5BarXiv%3A2403%2E14720%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2403%2E14720%29)
27. [35] J. Yi et al., “Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models,” in KDD, 2025. [find](https://scholar.google.com/scholar?q=%5B35%5D+J%2E+Yi+et+al%2E%2C+%E2%80%9CBenchmarking+and+Defending+Against+Indirect+Prompt+Injection+Attacks+on+Large+Language+Models%2C%E2%80%9D+in+KDD%2C+2025%2E)
28. [36] K. Greshake et al., “Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” in AISec, pp. 79–90, 2023. [find](https://scholar.google.com/scholar?q=%5B36%5D+K%2E+Greshake+et+al%2E%2C+%E2%80%9CCompromising+Real%2DWorld+LLM%2DIntegrated+Applications+with+Indirect+Prompt+Injection%2C%E2%80%9D+in+AISec%2C+pp%2E+79%E2%80%9390%2C+2023%2E)
29. [37] Y. Liu et al., “[Prompt Injection Attack Against LLM-Integrated Applications](https://md.research.elamur.ai/free/en/papers/liu-2023-prompt-injection-attack-against-llm/),” arXiv:2306.05499, 2024.
30. [38] A. Zou et al., “[Universal and Transferable Adversarial Attacks on Aligned Language Models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/),” arXiv:2307.15043, 2023.
31. [39] A. Wei et al., “[Jailbroken: How Does LLM Safety Training Fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/)” in NeurIPS, vol. 36, 2024.
32. [22] OpenFGA, “OpenFGA: Fine-Grained Authorization,” [https://openfga.dev](https://openfga.dev), 2024. [↗](https://openfga.dev)
33. [40] X. Shen et al., “Do Anything Now’: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on LLMs,” in CCS, 2024. [find](https://scholar.google.com/scholar?q=%5B40%5D+X%2E+Shen+et+al%2E%2C+%E2%80%9CDo+Anything+Now%E2%80%99%3A+Characterizing+and+Evaluating+In%2DThe%2DWild+Jailbreak+Prompts+on+LLMs%2C%E2%80%9D+in+CCS%2C+2024%2E)
34. [23] Cerbos, “Cerbos: The Open Source Authorization Layer,” [https://cerbos.dev](https://cerbos.dev), 2024. [↗](https://cerbos.dev)
35. [41] S. Zhu et al., “AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned LLMs,” in ICLR, 2024. [find](https://scholar.google.com/scholar?q=%5B41%5D+S%2E+Zhu+et+al%2E%2C+%E2%80%9CAutoDAN%3A+Generating+Stealthy+Jailbreak+Prompts+on+Aligned+LLMs%2C%E2%80%9D+in+ICLR%2C+2024%2E)
36. [24] Open Policy Agent, “OPA: Policy-based Con- [42] E. Perez et al., “Red Teaming Language Models trol for Cloud Native Environments,” [https://www.with](https://www.with) Language Models,” in EMNLP, pp. 3419–3448, openpolicyagent.org, 2024. 2022. [↗](https://www.with)
37. [25] OWASP, “OWASP Top 10 for Large Language Model Applications,” Version 2025, November 2024. [find](https://scholar.google.com/scholar?q=%5B25%5D+OWASP%2C+%E2%80%9COWASP+Top+10+for+Large+Language+Model+Applications%2C%E2%80%9D+Version+2025%2C+November+2024%2E)
38. [43] N. Carlini et al., “[Extracting Training Data from Large Language Models](https://md.research.elamur.ai/free/en/papers/carlini-2020-extracting-training-data-large-language/),” in USENIX Security, pp. 2633–2650, 2021.
39. [44] N. Carlini et al., “Quantifying Memorization Across Neural Language Models,” in ICLR, 2023. [find](https://scholar.google.com/scholar?q=%5B44%5D+N%2E+Carlini+et+al%2E%2C+%E2%80%9CQuantifying+Memorization+Across+Neural+Language+Models%2C%E2%80%9D+in+ICLR%2C+2023%2E)
40. [62] M. Abadi et al., “Deep Learning with Differential Privacy,” in CCS, pp. 308–318, 2016. [find](https://scholar.google.com/scholar?q=%5B62%5D+M%2E+Abadi+et+al%2E%2C+%E2%80%9CDeep+Learning+with+Differential+Privacy%2C%E2%80%9D+in+CCS%2C+pp%2E+308%E2%80%93318%2C+2016%2E)
41. [45] M. Nasr et al., “[Scalable Extraction of Training Data from (Production) Language Models](https://md.research.elamur.ai/free/en/papers/nasr-2023-scalable-extraction-training-data-production/),” arXiv:2311.17035, 2023.
42. [63] I. Issa et al., “An Operational Approach to Information Leakage,” IEEE Trans. IT, vol. 66, no. 3, pp. 1625–1657, 2020. [find](https://scholar.google.com/scholar?q=%5B63%5D+I%2E+Issa+et+al%2E%2C+%E2%80%9CAn+Operational+Approach+to+Information+Leakage%2C%E2%80%9D+IEEE+Trans%2E+IT%2C+vol%2E+66%2C+no%2E+3%2C+pp%2E+1625%E2%80%931657%2C+2020%2E)
43. [46] R. Staab et al., “Beyond Memorization: Violating Privacy Via Inference with LLMs,” in ICLR, 2024. [find](https://scholar.google.com/scholar?q=%5B46%5D+R%2E+Staab+et+al%2E%2C+%E2%80%9CBeyond+Memorization%3A+Violating+Privacy+Via+Inference+with+LLMs%2C%E2%80%9D+in+ICLR%2C+2024%2E)
44. [64] L. Huang et al., “A Survey on Hallucination in Large Language Models,” arXiv:2311.[05232, 2023](https://md.research.elamur.ai/free/en/papers/huang-2023-survey-hallucination-large-language-models/).
45. [47] N. Lukas et al., “Analyzing Leakage of Personally Identifiable Information in Language Models,” in IEEE S&P, pp. 346–363, 2023. [find](https://scholar.google.com/scholar?q=%5B47%5D+N%2E+Lukas+et+al%2E%2C+%E2%80%9CAnalyzing+Leakage+of+Personally+Identifiable+Information+in+Language+Models%2C%E2%80%9D+in+IEEE+S%26P%2C+pp%2E+346%E2%80%93363%2C+2023%2E)
46. [48] S. Zeng et al., “The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG),” arXiv:2402.16893, 2024. [find](https://scholar.google.com/scholar?q=%5B48%5D+S%2E+Zeng+et+al%2E%2C+%E2%80%9CThe+Good+and+The+Bad%3A+Exploring+Privacy+Issues+in+Retrieval%2DAugmented+Generation+%28RAG%29%2C%E2%80%9D+arXiv%3A2402%2E16893%2C+2024%2E)
47. [65] N. Kassner and H. Schütze, “Negated and Misprimed Probes for Pretrained Language Models,” in ACL, pp. 7811–7818, 2020. [find](https://scholar.google.com/scholar?q=%5B65%5D+N%2E+Kassner+and+H%2E+Sch%C3%BCtze%2C+%E2%80%9CNegated+and+Misprimed+Probes+for+Pretrained+Language+Models%2C%E2%80%9D+in+ACL%2C+pp%2E+7811%E2%80%937818%2C+2020%2E)
48. [66] A. Ettinger, “What BERT Is Not,” TACL, vol. 8, pp. 34–48, 2020. [find](https://scholar.google.com/scholar?q=%5B66%5D+A%2E+Ettinger%2C+%E2%80%9CWhat+BERT+Is+Not%2C%E2%80%9D+TACL%2C+vol%2E+8%2C+pp%2E+34%E2%80%9348%2C+2020%2E)
49. [49] H. Brown et al., “What Does it Mean for a Language Model to Preserve Privacy?” in FAccT, pp. 2280–2292, 2022. [find](https://scholar.google.com/scholar?q=%5B49%5D+H%2E+Brown+et+al%2E%2C+%E2%80%9CWhat+Does+it+Mean+for+a+Language+Model+to+Preserve+Privacy%3F%E2%80%9D+in+FAccT%2C+pp%2E+2280%E2%80%932292%2C+2022%2E)
50. [50] W. Zou et al., “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation,” arXiv:2402.07867, 2024. [find](https://scholar.google.com/scholar?q=%5B50%5D+W%2E+Zou+et+al%2E%2C+%E2%80%9CPoisonedRAG%3A+Knowledge+Corruption+Attacks+to+Retrieval%2DAugmented+Generation%2C%E2%80%9D+arXiv%3A2402%2E07867%2C+2024%2E)
51. [51] H. Su et al., “A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents,” arXiv:2506.23844, 2025. — [arXiv:2506.23844](https://arxiv.org/abs/2506.23844) [find](https://scholar.google.com/scholar?q=%5B51%5D+H%2E+Su+et+al%2E%2C+%E2%80%9CA+Survey+on+Autonomy%2DInduced+Security+Risks+in+Large+Model%2DBased+Agents%2C%E2%80%9D+arXiv%3A2506%2E23844%2C+2025%2E+%E2%80%94+%5BarXiv%3A2506%2E23844%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2506%2E23844%29)
52. [67] M. Nadeem et al., “Do LLMs Know When to Not Follow Instructions?” arXiv, 2024. [find](https://scholar.google.com/scholar?q=%5B67%5D+M%2E+Nadeem+et+al%2E%2C+%E2%80%9CDo+LLMs+Know+When+to+Not+Follow+Instructions%3F%E2%80%9D+arXiv%2C+2024%2E)
53. [68] F. Petroni et al., “[Language Models as Knowledge Bases?](https://md.research.elamur.ai/free/en/papers/petroni-2019-language-models-as-knowledge-bases/)” in EMNLP, pp. 2463–2473, 2019.
54. [69] N. F. Liu et al., “[Lost in the Middle: How Language Models Use Long Contexts](https://md.research.elamur.ai/free/en/papers/liu-2023-lost-middle-language-models-use/),” TACL, vol. 12, pp. 157–173, 2024.
55. [70] Y. Lu et al., “Fantastically Ordered Prompts and Where to Find Them,” in ACL, pp. 8086–8098, 2022. [find](https://scholar.google.com/scholar?q=%5B70%5D+Y%2E+Lu+et+al%2E%2C+%E2%80%9CFantastically+Ordered+Prompts+and+Where+to+Find+Them%2C%E2%80%9D+in+ACL%2C+pp%2E+8086%E2%80%938098%2C+2022%2E)
56. [52] Y. Ruan et al., “Identifying the Risks of LM Agents with an LM-Emulated Sandbox,” in ICLR, 2024. [find](https://scholar.google.com/scholar?q=%5B52%5D+Y%2E+Ruan+et+al%2E%2C+%E2%80%9CIdentifying+the+Risks+of+LM+Agents+with+an+LM%2DEmulated+Sandbox%2C%E2%80%9D+in+ICLR%2C+2024%2E)
57. [53] B. Wang et al., “[DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models](https://md.research.elamur.ai/free/en/papers/wang-2023-decodingtrust-comprehensive-assessment-trustworthiness-gpt/),” in NeurIPS, vol. 36, 2023.
58. [71] J. Hayes et al., “LOGAN: Membership Inference Attacks Against Generative Models,” PoPETs, vol. 2019, no. 1, pp. 133–152, 2019. [find](https://scholar.google.com/scholar?q=%5B71%5D+J%2E+Hayes+et+al%2E%2C+%E2%80%9CLOGAN%3A+Membership+Inference+Attacks+Against+Generative+Models%2C%E2%80%9D+PoPETs%2C+vol%2E+2019%2C+no%2E+1%2C+pp%2E+133%E2%80%93152%2C+2019%2E)
59. [54] L. Sun et al., “[TrustLLM: Trustworthiness in Large Language Models](https://md.research.elamur.ai/free/en/papers/huang-2024-trustllm-trustworthiness-large-language-models/),” arXiv:2401.05561, 2024.
60. [72] H. Li et al., “Privacy in Large Language Models: Attacks, Defenses and Future Directions,” arXiv:2310.10383, 2024. — [arXiv:2310.10383](https://arxiv.org/abs/2310.10383) [find](https://scholar.google.com/scholar?q=%5B72%5D+H%2E+Li+et+al%2E%2C+%E2%80%9CPrivacy+in+Large+Language+Models%3A+Attacks%2C+Defenses+and+Future+Directions%2C%E2%80%9D+arXiv%3A2310%2E10383%2C+2024%2E+%E2%80%94+%5BarXiv%3A2310%2E10383%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2310%2E10383%29)
61. [55] N. Hardy, “The Confused Deputy,” ACM SIGOPS OSR, vol. 22, no. 4, pp. 36–38, 1988. [find](https://scholar.google.com/scholar?q=%5B55%5D+N%2E+Hardy%2C+%E2%80%9CThe+Confused+Deputy%2C%E2%80%9D+ACM+SIGOPS+OSR%2C+vol%2E+22%2C+no%2E+4%2C+pp%2E+36%E2%80%9338%2C+1988%2E)
62. [73] Amazon Web Services, “Amazon Bedrock Knowledge Bases,” [https://docs.aws.amazon.com/](https://docs.aws.amazon.com/) bedrock/, 2024. [↗](https://docs.aws.amazon.com/)
63. [56] J. A. Goguen and J. Meseguer, “Security Policies and Security Models,” in IEEE S&P, pp. 11–20, 1982. [find](https://scholar.google.com/scholar?q=%5B56%5D+J%2E+A%2E+Goguen+and+J%2E+Meseguer%2C+%E2%80%9CSecurity+Policies+and+Security+Models%2C%E2%80%9D+in+IEEE+S%26P%2C+pp%2E+11%E2%80%9320%2C+1982%2E)
64. [57] D. E. Denning, “A Lattice Model of Secure Information Flow,” CACM, vol. 19, no. 5, pp. 236–243, 1976. [find](https://scholar.google.com/scholar?q=%5B57%5D+D%2E+E%2E+Denning%2C+%E2%80%9CA+Lattice+Model+of+Secure+Information+Flow%2C%E2%80%9D+CACM%2C+vol%2E+19%2C+no%2E+5%2C+pp%2E+236%E2%80%93243%2C+1976%2E)
65. [58] A. Sabelfeld and A. C. Myers, “Language-Based Information-Flow Security,” IEEE JSAC, vol. 21, no. 1, pp. 5–19, 2003. [find](https://scholar.google.com/scholar?q=%5B58%5D+A%2E+Sabelfeld+and+A%2E+C%2E+Myers%2C+%E2%80%9CLanguage%2DBased+Information%2DFlow+Security%2C%E2%80%9D+IEEE+JSAC%2C+vol%2E+21%2C+no%2E+1%2C+pp%2E+5%E2%80%9319%2C+2003%2E)
66. [59] A. C. Myers and B. Liskov, “Protecting Privacy using the Decentralized Label Model,” ACM TOSEM, vol. 9, no. 4, pp. 410–442, 2000. [find](https://scholar.google.com/scholar?q=%5B59%5D+A%2E+C%2E+Myers+and+B%2E+Liskov%2C+%E2%80%9CProtecting+Privacy+using+the+Decentralized+Label+Model%2C%E2%80%9D+ACM+TOSEM%2C+vol%2E+9%2C+no%2E+4%2C+pp%2E+410%E2%80%93442%2C+2000%2E)
67. [74] LangChain, “LangChain: Building Applications with LLMs through Composability,” [https://github.com/langchain-ai/langchain](https://github.com/langchain-ai/langchain), 2023. [↗](https://github.com/langchain-ai/langchain)
68. [75] LlamaIndex, “LlamaIndex: Data Framework for LLM Applications,” [https://github.com/](https://github.com/) run-llama/llama_index, 2023. [↗](https://github.com/)
69. [76] Q. Zhan et al., “InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents,” in Findings of ACL, 2024. [find](https://scholar.google.com/scholar?q=%5B76%5D+Q%2E+Zhan+et+al%2E%2C+%E2%80%9CInjecAgent%3A+Benchmarking+Indirect+Prompt+Injections+in+Tool%2DIntegrated+LLM+Agents%2C%E2%80%9D+in+Findings+of+ACL%2C+2024%2E)
70. [60] D. E. Denning et al., “The Tracker: A Threat to Statistical Database Security,” ACM TODS, vol. 4, no. 1, pp. 76–96, 1979. [find](https://scholar.google.com/scholar?q=%5B60%5D+D%2E+E%2E+Denning+et+al%2E%2C+%E2%80%9CThe+Tracker%3A+A+Threat+to+Statistical+Database+Security%2C%E2%80%9D+ACM+TODS%2C+vol%2E+4%2C+no%2E+1%2C+pp%2E+76%E2%80%9396%2C+1979%2E)
71. [77] Z. Xiang et al., “GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning,” arXiv:2406.09187, 2024. — [arXiv:2406.09187](https://arxiv.org/abs/2406.09187) [find](https://scholar.google.com/scholar?q=%5B77%5D+Z%2E+Xiang+et+al%2E%2C+%E2%80%9CGuardAgent%3A+Safeguard+LLM+Agents+by+a+Guard+Agent+via+Knowledge%2DEnabled+Reasoning%2C%E2%80%9D+arXiv%3A2406%2E09187%2C+2024%2E+%E2%80%94+%5BarXiv%3A2406%2E09187%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2406%2E09187%29)
72. [61] C. Dwork et al., “Calibrating Noise to Sensitivity in Private Data Analysis,” in TCC, pp. 265–284, 2006. [find](https://scholar.google.com/scholar?q=%5B61%5D+C%2E+Dwork+et+al%2E%2C+%E2%80%9CCalibrating+Noise+to+Sensitivity+in+Private+Data+Analysis%2C%E2%80%9D+in+TCC%2C+pp%2E+265%E2%80%93284%2C+2006%2E)
73. [78] X. Qi et al., “Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To,” in ICLR, 2024. — [Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/)

*Updated 1 November 2026*