Intent-Based Security: Replacing Identity-Centric Trust in Autonomous AI Agentic Systems

Abstract

Earlier work showed clean attacks succeed about 61.4% of the time when targeting advanced LLM agents in one-step interactions; performance climbs to 90.0% by the twentieth step if constraints weaken gradually. These findings share a core insight: current defenses rely too heavily on where inputs come from, not what they aim to do. Because trust travels with verified sources, malicious additions slip through unnoticed once embedded steering systems off course without raising alarms. From this stems the risk: legitimacy of origin masks harmful intent buried inside otherwise trusted material. This work shows why trusting identities fails against invisible threats. Even when a message comes from a verified origin, meets every security rule, arrives encrypted, it might still carry hidden directions meant to mislead automated systems. The flaw lies not in who sent it, but in what the message means. Security checks based on user roles, token updates, or digital signatures do nothing here these tools ignore meaning entirely. Trust built on identity does not guarantee safe outcomes. What matters shifts from source validation to purpose matching. That mismatch defines the problem: proof of authenticity rarely equals proof of honest intent. Addressing this issue begins with Intent-Based Security (IBS), a structured approach built on foundational ideas from access control, zero-trust models, and principal-agent dynamics. Rather than relying solely on who sends data, trust now depends on how closely each incoming input matches the operator's stated intent vector φ checked continuously. This system unfolds across three central elements. One key part the Intent Verification Pipeline (IVP) acts as a layered checkpoint, producing a dynamic trust score τ for every input. That value emerges by combining insights from the Semantic Validity Score (SVS), detailed earlier in Paper 1, along with adjustments based on the Intent Drift Rate (IDR) from Paper 2. Periodically, Intent Anchoring brings φ back into the agent’s context every k turns, mirroring the restorative mechanism outlined in Paper 2's Lyapunov stability approach. Following that, the system introduces a boundary called φ-Trust Threshold τ, adjusted using Bayesian decision principles, which separates actions labeled execute from those marked block. One test after another, covering various attack types and four leading LLM systems, shows IBS using complete IVP setup and intent anchoring (k = 5) brings average ASR down from 61.4% to 11.6%, cutting it by 81.1 percentage points, yet keeps incorrect flags low at just 4.1%. Earlier alerts also emerge: about 3.2 turns ahead of major shifts in behavior seen earlier in Paper 2.