ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
This addresses a security vulnerability in LLM agent frameworks that could lead to financial and credential misuse, with the issue being incremental as it builds on existing checkpoint-restore mechanisms.
The paper tackles the problem of semantic rollback attacks in LLM agent checkpoint-restore systems, where re-synthesized requests after restore cause irreversible side effects like duplicate payments, and proposes ACRFence as a mitigation that enforces replay-or-fork semantics.
LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects; we term these semantic rollback attacks. We identify two attack classes, Action Replay and Authority Resurrection, validate them in a proof of concept experiment, and confirm that the problem has been independently acknowledged by framework maintainers. We propose ACRFence, a framework-agnostic mitigation that records irreversible tool effects and enforces replay-or-fork semantics upon restoration