ML Security PapersA2AS: Agentic AI Runtime Security and Self-Defense
Eugene Neelou 1,2,3, Ivan Novikov 1,3, Max Moroz 1,4, Om Narayan 5,2, Tiffany Saade 6, Mika Ayenson 7, Ilya Kabanov 8, Jen Ozmen 8, Edward Lee 9, Vineeth Sai Narajala 10,2, Emmanuel Guilherme Junior 2, Ken Huang 2, Huseyin Gulsin 2, Jason Ross 11, Marat Vyshegorodtsev 11, Adelin Travers 12, Idan Habler 12, Rahul Jadav 12
Published on arXiv
2510.13825
Prompt Injection
OWASP LLM Top 10 — LLM01
Excessive Agency
OWASP LLM Top 10 — LLM08
Key Finding
Introduces the BASIC security model as a conceptual foundation for LLM agent runtime security, positioning A2AS as a proposed industry standard analogous to HTTPS for web security.
A2AS / BASIC security model
Novel technique introduced
The A2AS framework is introduced as a security layer for AI agents and LLM-powered applications, similar to how HTTPS secures HTTP. A2AS enforces certified behavior, activates model self-defense, and ensures context window integrity. It defines security boundaries, authenticates prompts, applies security rules and custom policies, and controls agentic behavior, enabling a defense-in-depth strategy. The A2AS framework avoids latency overhead, external dependencies, architectural changes, model retraining, and operational complexity. The BASIC security model is introduced as the A2AS foundation: (B) Behavior certificates enable behavior enforcement, (A) Authenticated prompts enable context window integrity, (S) Security boundaries enable untrusted input isolation, (I) In-context defenses enable secure model reasoning, (C) Codified policies enable application-specific rules. This first paper in the series introduces the BASIC security model and the A2AS framework, exploring their potential toward establishing the A2AS industry standard.
Key Contributions
- A2AS framework: a runtime security layer for AI agents and LLM applications analogous to HTTPS, requiring no model retraining, architectural changes, or latency overhead
- BASIC security model: five-component foundation covering Behavior certificates, Authenticated prompts, Security boundaries, In-context defenses, and Codified policies
- Defense-in-depth strategy for LLM agents combining prompt authentication, behavior enforcement, and context window integrity