REALM limits LLM agents to required assets, cutting attack success to 0.2%
The claim
REALM can identify minimal task assets and reduce prompt-injection success rate to 0.2%
Published as: “REALM: Identifying Minimal Task Assets for LLM Agents”
So what
REALM demonstrates that asset-based least-privilege can dramatically curb prompt-injection attacks, though at the cost of substantially lower task success, highlighting a security-utility trade-off for LLM agents.
The five-minute version
REALM cuts prompt-injection attack success from 16.6% to 0.2% but also drops task utility, falling from 78.3% to 40.0% on clean tasks and from 71.6% to 36.4% on injected tasks. The evidence comes from an AgentDyn evaluation of 620 cases comparing REALM to a no-REALM baseline.
What they found 3
- Attack success rate drops dramatically with REALM
“The no-REALM baseline records 93 successful attacks among 560 injected cases (16.6%), compared with one among 560 valid injected cases (0.2%) for REALM.”
- Task utility is reduced when using REALM
“Clean utility decreases from 47/60 (78.3%) to 24/60 (40.0%)”
- Overall case completion halves with REALM
“Overall, REALM completes 228/620 cases (36.8%), compared with 448/620 (72.3%) for the baseline.”
What undercuts it the paper’s own results
- The same security gains come with a large drop in legitimate task completion (clean utility from 78.3% to 40.0%).
- A successful daily-life injection still occurs because the admitted calendar partial permits creating an unrelated event, showing that minimality was not fully achieved.
Stated limits 3
- Our prototype approximates the minimality objective and does not certify that every selected grant is indispensable.
- Its low native ASR and limited utility do not establish minimal asset recovery.
- Improving mission-to-asset reasoning and measuring required-access coverage and excess grants are identified as future work.
What’s new here 4
- Identifies required assets via a Dependency Graph with source-scoped discovery, handling assets whose concrete identities emerge only at runtime.
- Separates asset identity from permission, allowing incremental grant admission while preserving agent freedom to compute.
- Enforces the selected asset set using a container that exposes Asset Files and resource-bound Partial APIs rather than unrestricted tool access.
- Provides a concrete prototype evaluated on a public benchmark (AgentDyn) showing security-vs-utility trade-offs.
Artifacts & methods 6
- REALM Buildersystem
- Partial API Managersystem
- Asset Filessystem
- Dependency Graphprimitive
- AgentDyn benchmarkdataset
- Qwen3.5-flash modelsystem