ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
Open accessAbstract
LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects; we term these semantic rollback attacks. We identify two attack classes, Action Replay and Authority Resurrection, validate them in a proof of concept experiment, and confirm that the problem has been independently acknowledged by framework maintainers. We propose ACRFence, a framework-agnostic mitigation that records irreversible tool effects and enforces replay-or-fork semantics upon restoration
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
ACRFence studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution.
“ACRFence directly studies action replay and authority resurrection after agent checkpoint restore, while Agent libOS combines capability-controlled processes, parent-child lineage, ceilings, budgets, checkpoint images, restore intersection, and prepare-dispatch-settle execution [36, 39].”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [39]
Split into 2 atoms — 1 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredCheckpoint replay and safe-restore work already establish the general authority-resurrection threat.
“Checkpoint replay and safe-restore work already establish the general authority-resurrection threat [36, 39]; the rule here specializes it to a population transfer whose identity, allocation, and authorization record are fresh.”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [39]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 21
- Berk Atil, Sarp Aykent, Alexa Chittams, Lisheng Fu, Rebecca J. Pas- sonneau, Evan Radcliffe, Guru Rajan Rajagopal, Adam Sloan, Tomasz Tudrej, Ferhan Ture, Zhe Wu, Lixinyu Xu, and Breck Baldwin. 2025. Non-Determinism of "Deterministic" LLM Settings. arXiv:2408.04667. doi:10.48550/arXiv.2408.04667 · DOI
- Andrew D. Birrell and Bruce Jay Nelson. 1984. Implementing Remote Procedure Calls. ACM Transactions on Computer Systems 2, 1 (1984), 39-59. doi:10.1145/2080.357392 · DOI
- Elmootazbell Y. Elnozahy, Lorenzo Alvisi, Yi-Min Wang, and David B. Johnson. 2002. A Survey of Rollback-Recovery Protocols in Message- Passing Systems. Comput. Surveys 34, 3 (2002), 375-408. doi:10.1145/ 568522.568525 · DOI
- Erhu Feng, Wenbo Zhou, Zibin Liu, Le Chen, Yunpeng Dong, Cheng Zhang, Yisheng Zhao, Dong Du, Zhichao Hua, Yubin Xia, and Haibo Chen. 2025. Get Experience from Practice: LLM Agents with Record & Replay. arXiv:2505.17716. doi:10.48550/arXiv.2505.17716 · DOI
- Tairan Fu, Gonzalo Martínez, Javier Conde, Carlos Arriaga, Pedro Re- viriego, Xiuyuan Qi, and Shanshan Liu. 2026. Beyond Reproducibility: Token Probabilities Expose Large Language Model Nondeterminism. arXiv:2601.06118. https://arxiv.org/abs/2601.06118 · arXiv
- Raffi Khatchadourian. 2026. Replayable Financial Agents: A Determinism-Faithfulness Assurance Harness for Tool-Using LLM Agents. arXiv:2601.15322. doi:10.48550/arXiv.2601.15322 · DOI
- Yang Li, Siqi Ping, Xiyu Chen, Xiaojian Qi, Zigan Wang, Ye Luo, and Xiaowei Zhang. 2025. AgentGit: A Version Control Framework for Re- liable and Scalable LLM-Powered Multi-Agent Systems. arXiv preprint arXiv:2511.00628 (2025). https://arxiv.org/abs/2511.00628 · arXiv
- Sinisa Matetic, Mansoor Ahmed, Kari Kostiainen, Aritra Dhar, David M. Sommer, Arthur Gervais, Ari Juels, and Srdjan Capkun. 2017. ROTE: Rollback Protection for Trusted Execution. In Proceedings of the 26th USENIX Security Symposium (USENIX Security). 1289-1306.
- Bryan Parno, Jacob R. Lorch, John R. Douceur, James W. Mickens, and Jonathan M. McCune. 2011. Memoir: Practical State Continuity for Protected Modules. In Proceedings of the IEEE Symposium on Security and Privacy (S&P). 379-394.
- Tianneng Shi, Jingxuan He, Zhun Wang, Linyu Wu, Hongwei Li, Wenbo Guo, and Dawn Song. 2025. Progent: Programmable Privilege Control for LLM Agents. arXiv:2504.11703. https://arxiv.org/abs/2504. 11703 · arXiv
- Zoltan Somogyi. 2003. Idempotent I/O for Safe Time Travel. In Pro- ceedings of the Fifth International Workshop on Automated Debugging (AADEBUG). Ghent, Belgium. arXiv:cs/0311040. · arXiv
- Robert E. Strom and Shaula A. Yemini. 1985. Optimistic Recovery in Distributed Systems. ACM Transactions on Computer Systems 3, 3 (1985), 204-226. doi:10.1145/3959.3962 · DOI
- Cong Wang and Yusheng Zheng. 2026. Fork, Explore, Commit: OS Primitives for Agentic Exploration. arXiv:2602.08199. https://arxiv. org/abs/2602.08199 · arXiv
- Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2025. AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. arXiv:2503.18666. https://arxiv.org/abs/2503.18666 · arXiv
- Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Jun- yang Lin, Robert Brennan, Hao Peng, Heng Ji, and Graham Neubig. 2024. OpenHands: An Open Platform for AI Software Developers as Generalist Agents. arXiv:2407.16741. https://arxiv.org/abs/2407.16741 · arXiv
- Jingwei Wu and Yizheng Yang. 2025. Commercial LLM Agents Are Al- ready Vulnerable to Simple Yet Dangerous Attacks. arXiv:2502.08586. https://arxiv.org/abs/2502.08586 · arXiv
- Jiakai Xu, Tianle Zhou, Eugene Wu, and Kostis Kaffes. 2025. Toward Systems Foundations for Agentic Exploration. arXiv:2510.05556. https: //arxiv.org/abs/2510.05556 · arXiv
- John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. SWE-agent: Agent- Computer Interfaces Enable Automated Software Engineering. In Advances in Neural Information Processing Systems. https://arxiv.org/ abs/2405.15793 · arXiv
- Yiwei Yang, Aibo Hu, Yusheng Zheng, Brian Zhao, Xinqi Zhang, Dawei Xiang, Kexin Chu, Wei Zhang, and Andi Quinn. 2025. MVVM: Deploy Your AI Agents-Securely, Efficiently, Everywhere. arXiv:2410.15894 [cs.OS] https://arxiv.org/abs/2410.15894 · arXiv
- Jiayi Yuan, Hao Li, Xinheng Ding, Wenya Xie, Yu-Jhe Li, Wentian Zhao, Kun Wan, Jing Shi, Xia Hu, and Zirui Liu. 2025. Understanding and Mitigating Numerical Sources of Nondeterminism in LLM Inference. arXiv:2506.09501. https://arxiv.org/abs/2506.09501 · arXiv
- Yusheng Zheng, Yanpeng Hu, Tong Yu, and Andi Quinn. 2025. AgentSight: System-Level Observability for AI Agents Using eBPF. In Proceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems. 110-115.
Cited by
Sorted by citations
Zhu, G., & Wang, C. (2026) · arXiv · doi:10.48550/arxiv.2610.00347
- Authors
- Zheng, Y., Yang, Y., Zhang, W., & Quinn, A.
- Affiliations
- University of California, Santa Cruz (US)
- University of Connecticut (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2603.20625
- OpenAlex
- W7140191254
- Cited by
- 1
- References
- 0
- Citations by year
- 2026: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Networks and Communications › Distributed systems and fault tolerance
- Keywords
- LLM agents, LLM agent security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
