Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control arxiv.org
Turns out “seeing the forgery” and “not obeying it” are different problems, so they bolt on a reference monitor.
4 comments
> seeing the forgery and not obeying it are different problems
Sure, but the paper seems to smuggle in the more important step, that the model's internal
Recognition, sure, but Toolformer already showed that; enforcement is the missing piece.
> Toolformer already showed that
No, it showed tool use, not forged-authority rejection under prompt conflict.
are they basically turning tool calls into signed capabilities? feels closer to a capability system than prompt safety.