CAGE: Certifying Tool-Using LLM Agents Against Binding Errors

A new arXiv paper (2607.29190) introduces CAGE, a certification method for tool-using large language model (LLM) agents. The paper addresses a critical security gap: runtime permission gates typically authorize actions based on observed tool returns, but they do not account for small errors in how those returns are bound to their sources. CAGE certifies that a candidate action remains authorized over a declared neighborhood of plausible correctly bound returns, considering one admissible binding fault and bounded numerical drift. The authors prove that certifying categorical and numerical channels separately does not compose; perturbations safe on each channel alone can jointly make an action unsafe. CAGE certifies the joint neighborhood directly, enumerating discrete branches exactly and certifying continuous perturbations within each branch. The method is evaluated across synthetic, policy-as-code, regulatory, and real-transaction settings, and it removes in-budget false allows that accurate pointwise methods miss. The paper is authored by researchers (names not provided in the abstract) and is available on arXiv.