arXiv eess.SY: REALM: Identifying Minimal Task Assets for LLM Agents

arXiv eess.SY: REALM: Identifying Minimal Task Assets for LLM Agents

Authors Zihou Ren, Byungchul Tak, and Long Wang present REALM (Required Execution Assets Linked to a Mission), an approach for identifying and maintaining the assets an LLM agent needs for a task and their permitted uses. They argue that agents often receive access to more files, accounts, and services than tasks require, giving prompt injection an opportunity to redirect execution toward unrelated resources. REALM represents required assets as Dependency Graph nodes, resolves prerequisites, and can admit assets discovered during execution through source-scoped selection. It separates discovering an asset from authorizing its use, while preserving the agent’s freedom to choose its computation. The REALM Builder maintains grants and projects Asset Files; the Partial API Manager exposes resource-bound Partial APIs inside a Task Container. In the reported AgentDyn evaluation, with qwen3.5-flash as the base model, the approach completed 40.0% of 60 clean tasks and 36.4% of 560 injected cases, and decreased ASR from 16.6% to 0.2%. These figures describe the reported evaluation, not performance beyond it. The abstract does not provide further evaluation details or establish how results vary across other tasks or base models.

Publication: dd95b0f3-47a4-4816-88f4-0adb487030a3

attribution — pass: The reading correctly credits REALM to Zihou Ren, Byungchul Tak and Long Wang, and keeps the claims attributed to the authors. The title prefix 'arXiv eess.SY' reflects the feed's cross-list; the paper is primarily cs.CR, but this does not misattribute the work.

Authors:Zihou Ren, Byungchul Tak, Long Wang

summary — uncertain: The summary is faithful but too jargon-heavy for a general reader. ASR is the headline result, yet it is never expanded or explained; the source abstract does not expand it either. Prompt injection, Dependency Graph nodes, source-scoped selection, Partial APIs and Task Container are copied without explanation. The least-privilege framing that motivates the work is also dropped. Smallest repair: briefly explain prompt injection and least privilege in plain language, and add term-library tooltips for ASR and the REALM components without paraphrasing the terms.

Applying least privilege therefore requires identifying the assets needed by a task, including assets whose identities emerge only during execution.

date — pass: originalPublished 2026-10-29 matches the v1 submission date. The feed date of Oct 31 is correctly not used.

[Submitted on 29 Oct 2026]

support — pass: All claims and figures match the abstract. The reading does not treat benchmark results as real-world reliability. The limitations and the question are appropriately scoped and add no unsupported benefits or costs.

Across 60 clean tasks and 560 injected cases in AgentDyn, it completes 40.0% and 36.4% of tasks and decreases ASR from 16.6% to 0.2% with qwen3.5-flash as the base model.

media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.