SPA is a plan-first architecture for persistent LLM agents that generates a complete executable plan per query using a declarative domain-specific language, then applies dual-lattice to track confidentiality and integrity. It stores execution results as labeled artifacts and reveals only semantic metadata during later planning, preventing untrusted data from influencing future queries.
Evaluated on AgentDojo and a new multi-query benchmark (AgentDojo-MQ) for delayed attacks, SPA reduced the success of the tool_knowledge attack to zero on AgentDojo and to 0.2% on AgentDojo-MQ.
This is interesting because existing defenses protect only individual steps or queries, while SPA addresses cross-query attacks that exploit persistent state reuse—a growing threat as LLM agents gain authority over sensitive resources.