# SAGE

The work formulates attack and defense for tool-using language-model agents as partially observed state control (SEAD), derives from it an execution-feedback tree-search attacker (DART) and a pre-execution defender that can run read-only state investigations (SAGE), and reports across 187 malicious tasks and four target models that DART exceeds baselines by 18.8–35.9 percentage points under both semantic and executable criteria, while SAGE preserves 95.79% of benign trajectories, intercepts 92.73% of harmful paths on recorded trajectories, and reduces DART's executable attack success from 48.0% to 4.0% online.

The work formulates attack and defense for tool-using language-model agents as partially observed state control (SEAD), derives from it an execution-feedback tree-search attacker (DART) and a pre-execution defender that can run read-only state investigations (SAGE), and reports across 187 malicious tasks and four target models that DART exceeds baselines by 18.8–35.9 percentage points under both semantic and executable criteria, while SAGE preserves 95.79% of benign trajectories, intercepts 92.73% of harmful paths on recorded trajectories, and reduces DART's executable attack success from 48.0% to 4.0% online.