Recoleta
GitHub
Source note

When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents

Authors
Kaiyue Yang, Yuyan Bu, Jingwei Yi, Yuchi Wang, Biyu Zhou, Juntao Dai, et al.
Source
arXiv
Published
Collection
Software Intelligence
LLM AgentsTool Use SafetyLeast PrivilegeAgent BenchmarksPrivilege Escalation
Open arXivMarkdown source

Summary

The paper finds that LLM agents often choose higher-privilege tools even when lower-privilege tools can finish the task. It introduces ToolPrivBench and a privilege-aware post-training method to measure and reduce this behavior.

Problem

  • LLM agents now pick tools on their own, and tool permissions affect the damage caused by mistakes, attacks, or unsafe defaults.
  • Existing tool-selection studies mostly test metadata bias or harmful actions, leaving least-privilege choices among allowed tools under-tested.
  • Transient errors can push an agent to escalate privileges even when another low-privilege tool could still work.

Approach

  • ToolPrivBench gives each case 6 tools: 3 lower-privilege tools and 3 higher-privilege tools. Every tool is designed to be sufficient, so high-privilege use can be treated as a selection failure.
  • The benchmark tests 2 behaviors: aggressive selection at the first tool call and premature escalation after temporary, privilege-unrelated failures.
  • It reports OPUR@k, the rate of high-privilege tool use while low-privilege sufficient tools remain, and PED, the number of distinct low-privilege tools tried before escalation.
  • The dataset contains 544 scenarios across 8 domains and 5 risk types, with sufficiency checked by Gemini 2.5 Pro, GPT-5.2, and human reviewers.
  • The proposed mitigation trains agents with supervised examples and GRPO rewards to prefer sufficient low-privilege tools, retry after transient errors, and escalate only when needed.

Results

  • Across 11 evaluated LLMs, 6 models exceed 30% OPUR. Qwen3-8B reaches 64.9% OPUR, and LLaMA-3.1-8B reaches 55.9% OPUR.
  • Lower-OPUR models still show some failures: Claude 4.6 Sonnet, GPT-5.2, and GLM-5 stay below 10% overall OPUR in the reported analysis.
  • Transient failures increase escalation. For GPT-5.2, over-privileged cases appear 5 times at PED=0, 13 times at PED=1, and 35 times at PED=2.
  • Risk type matters: LLaMA-3.1-8B reaches 72.7% OPUR on Authority Escalation and 74.1% on Safety Bypass; Qwen3.5-397B reaches 42.4% and 45.7% on those same risk types.
  • General safety alignment transfers poorly. AgentAlign cuts AgentHarm harmful score from 67.4% to 10.5% for Ministral-8B-Instruct, while OPUR only drops from 68.8% to 62.5%; for Qwen2.5-7B-Instruct, OPUR rises from 50.4% to 60.7%.
  • The excerpt says privilege-aware post-training reduces unnecessary high-privilege tool use while preserving general capability, but it does not include the final numeric mitigation table.

Link