💻 computer science

Teleoneutrosophic Logic for Three-Way Authorisation of Institutional AI Agents

This paper proposes Teleoneutrosophic Logic, a provenance-aware framework that pairs separate neutrosophic triples for effect and purpose to enable three-way authorization of institutional AI agents, effectively reducing direct-harm pass-through by distinguishing legitimate external requests from malicious inducements.

Original authors: Selçuk Topal, Buğra Ayan

Published 2026-10-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Selçuk Topal, Buğra Ayan

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital world, government agencies and large institutions are beginning to use artificial intelligence to handle complex tasks, such as summarizing citizen petitions or managing tax records. These AI agents are powerful tools, but they face a unique and dangerous problem: they can be tricked. Imagine a citizen submitting a petition about a tax issue, but hidden inside that document is a secret instruction telling the AI to transfer money to a stranger's account. To the AI, the instruction looks like just another command to follow. The challenge for security experts is to distinguish between a legitimate order from an authorized official and a hidden command buried in a document the AI is merely reading. Traditional security systems often look only at what an action does—like a money transfer—and struggle to understand who actually asked for it or why. This gap leaves institutions vulnerable to "prompt injection," where attackers hide malicious instructions inside the data the AI processes.

To solve this, researchers Selçuk Topal and Buğra Ayan have developed a new method for deciding whether an AI agent should carry out a request. Their approach, called Teleoneutrosophic Logic, treats the decision to authorize an action as a three-way choice: the system can approve the action, deny it, or pause to ask a human for review. The core of their innovation is separating the "what" from the "why." The system evaluates the action itself (the effect) and the source of the instruction (the purpose) as two distinct pieces of evidence. Crucially, it assigns a trust score to every source. A direct order from a verified government officer carries a high trust score, while a document uploaded by a citizen or an email from an unknown sender carries a low score. The system then weighs these scores against the potential harm of the action. If a low-trust source tries to influence a high-stakes decision, the system does not simply ignore it; instead, it treats the lack of a clear, trusted purpose as a reason to pause and escalate the decision to a human.

The researchers tested this system using a large collection of simulated attacks and realistic government scenarios. They created over a thousand scenarios where attackers tried to trick AI agents into stealing data or issuing unauthorized refunds. In these tests, the new system proved highly effective at stopping attacks that came from untrusted sources. When the system correctly identified that a request came from a low-trust channel, it prevented the AI from acting, even if the hidden instruction looked very convincing. The study found that by keeping the "purpose" of a request separate from its "effect," the system could reduce the rate of successful attacks from a dangerous level down to a very small fraction. For instance, in one set of tests involving direct harm, the system reduced the number of successful attacks from over 36 percent to less than 2 percent when labels were correct. Even when the system was tricked into mislabeling a dangerous source as trusted, it still managed to block the majority of attacks, dropping the success rate from over 80 percent down to about 35 percent.

However, the researchers also discovered the limits of this approach. The system relies heavily on the accuracy of the trust labels assigned to different channels. If an attacker can successfully trick the system into believing a malicious source is trustworthy, the protection weakens. Furthermore, the study showed that the system is not a magic shield that works perfectly in every situation. In some cases, particularly when the AI was asked to process generic requests from citizens without specific instructions, the system was cautious and often paused for human review. This caution is a feature, not a bug; it ensures that the AI does not accidentally approve harmful actions. The researchers found that while the system is excellent at stopping obvious attacks, it still requires human oversight for complex or ambiguous situations. They also noted that for the system to learn and improve, it needs to see examples of legitimate requests coming from untrusted channels, which are currently rare in training data. Without these examples, the system might mistakenly block valid requests from citizens.

The study concludes that while this new logic offers a significant step forward in securing AI agents, it is not a standalone solution. It works best when combined with strict rules about how data is labeled and tracked. The researchers demonstrated that a simpler, rigid rule that treats any untrusted input as suspicious can be just as safe as their complex system, provided the labels are correct. The real value of their work lies in showing how to handle uncertainty. By allowing the system to express "ambivalence"—a state where it is unsure if a request is safe or unsafe—it can make smarter decisions than a simple yes-or-no filter. This approach ensures that when an AI agent is asked to perform a sensitive task, it checks not just if the task is possible, but if the person asking for it has the right to do so. The findings suggest that for AI to be safely used in government and critical infrastructure, we must build systems that understand the difference between a command and a suggestion, and that know when to step back and let a human take the wheel.

Technical Summary: Teleoneutrosophic Logic for Three-Way Authorisation of Institutional AI Agents

Problem Statement
Institutional AI agents operating in public-sector workflows face a critical vulnerability: indirect prompt injection. An agent may be tasked with summarizing a citizen petition that contains a hidden instruction to execute a sensitive action, such as issuing a refund or altering records. While the immediate effect of this action (e.g., transferring funds) may be identical to a legitimate request from an authorized officer, the authority and purpose differ fundamentally. Existing monitoring systems that evaluate only the safety or effect of an action cannot distinguish between a legitimate officer's command and a malicious injection embedded in untrusted data. Furthermore, standard fuzzy or neutrosophic approaches that refine the "safety" scale fail to recover information regarding the source of the instruction, leaving the authorization problem unresolved.

Methodology
The authors propose Teleoneutrosophic Logic (TNL), a decision calculus that pairs two separate neutrosophic triples to evaluate a proposed tool call:

Effect Triple ( $T, I, F$ ): Represents Truth (safe execution), Indeterminacy, and Falsity (harm) regarding the action's immediate consequences.
Telic Triple ( $P, A, H$ ): Represents Truth (purpose alignment with the principal), Ambivalence (missing support), and Hostility (adverse purpose) regarding the instruction's origin and intent.

The framework operates through the following mechanisms:

Algebraic Structure: The system forms a product of two single-valued neutrosophic algebras, creating a six-coordinate value space. This structure supports paraconsistency (allowing $P$ and $H$ to coexist) and defines specific conditions for adjunction.
Provenance Discounting: Evidence is weighted by the trust level of its channel ( $t \in [0, 1]$ ). A "caution-preserving discount" operator reduces the support ( $T$ or $P$ ) of untrusted sources while retaining and accumulating uncertainty and harm/hostility reports.
Sceptical Fusion: Evidence from multiple sources is fused by taking the maximum of discounted supports and the probabilistic sum of indeterminacies, ensuring that untrusted sources cannot artificially inflate support beyond their trust cap.
Three-Way Guard: A decision function $G(\omega, \omega_0)$ $G (ω, ω_{0})$ evaluates the full evidence set ( $\omega$ $ω$ ) and the trusted evidence subset ( $\omega_0$ $ω_{0}$ ).
- Deny: Triggered if trusted evidence alone indicates high risk ( $\rho(\omega_0) \ge \theta_d$ ). Untrusted evidence cannot trigger denial.
- Auth: Granted only if the full evidence set satisfies safety, purpose, and harm thresholds ( $\rho(\omega) \le \theta_a$ , $T \ge \tau_T$ , $P \ge \tau_P$ ).
- Escalate: The default outcome for cases that are not denied but fail authorization thresholds.

The authors prove that under specific parameter conditions, untrusted evidence can only force an escalation (review) but cannot cause a denial or an unauthorized authorization if the trusted evidence is insufficient.

Key Contributions

Dual-Triple Representation: The introduction of a teleoneutrosophic value that decouples effect assessment from purpose alignment, allowing the system to detect "dual-use" scenarios where an action is safe but unauthorized.
Provenance-Aware Fusion: A formal mechanism where trust labels cap the positive support an untrusted source can provide, while preserving warnings (hostility/harm) from any source.
Theoretical Guarantees: Proofs establishing that the guard is paraconsistent and that, under defined support conditions, untrusted evidence is bounded in its ability to alter decisions (specifically, it cannot justify denial or bypass purpose thresholds).
Trajectory Protection: Extension of the logic to multi-step trajectories using flow kernels to detect decomposition attacks where a sensitive read is followed by a routine action.

Experimental Results
The framework was evaluated on 1,054 cases from the InjecAgent benchmark and synthetic e-government scenarios involving tax, health, and registry tools.

Correct Labels: When provenance labels are accurate, crisp "taint-and-escalate" rules and TNL perform similarly, with TNL offering slightly more nuanced handling of intermediate-trust channels.
Mislabelled Channels (T2): When untrusted content is incorrectly labelled as trusted, TNL significantly outperforms label-dependent crisp rules.
- On InjecAgent, TNL reduced direct-harm pass-through from 82.3% (taint rule) to 36.7%.
- With "ignorance-aware" ambivalence (retaining the fact that a call was not originally requested), pass-through dropped further to 16.9%.
- On synthetic benchmarks, TNL reduced pass-through from 100% (crisp rules) to 12.5% for single-step attacks under mislabelling.
Learned Estimators: Replacing fixed rules with learned estimators for purpose/hostility reduced pass-through under mislabelling from 36.7% to 1.6% on InjecAgent. However, this required training data containing legitimate requests from untrusted channels; without such data, models failed to generalize to legitimate external requests.
Limitations: The system struggles with "Arg0" attacks (argument manipulation without new identifiers) and worst-case scenarios where the attacker perfectly mimics alignment (T1*).

Significance and Claims
The paper claims that TNL provides a formal decision semantics for separating what an agent does from why it does it, addressing the "dual-use dilemma" in AI authorization.

Independent Ambivalence: A key finding is that retaining ambivalence about an unrequested call prevents later purpose support from erasing the need for review, reducing worst-case direct-harm pass-through from 100% to 34.5% (InjecAgent) and 25.0% (synthetic) under mislabelling.
Role of Automation: The authors modestly conclude that while TNL improves safety under label errors, "crisp" attribution-based rules (which escalate any call proposed by untrusted data regardless of content) are at least as safe and often simpler.
Training Data Necessity: The study highlights that learning-based improvements are contingent on the presence of legitimate external requests in training data; without them, automation of external requests remains unsafe.
Human-in-the-Loop: The authors emphasize that the guard is a technical control that shifts the burden to human review queues. They note that high escalation rates (e.g., 326 reviews per 1,000 requests) are a necessary cost for safety, and that the system does not guarantee compliance with regulations like GDPR or Turkish Law 6698 without appropriate human oversight.

The paper does not claim to solve all agent security issues, noting that it excludes intentional subversion by the model itself and relies on the integrity of provenance labels, which, if violated (T2*), still allow attacks to pass.

More like this