Arduino Security System

For Llm-Integrated App Systems

Evan Li∗, Tushin Mallick∗, Evan Rose∗, William Robertson, Alina Oprea, and Cristina Nita-Rotaru Abstract—LLM-integrated app systems extend the utility of Large Language Models (LLMs) with third-party apps that are invoked by a system LLM using interleaved planning and execution phases to answer user queries. These systems introduce new attack vectors where malicious apps can cause integrity violation of planning or execution, availability breakdown, or privacy compromise during execution.

In this work, we identify new attacks impacting the integrity of planning, as well as the integrity and availability of execution in LLM-integrated apps, and demonstrate them against IsolateGPT, a recent solution designed to mitigate attacks from malicious apps. We propose Abstract-Concrete-Execute (ACE), a new secure architecture for LLM-integrated app systems that provides security guarantees for system planning and execution.

Specifically, ACE decouples planning into two phases by first creating an abstract execution plan using only trusted informa- tion, and then mapping the abstract plan to a concrete plan using installed system apps. We verify that the plans generated by our system satisfy user-specified secure information flow constraints via static analysis on the structured plan output.

During execution, ACE enforces data and capability barriers between apps, and ensures that the execution is conducted according to the trusted abstract plan. We show experimentally that ACE is secure against attacks from the INJECAGENT and Agent Security Bench benchmarks for indirect prompt injection, and our newly introduced attacks. We also evaluate the utility of ACE in realistic environments, using the Tool Usage suite from the LangChain benchmark. Our architecture represents a significant advancement towards hardening LLM-based systems

I. Introduction

Large language models (LLMs) have shown remarkable per- formance in language generation –, motivating their in- tegration with external systems. This integration is commonly realized through third-party applications (or apps) that connect an LLM with external APIs to enable seamless interactions between users and third-party services. These LLM-integrated apps can support a variety of tasks such as booking flights,

Several Major Llm Orchestration Frameworks – Have

emerged to facilitate the development of apps. These frame- works provide centralized management of prompts and dy- namic, iterative generation of multi-step LLM workflows.

Specifically, a central “system LLM” iterates between suc- cessive planning and execution phases. Each planning phase

∗Equal Contribution

1 This is the full version of the paper accepted for publication at the Network and Distributed System Security Symposium (NDSS) 2026. decides the next operations towards answering a user query based on the results of prior execution steps. Given a plan, the LLM then carries it out in a subsequent execution phase, potentially invoking apps and accessing context to do so.

Planning and execution phases are interleaved, resulting in dynamic control flow that is dependent on user instructions, app descriptions, and intermediate system outputs.

To support this dynamic orchestration, the system relies on structured representations in the form of app schemas and app descriptions. An app schema formally defines the structure, expected inputs and outputs, and operational interface of an app, while an app description provides semantic metadata about the app’s capabilities, behavior, and usage context. These representations enable the system LLM to reason about avail- able functionality, plan appropriate execution, and coordinate the invocation of apps in accordance with user intent.

Security is a major concern for LLM-integrated app sys- tems, as they introduce new attack vectors from malicious apps installed on user devices, including indirect prompt in- jection , denial of service and privacy leakage . Based on the attacker objective and the system component being attacked we classify such attacks as (1) integrity violation of planning – attacks that impact the integrity of the planning phase; (2) integrity violation of execution – attacks that impact the integrity of the execution phase; (3) availability breakdown of execution – attacks that interrupt the normal execution of the LLM system; and (4) privacy compromise of execution – attacks that cause leakage of sensitive user information from the execution environment.

Llm-

integrated app systems focus on mitigating prompt injection and related security threats posed by untrusted third-party data sources. These defenses primarily leverage isolated execution or control how data propagates within an LLM-integrated app system. Information flow control mechanisms enforce separation between trusted planning and untrusted execution, while isolation architectures decouple application logic through modular components to prevent shared context com- promise. However, existing defenses assume a weak adversary that cannot manipulate the app description and schema and use an interleaved plan-execute approach that does not establish sufficiently comprehensive security boundaries between the system LLM and untrusted third-party apps.

Motivated by limitations of existing defenses, we iden- tify and demonstrate several concrete attacks that subvert

Arxiv:2504.20984V3 [Cs.Cr] 10 Sep 2025

the integrity of the system planning phase as well as the integrity and availability of the system execution phase of Iso- lateGPT . Our attacks include Execution Flow Disruption and Execution Manager Hijack created through malicious app outputs, and Planner Manipulation created through malicious app descriptions. To address these new attacks, we design Abstract-Concrete-Execute (ACE), a new secure architecture for LLM-integrated apps that provides comprehensive security by design. ACE is based upon the key insight that ahead- of-time planning based only on the trusted user query— as opposed to dynamic plan generation—enables principled security reasoning and static enforcement of strong security policies on plan execution. An overview of our architecture is given in Figure 1b, in contrast to existing systems using interleaved planning and execution shown in Figure 1a.

ACE separates query processing into three distinct phases: abstract plan generation, concrete plan instantiation, and isolated plan execution. The first phase creates an abstract execution plan using only trusted query information, thus creating a security boundary that preserves plan integrity despite the presence of untrusted apps. This approach enables reasoning about the control and information flow properties of system execution traces under an immutable rule-based plan compared to a dynamic, data-dependent plan. The separation of planning and execution phases guarantees integrity of exe- cution, including preventing indirect prompt injection attacks arising from malicious app outputs.

The second phase instantiates the plan using registered apps, leveraging isolation to prevent malicious apps from corrupting the integrity of the abstract plan. With a complete execution plan in hand, ACE then verifies that the plan satisfies static security policies including quantification of risk and permissi- ble information flows between the system LLM, context, and apps. By verifying concrete plan implementations against our lattice-based policy, we automatically reject implementations that violate defined information flow constraints.

The final phase executes the verified plan, leveraging system isolation primitives and controlled interfaces between compo- nents to enforce the previously-verified security policies and overall integrity of execution with respect to the concrete plan.

To Summarize, Our Contributions Are:

• We demonstrate three new attacks that subvert the in- tegrity of the system planning phase as well as the integrity and availability of the system execution phase of IsolateGPT .

• We propose ACE, a new secure architecture for LLM- integrated app systems providing comprehensive security by design. ACE uses the key insight that planning based on only trusted components enables principled security reasoning and static enforcement of strong security poli- cies on plan execution. Our abstract planning mechanism stands in stark contrast to the majority of existing LLM- based systems, which follow an interleaved plan-execute procedure to decide execution and produce a response.

• We verify that the plans generated by our system sat- isfy user-specified secure information flow constraints via static analysis on the structured plan output. We demonstrate that our information flow verification system successfully blocks the accidental or malicious leakage of privileged information to unqualified recipients.

• We conduct experiments to empirically demonstrate ACE’s security benefits. We show that ACE success-

Asb , Standard Benchmarks For Evaluating Indirect

prompt injection attacks. We also show that ACE pre- vents our newly introduced attacks. In addition, we demonstrate that ACE achieves high utility (above 80%) on the Tool Usage suite from the LangChain benchmark.

Https://Github.Com/

escottrose01/ace-llm.

Ii. Background And Problem Statement

We provide an overview of LLM-integrated apps and de- tails about existing defenses against malicious apps. We then describe our problem statement and goals.

A. Overview Of Llm-Integrated App Systems

LLM-integrated app systems are structured around modular, composable components—primarily apps—that expand the LLM’s functionality to perform real-world tasks. We give an example of a typical LLM-integrated app system in Figure 1a.

At the core of this architecture is a system LLM that interprets user queries, formulates execution strategies, and invokes the appropriate apps to fulfill task objectives. The system LLM operates over a dynamic prompt context including the user’s input, prior dialogue, app descriptions, and any intermediate results. This context functions as transient memory, allowing the model to reason over evolving task states, maintain coher- ence across steps, and ensure consistency in output.

Within this framework, an app is defined by three elements: a natural language description, a schema, and a function. The description specifies the app’s purpose and operational constraint, and serves as semantic metadata for app selection and planning. The schema defines the structure of the app’s inputs and outputs. The function, typically a script or service, implements the app logic—receiving structured inputs and returning either structured or natural language outputs.

Task handling involves two conceptual phases: planning and execution. Embedded within the system LLM is a planning mechanism responsible for decomposing high-level user in- tent into a structured execution strategy. The planner selects relevant apps, determines their invocation order, and supplies required inputs. The resulting plan serves as a blueprint for ex- ecution, supporting both single-step and multi-step workflows.

App execution is managed by an underlying execution envi- ronment, which enforces process isolation, resource limits, and secure system access. Within this environment, an orchestrator acts as an intermediary between the system LLM and the apps.

The orchestrator receives the execution plan, schedules and manages app invocations accordingly, and oversees the data flow between apps. It also maintains an execution state that is logically independent from the reasoning process of the system

Read / Write

files . .

Evaluate

arithmetic . .

Query (Trusted)

(a) Typical LLM-integrated app system.

Read / Write

files . .

Evaluate

arithmetic . .

Response:

Message sent.

Read

files . .

Concrete Plan

(b) ACE system design. Fig. 1: Comparison of system architectures. In typical systems (left) a central system LLM is responsible for planning control flow based on the user queries and available system utilities. Planning and execution phases are interleaved, producing a control flow mechanism that is arbitrarily dependent on the user instructions, app descriptions, and intermediate system outputs. Our system ACE (right) generates a structured plan prior to execution based on trusted information.

LLM which ensures that high-level reasoning is decoupled from low-level operational control. In more complex workflows, app chaining is needed, where the output of one app serves as the input to another. These multi-step executions introduce coordination challenges, in- cluding dependency tracking, validation of intermediate re- sults, and maintaining type consistency across steps. The planner is responsible for explicitly encoding these dependen- cies within the execution plan, while the orchestrator handles data transformation and propagation between steps, ensuring consistency and system integrity throughout the process.

B. Existing Defenses for LLM-Integrated App Systems While LLM-integrated apps enhance functionality and user experience, they also introduce significant security vulner- abilities—particularly through indirect prompt injection at- tacks . These risks are amplified in systems involving multiple untrusted apps, where adversaries can exploit natural language ambiguity to compromise app integrity, mislead users, or violate privacy across multi-step execution chains.

Two LLM app security systems that attempt to address these issues are f-Secure and IsolateGPT . f-Secure . This system provides a defense against indirect prompt injection attacks in LLM-powered apps by adopting information flow control (IFC). The core design of f-Secure involves separating LLM functionalities into a planner, which generates structured execution steps using only trusted in- puts, and a rule-based executor, which processes potentially untrusted data. A security monitor enforces IFC policies, preventing untrusted data from influencing planning.

The system relies on several trust assumptions, notably treating app descriptions and schemas as inherently reliable without verification. As a result, any compromise in these components can undermine the effectiveness of IFC and lead to insecure behavior.

IsolateGPT . This system-level defense mitigates security risks from untrusted apps in LLM systems by enforcing strict app execution isolation. The architecture of IsolateGPT is centered around a strict app execution isolation model, im- plemented via a modular Hub-and-Spoke design. More details are given in Section III-A.

However, IsolateGPT’s reliance on static app descriptions and schemas as trusted sources presents a critical limitation. Since it lacks mechanisms for validating the integrity of these descriptions or inspecting the internal logic of app functions, it is constrained to verifying outputs based solely on expected formats and declared semantics. This limits its ability to rea- son dynamically or adapt to adversarial scenarios, ultimately affecting system robustness. Another limitation of IsolateGPT lies in its reliance on user interaction for app control, which introduces significant user fatigue.

C. Problem Statement

Our goal is to design a security architecture for LLM- integrated app systems that provides mitigation against ma- licious apps installed on a user’s device that might influence both the LLM planning and the execution flow of the LLM system. The main problem we address in our work is to restrict the influence of malicious apps in LLM systems by protecting benign apps and the LLM from their adversarial impact.

Threat Model. We assume that the attacker capabilities in- volve control over one or several apps on the user’s device, with the goal of influencing other benign apps or the LLM planning and execution components. Within the compromised apps, the attacker has total control over the details of their execution, their interface with the LLM system (schema), and app metadata, such as the name and natural language description. As a consequence of controlling the app execution, the attacker also controls malicious app outputs, which could result in an indirect prompt injection attack manipulating the

3

TABLE I: Comparison of our system with existing LLM security systems based on what attack surfaces they are designed to address. We consider two adversaries: our strong threat model, which assumes completely untrusted apps, and a weaker threat model, which trusts the app description and schema.

✓

✓

control flow. We distinguish between a weak threat model in which the app description and schema are trusted, and a strong threat model in which they may be malicious.

We consider several attacker objectives of interest (avail- ability, integrity, and privacy) during both the LLM planning and execution phases. While a combination of adversarial objectives and LLM phase leads to six possible attack types,

We Focus Here On The Most Relevant:

1) Planning Integrity Violation. The attacker could ma- nipulate the LLM planning, for instance to promote their own malicious apps to be included or to demote a benign app to be excluded from the generated plan.

2) Execution Integrity Violation. The attacker could at- tempt to change the system execution flow so that a be- nign app receives malicious output from a compromised app or manipulate the execution context, leading to an integrity violation in the system’s behavior.

3) Execution Availability Breakdown. The attacker may

Wish To Interrupt The Normal Execution Of The Llm

system, causing user queries to fail to resolve despite the availability of suitable resources on the system. 4) Execution Privacy Compromise. The attacker might wish to cause leakage of sensitive user information from the execution environment.

It is possible to launch an availability attack during planning to prevent the plan generation and task completion, but such an attack would be easily detected. Privacy compromises are not relevant in the planning phase, but only during execution when the LLM gets access to sensitive user data.

Our Goals. We have two main types of goals: security goals (preventing attacks from malicious apps) and utility goals (maintaining system utility). As shown in Table I, existing defenses , do not consider a strong threat model with arbitrary app manipulation. Even in the case of a weak threat model where app description and schema are trusted, they provide limited protection, and none of the existing systems is resilient against all attacker objectives.

Our system should preserve the security of both planning and execution phases in the face of untrusted components. In particular, the integrity of the planning phase should not be compromised in the presence of untrusted apps installed on the system. App descriptions should not be able to induce arbitrary changes in the generated control flow. Additionally, the execution phase should prevent integrity, availability, and privacy compromises resulting from indirect prompt injections performed by malicious apps. The system should appropriately restrict the processing of untrusted data originating from system app outputs. The data flow in the system should be enforced according to the prespecified plan. Besides designing a system resilient against both weak and strong attacker models, our goals are to offer high levels of utility, and be agnostic to the system and LLM configurations.

Iii. New Attacks On Llm-Integrated App Systems

Previous defenses for LLM-integrated app systems either trust the description of the app, or they trust the LLM to choose the apps and plan the execution of the task. We identify several new attacks against IsolateGPT which we demonstrate on the public system implementation: (1) Execution Flow Disruption, (2) Execution Manager Hijack, and (3) Planner Manipulation. The first two attacks are created through mali- cious app output, while the third is created through malicious app descriptions. Below we describe in detail the IsolateGPT system, and how our attacks bypass its security mechanisms.

A. Isolategpt System Overview

In IsolateGPT user queries are processed through a modular Hub-and-Spoke architecture that supports dynamic, multi- step task execution while enforcing strict execution isolation.

When a user submits a query, it is first received by the hub, which orchestrates all downstream activity. The hub contains two key subsystems: the planner and the execution manager.

Each subsystem is responsible for distinct phases of query interpretation and execution. An example of an end-to-end scenario from user query to final output is shown in Figure 2.

The hub planner component incorporates a planning LLM that interprets the user’s query and constructs a detailed multi- step execution plan taking into account the apps available to the system. This plan includes a proposed ordering of app calls, their expected inputs and outputs, and interdependencies.

However, instead of executing this plan directly, IsolateGPT discards the detailed structure and retains only a high-level list of relevant apps identified as potentially useful for resolving the query. This list defines the complete set of apps that the system is allowed to call during the execution phase.

The app list, along with the original user query, is passed to the execution manager, which contains its own LLM com- ponent, responsible for orchestrating the actual execution. It takes the user query and the planner-provided list of apps as input and determines the immediate next app to invoke. The execution manager then instantiates a spoke for the app within

4

a sandboxed, isolated environment and forwards the necessary information to it for processing. Once the spoke completes its task and returns an output, the execution manager integrates the intermediate result, the original user query, and any previous context into the prompt of its internal LLM. This LLM evaluates the current state and determines the next appropriate step, including which spoke to invoke next and what information to provide. This iterative process continues until the execution manager’s LLM concludes that the task is complete. At that point, the final result is routed back through the hub to the user. Throughout this workflow, all inter-spoke communication is strictly medi- ated by the execution manager, ensuring that no direct data exchange occurs outside the control of the hub.

B. New Attacks Against Isolategpt

IsolateGPT distrusts app descriptions during spoke execu- tions, but relies on them during the planning phase. This exposes IsolateGPT to a host of new attacks which utilize app descriptions.

IsolateGPT also trusts app outputs and passes them to the context of execution manager LLM of the hub without any prior verification. This makes the LLM vulnerable to prompt injection from malicious app outputs, which can influence sub- sequent actions taken by the LLM. Although IsolateGPT does not attempt to defend against attacks that occur entirely within a single app, such as prompt injection or internal compromise during input processing, they claim to prevent the effects of such attacks from propagating beyond the compromised app to the rest of the system. Trusting raw app outputs contradicts this claim and compromises the robustness of the system.

Below we present three new attacks on IsolateGPT that ex- ploit app description and app outputs. In these scenarios, a user intends to calculate fare from “Main Street” to “Elm Avenue” using two apps: MetroHail and QuickRide. Without loss of generality, MetroHail is considered the benign application pro- viding legitimate fare estimates, while QuickRide is malicious and embeds a prompt injection in its output/description to compromise the integrity of MetroHail’s output. All the attacks were evaluated on the public IsolateGPT implementation2, and Figures 2, 11, and 12 represent output from the attacked system.

C. Execution Flow Disruption Attack

A malicious app can exploit the fact that the raw app output is passed to the context of execution manager LLM of the hub without any prior verification, and that the planning and execution phases are interleaved, to disrupt the execution flow of a task. We show an indirect prompt injection attack against IsolateGPT in Figure 2, where the malicious app prematurely halts execution.

An adversary modifies the MetroHail app to insert a disrup- tion string into its output claiming that all fare calculating apps are compromised and used for illegal activities. The created

Being Used To

distribute drugs.

Technical Error With

the tools. Fig. 2: Illustration of Execution Flow Disruption attack on Iso- lateGPT, which causes an availability breakdown in execution.

execution plan first uses QuickRide and then MetroHail to solve the user query. However, when QuickRide is executed, IsolateGPT’s execution flow is diverted as the execution man- ager exits the plan of execution before running MetroHail and returns an error message to the user.

We expect IsolateGPT to display the fare from MetroHail and notify the user that QuickRide did not function as intended or is compromised and should not be used. However, in this instance, IsolateGPT instead reports to the user that a technical issue occurred and does not return any valid fare for the user.

This attack demonstrates that IsolateGPT’s isolated execution system is susceptible to availability attacks that disrupt its execution chain. IsolateGPT failed to display the fare from MetroHail, and also failed to properly acknowledge the source of the error to the user, instead returning a vague message.

D. Execution Manager Hijack Attack

A malicious app can exploit the fact that the raw app output is passed to the context of execution manager LLM of the hub without any prior verification to enable malicious cross-app interference. For example, a malicious app can craft an output containing a prompt injection that impacts another app. We show such a concrete attack against IsolateGPT in Figure 11 in the Appendix.

The created plan of execution first uses MetroHail and then QuickRide to solve the user query. The execution manager receives expected fare from MetroHail, but from QuickRide it receives a set of instructions to repeat, verbatim. Specifically, it receives a prompt that instructs it to report a normal fare for itself but an artificially inflated fare for MetroHail. The spoke regurgitates the prompt injection, thereby injecting the prompt into the execution manager LLM context, which then reports the artificially inflated MetroHail fare to the user, along with the normal fare for QuickRide. This represents a critical security vulnerability, as it introduces a central point of failure within the system, enabling malicious app developers to undermine the credibility of other apps and deliver misleading information to the user.

E. Planner Manipulation Attack

A malicious app can also exploit the fact that the system trusts app descriptions during the planning phase to manip- ulate the planner into selecting the malicious app despite the presence of other functionally equivalent alternatives. We demonstrate such an attack against IsolateGPT in Figure 12 in the Appendix.

Once the user gives a query to calculate the fare from “Main Street” to “Elms Avenue”, the planner develops a plan of execution to solve the query. To do this, the planner LLM reads the user query, the benign description of MetroHail, and the malicious description of QuickRide. While both apps’ de- scriptions state their purpose as fare calculators, QuickRide’s description also has a malicious prompt commanding the planner LLM to exclude MetroHail from the plan of execution when resolving fare calculation requests. The planner LLM reads this malicious prompt and excludes MetroHail from the created plan. In the user’s final output, only the fare generated from QuickRide is returned, removing MetroHail from the execution process without the user’s knowledge. This vulnerability leaves the hub planner susceptible to manipula- tion by malicious app developers, providing adversaries with the ability to promote their own product and demote their competitor’s, undermining the system’s reliability.

Iv. Ace System Architecture

We start by discussing the design principles guiding the design of ACE. We then give an overview of our system architecture. Finally, we describe each component in detail and explain how they contribute to achieving our security goals.

A. Design Principles

One of the key challenges in designing a secure LLM system in the face of untrusted apps lies in how to create structured, rule-based execution plans while also limiting the extent to which installed apps can influence these plans. At a high level, we desire that the basic control flow determined by the planner cannot be altered by malicious app descriptions.

This includes app demotion attacks such as the Planner Ma- nipulation Attack from Section III. We also require that, once this plan is established, the execution phase is subject to the constraints imposed by the plan. That is, malicious app outputs cannot cause an indirect prompt injection attack resulting in arbitrary execution traces not permitted by the semantics of the prespecified plan. Finally, we want to prevent privacy leakage by design, so that data boundaries can be enforced and sensitive information cannot leak to unqualified parties.

Thus, we are led to the following design principles: Separate Planning and Execution. We showed with the Execution Flow Disruption Attack how an attacker could prematurely interrupt execution by performing an indirect prompt injection attack to insert a malicious output into the execution path. With the Planner Manipulation Attack we showed how a malicious app description could influence the control flow by suppressing the use of a relevant app. This leads us to propose a stricter boundary between planning and execution, in which a planning module determines an execution workflow based only on fully-trusted information, such as the user query. This execution workflow imposes hard, irreversible constraints on the possible downstream execution paths, which cannot be modified by malicious app descriptions or outputs.

Remove Unintended Cross-app Interactions. In the Planner Manipulation Attack we showed how a malicious app can suppress the usage of a different, unrelated app by modifying its own description. We recognize this behavior more broadly as an unintended cross-app interaction. In particular, for the purposes of planning the broader control flow, the planning module should be able to determine the inclusion of each app independently from the others. Thus, we seek a solution which encodes this requirement explicitly in its design.

Enforce Data Controls within Execution Paths. LLMs can- not be trusted to keep flows of private and public information separate. Instead, our insight is to enforce privacy controls by design using rule-based data security controls. These controls should guarantee that privileged information is not divulged to unqualified locations during any execution trace, regardless of how the control flow was determined (even by a trusted component). The controls should also be extensive enough to detect and prevent long-range data dependencies, as data in multi-step plans can be processed in potentially complex ways which must be tracked.

Enforce Low-privilege Principle. A general, widely-accepted security guideline is the principle of least privilege (PoLP), which states that the privileges granted to an entity should be the minimal possible needed to perform its intended functions.

Guided by this principle, our system should provide the least amount of privilege to apps during execution.

B. High-Level Overview

ACE consists of three main components, shown in Figure 3: an abstract planner, a concrete planner, and an executor. Each component is responsible for handling a distinct phase of user query processing, each with less capability than the previous one. In this way, we balance the need for generality while restricting the influence of untrusted data sources.

The abstract planner is responsible for generating the overarching plan of execution for fulfilling the user query. It serves as the most privileged and trusted component of the system and interacts only with fully trusted information, the user query. In particular, the abstract planner is oblivious to the set of apps installed on the system, making it immune to indirect prompt injection and planning manipulation attacks.

The output of the abstract planner specifies clearly-defined control flow rules governing downstream execution paths. Our insight in this direction is for the abstract planner to identify a set of abstract apps which can be used in expressing the execution plan. The resulting plan makes use of these abstract apps in defining the control flow of the program without deferring to the untrusted information involved with installed system utilities.

Read / Write

files . .

Evaluate

arithmetic . .

App

App

Fig. 3: Overview of our three-phase ACE secure LLM-integrated app system architecture. First, our system generates an abstract plan using a set of abstract apps, generated using only fully-trusted query information. Next, we match abstract apps with concrete apps installed on the system in the concrete planning phase. Matching consists of a binary decision made independently between each pair of abstract and concrete app. Finally, the concrete plan is executed in a carefully managed execution environment which enforces isolation between system app instances.

The concrete planner acts as an intermediate step, combin- ing the output of the abstract planner with the apps installed on the system to obtain a valid flow that can be executed.

The output of the concrete planner must abide by any struc- tural constraints imposed by the abstract planner. Briefly, the abstract apps identified during the abstract planning phase are matched with concrete apps installed on the system. We perform this matching carefully to eliminate unintended cross- app interactions such as app demotion attacks. This results in a concrete plan which fully specifies the needed system operations. At this phase, we also statically verify system- level security policies such as privacy controls on information flow between apps.

The executor runs the concrete plan within an orchestrator- worker architecture and is responsible for executing the con- crete plan in a secure manner by enforcing all security policy rules. Each app is run inside an isolated environment with care- fully managed permissions. Only data required for executing the app is made available to each app’s execution environment.

Apps are restricted by default from interacting with each other or with other host system resources. In the executor we implement a distributed protocol between a trusted orchestrator and workers. The protocol defines a structured message flow between distributed components, where participants exchange messages according to predefined roles and state transitions.

Our system supports standalone apps and single-query. Supporting application suites and multi-query interactions are left for future work.

C. Abstract Planner

We propose a method of plan generation that depends only on knowledge of the user query and which is oblivious to information involving the set of installed apps. In particular, our planning module is designed so that an attacker cannot influence the generated plan by having their app installed.

Crucially, the abstract planning phase is performed without access to information involving the set of installed apps, and thus is by design secure from manipulation by installed apps.

Abstract Apps. Motivated by the concepts of abstract classes and polymorphism from programming languages, the first task of the abstract planner is to generate a set of abstract apps.

Abstract apps consist of a name, natural language description, and a type signature defining the input and output structure. Abstract apps do not implement the behavior stated in their descriptions. Given a user query, the planning module gener- ates a set of abstract apps which may be relevant to completing the query.

We implement the abstract app generator using a specialized LLM (i.e., an LLM paired with a customized system prompt, as described in Appendix D), which takes the user query as input and produces abstract app specifications in a structured output format.

To be useful, abstract apps must satisfy two criteria. First, the user intent must be expressible with some program logic using the abstract apps as building blocks. Second, the apps must be representative of utilities installed on the system.

We observe that real-world apps naturally group into broad functional categories–such as file system interactions, text pro- cessing utilities, data retrieval, or computational operations– whose general functionalities can often be captured without re- quiring exact implementation details. Thus, by guiding abstract app generation to generate apps falling into such functional groups, we are able to create abstract apps which correspond to installed utilities, even without seeing the utilities themselves.

For example, a query of the form “summarize file.txt” may generate two abstract apps, LOADDOCUMENT, which is responsible for loading data from the host filesystem, and SUMMARIZETEXT, which applies summarization to a provided piece of text. By abstracting the key functionalities required to fulfill a user query, abstract apps serve as a stepping

7

stone to expressing a user’s intended outcome without prema- turely committing to specific underlying implementations and without exposing an attack surface for untrusted information.

Abstract Plan. We introduce a specialized language, a mod- ified subset of the Python language with plan-specific func- tionality added. Plans in this language are syntactically valid Python programs with a well-defined entry point for execution.

Valid function calls include a restricted subset of the Python standard library in addition to a handful of utilities to facilitate planning with apps. An example of abstract plan is given in Figure 4.

The planning LLM is instructed to generate the plan, using the prompt from Prompt 2 in Appendix D. Our abstract plan- ning framework contributes to achieving our security objec- tives in the following way. The abstract plan can be viewed as a hard constraint on the space of possible execution traces of the system. In particular, choosing a particular implementation for a given abstract app cannot drastically alter the overarching control flow of the underlying program. Any properties which can be gleaned from an abstract execution of the abstract plan are necessarily satisfied by any particular concrete plan implementing the abstract plan. Moreover, expressing plans in a language with precise semantics opens the door for static analysis to prove formal properties about the security and integrity of plan execution.

Every program in our abstract planning language contains a single top-level entry point definition ‘main()’. The logic ex- pressed within the main function consists of basic statements as well as basic branching program control flow constructs. We support branching control flow in the form of if-statements, for-loops, and while-loops. The usage of these constructs is restricted to appropriately limit the capabilities implied by the planning language while retaining the general expressiveness of the planner. For-loops are restricted to “for-range” loops; that is, they only allow iteration over a (possibly variable) sequence of integer values. While-loops function as usual, but require the loop condition to be a single variable. Break statements are not allowed within either loop construct. These restrictions simplify downstream static analysis.

Our language runtime is similarly restricted to prevent unsafe data or control flows. We restrict builtin file system utilities, mutable data types, and dynamic code features to appropriately limit allowed runtime behaviors. More details on the language runtime are given in Appendix C.

Our abstract planning mechanism stands in stark contrast to the majority of existing LLM-based systems, which follow an interleaved plan-execute procedure to determine execution traces and produce a response . We argue that it is much easier to reason about the control and information flow properties of system execution traces under an immutable rule- based plan than under a dynamic, data-dependent plan. Our design ensures that the abstract plan is not influenced by malicious apps, preventing indirect prompt injection attacks that manipulate the execution flow.

Operational Context. In some cases, more context may be needed to clarify the operational environment of the agent

Return Res

Fig. 4: Example abstract plan for the user query “Load document ’file.txt’ from my documents and summarize the contents.” DocumentLoader and TextSummarizer are abstract apps automatically generated by the planner and are not affected by the apps installed on the system.

before an abstract plan can be generated. To resolve this, we expose an optional context field to the abstract planner. The context field originates from a fully-trusted source and clarifies both the operational environment in which the agent can take actions as well as broadly summarizes the expected capabili- ties the agent should expect to have within this environment.

Because the context field is fully trusted, it must not contain explicit metadata from apps or application outputs.

D. Concrete Planner

The abstract plan utilizes abstract apps, but in order to execute the plan, the system must first generate implemen- tations for each of the abstract apps. The concrete planner is responsible for replacing the abstract apps with the actual concrete apps registered by the user on the system. We define an implementation of the abstract plan to be a mapping from abstract apps to concrete apps; that is, every abstract app in the abstract plan should correspond to exactly one concrete app. The abstract plan and implementation together form the concrete plan, which fully expresses the structured control flow which can be executed on the system. The following describes how we determine such an implementation.

Concrete App Matching. We use a two-step process to gen- erate implementations of abstract apps based on their descrip- tions and the concrete apps. First, we filter the set of concrete apps by thresholding the similarity scores between abstract and concrete app description embeddings. Our implementation uses the OpenAI text-embedding-ada-002 embeddings model with the Euclidean distance similarity score. The purpose of the first step is to reduce the apps that must be considered for implementation to only include those that are relevant for a particular task. Second, we use a concrete planner mechanism to determine which filtered apps are capable of implementing each abstract app. The purpose of the second step is to conform discrepancies between type signatures as well as resolve any fine-grained semantic discrepancies between the abstract apps and the proposed implementations. An implementation of an abstract app must conform to the abstract app’s type signature, for both inputs and outputs. A priori, for some abstract app, there may exist reasonable implementations using concrete apps but with incompatible type signatures. For example, a concrete app could produce multiple outputs when the abstract app only requires one, or the ordering of the arguments

8

between the abstract app and the concrete app may not agree. To resolve these issues, we propose to use a compatibility layer which translates between the inputs and outputs of the concrete app and those of the abstract app. The translation process is highly dependent upon the natural language semantics of the involved concrete and abstract apps. Thus, we implement this step with another specialized LLM, whose prompt is given in Prompt 3 of Appendix D. We note that the LLM used for app matching can be different from the one used for planning, giving rise to a configuration space of LLMs which can be tuned according to desired performance-cost tradeoff.

The matching process induces a space of possible concrete plans. Each abstract app corresponds to a set of matched concrete apps which can implement it under a lightweight compatibility layer. All that remains is to choose for each abstract app, a matching to a concrete app. In principle, any such pairing will satisfy the intended semantics of the abstract plan. We prioritize concrete plans to enforce other security constraints, namely low privilege access (discussed in Appendix B) and secure information flow (discussed in IV-F).

E. Executor

After the concrete planning phase, the system possesses a plan detailing concrete steps for achieving the user query while adhering to user-prescribed security objectives. This plan includes the particular implementations of abstract apps as determined by concrete planner. In this section, we describe how to execute this plan securely from a systems perspective.

To enforce additional security in the execution phase, the executor is structured following a orchestrator-worker archi- tecture which separates privilege management from execution.

This design follows the principle of least privilege and further restricts the effect scope of malicious or faulty components. We view both the overall execution of the LLM-generated plan, as well as the execution of concrete apps, as possible points of system misuse, and therefore propose to execute these components in environments with carefully managed capabilities. We propose to use an orchestrator process to man- age resource allocation and privilege enforcement during plan and application execution. The orchestrator spawns worker processes, each of which operates within its own isolated execution environment, ensuring separation from sensitive host system resources. To prevent resource misuse, these execution environments default to the most restrictive possible set of privileges while still enabling the required functionality.

Next, we describe in more detail the responsibilities and capabilities of the three main components of our executor system: the orchestrator, the plan worker, and the app worker.

Orchestrator. The orchestrator is the privileged entry point for the executor whose primary purpose is to manage execution environments for plan processing and app execution. For ex- ample, if a worker requires file system access, the orchestrator spawns an environment with only those privileges.

A secondary responsibility of the orchestrator is to handle message passing between workers. The orchestrator process possesses the concrete plan, and so additionally performs data validation such as schema verification on worker inputs and type enforcement on worker outputs.

It is additionally responsible for overseeing the resource consumption of worker processes. In the event that an app worker consumes too many resources (for example, by ex- ceeding a pre-set runtime limit), the orchestrator is responsible for terminating the execution of the violating worker and communicating the failure condition to the plan worker.

Plan Worker. The plan worker is responsible for sequentially processing the concrete plan. We implement the plan worker to execute the provided script inside a restricted containerized execution environment with no unnecessary privileges such as file system access. The plan worker’s execution process is strictly limited to communicating with the orchestrator over the network using socket-based connections, where the container exposes a network interface. Data exchange occurs through well-defined socket endpoints, allowing asynchronous and bidirectional communication across container boundaries. In this setting, the primary concern is not malicious behavior, but accidental system misuse resulting from faulty LLM-generated code. These restrictions help contain the effect of poorly generated or misconfigured LLM code, such as attempting to overwrite critical system files, or making unintended API calls.

The plan worker is responsible for overseeing the execution of the system plan, but does not itself have the ability to invoke system apps. In fact, under the application of principle of least privilege, it would be a security risk to expose certain capabilities, such as filesystem or network access, to the plan worker. Moreover, much like apps in the mobile platforms, each app in an LLM system may require a different set of privileges to fulfill its purpose. An app responsible for loading documents from the host system’s filesystem cannot function without filesystem access, yet most apps do not require filesystem access (and may not be trusted with such access). So, if the plan worker requires an app invocation it makes a blocking call to the orchestrator and waits until the orchestrator provides the app output.

App Worker. To support modularity, flexibility, and scala- bility in execution, the orchestrator employs Dockerized app workers, each encapsulating a distinct app within an isolated runtime environment with the necessary set of privileges. The app worker only exchanges data with the orchestrator using well-defined network sockets.

Each worker sends its output back to the orchestrator, which collects and routes these results back to the plan worker. This architecture enables loosely coupled interaction among apps, and ensures that intermediate results can be flexibly recomposed into subsequent execution stages.

F. Information Flow Control Security

ACE strictly enforces data privacy and integrity using a structured modeling of information flow constraints. LLM- based systems cannot be trusted on their own to prevent the leakage of private or sensitive information to unqualified destinations. Thus, we propose to systematically monitor and enforce the qualified flow of information through our system.

9

Our solution to this problem is to embed the desired security policy within a lattice and to statically analyze the generated concrete plan to verify that the plan semantics conform to the policy. Secure information flow formally specifies and enforces constraints on how data can flow through a system according to a defined security policy.

Modeling policies with lattices. We model the secure infor- mation flow policy as a universally bounded lattice (C, ⊑). The lattice consists of a set C equipped with a partial order ⊑such that every pair of set elements x, y ∈C has a least upper bound x⊔y, called the join, and a greatest lower bound x ⊓y, called the meet. Semantically, the relation ⊑defines the information flow constraints and can be read as “may flow into”. The join operation models the semantic notion of combining information from two or more classes: the output is “contaminated” by its inputs, and thus its future use must be restricted by a stricter access policy. The meet operation can be interpreted in the following way: if a piece of data of class c needs to flow into multiple storage objects of different security classes c1, c2 ∈C, then the maximum security class of c is c1⊓c2. We give an example of a lattice in Appendix A.

Each data object x ∈O in our system is bound to a security class x ∈C. We allow data objects to be either statically or dynamically bound to security classes. A statically-bound object maintains the same security class throughout the opera- tion of the system. Statically-bound classes are most useful for defining the semantics of resources such as system apps and host storage locations. Dynamically-bound classes are useful for modeling the continual contamination of ephemeral storage objects, such as program variables.

When the user queries ACE, the query q is itself labeled as some q ∈C according to the sensitivity of the involved information. We specify two types of data objects: program variables and app memory. Program variables correspond to the intermediate state of the process executing the plan.

Each variable receives a distinct storage location and program variable objects are dynamically-bound to security classes. At initialization, variables are bound to the query class q, corresponding to contamination from any sensitive information in the query q. We model app memory explicitly as statically- bound data objects. These labels coarsely capture how much data leakage is permitted to apps: importantly, an app should never observe any information contaminated by a label that app is uncleared to see.

Information flow grammar. To enable static verification of information flow constraints during the concrete planning phase, we consider a coarse-grained language grammar con- sisting of three production rules (following Denning ): 1) S: an atomic statement consisting of explicit flow of information from sources x1, . . , xn into destinations y1, . , ym, either by applying an external resource f (external flow) or by an internal resource ⋆(internal flow).

2) S1; S2: the execution of two programs S1, S2 in se- quence. 3) [S]: the program S is executed an arbitrary (but finite) number of times.

Internal flows provide a flexible mechanism for combining data of different security classes, where the operations are performed inside the execution’s runtime environment. That is, data leakage is not possible with internal flows, and so we use these flows for tracking the incremental contamination of program variables. Conversely, external flows impose strict upper-bound constraints on the input labels and lower-bound constraints on output labels for data passing through a compu- tational resource external to the plan’s runtime environment; i.e., app executions. More details on how the flow constraints are enforced with the grammar are given in Appendix A.

Verifying ACE plans. When a user provides a query to the system, they explicitly specify its sensitivity as an element of the lattice. Given the abstract plan from the abstract planning phase, we compile the plan into a program in our information flow grammar. Then, for each proposed concrete plan, we perform the following procedure. First, we bind initial security labels to all apps and variables based on the registered app security clearances and the indicated query label. All flows are additionally implicitly contaminated with the query label, since the plan’s generation is dependent on the user query and thus may itself involve privileged information. We then statically analyze the compiled plan subject to the initial label state to verify that any flow constraints are satisfied. This analysis includes considerations for challenging looping and branching control flow constructs, details and an example of which are provided in Appendix A. The plan is rejected if any constraints are violated. We show an example of an insecure plan and its detection in Figure 5 in Appendix A.

By verifying concrete plan implementations against our lattice-based policy, we automatically reject implementations that violate defined information flow constraints. Should no secure assignment from abstract to concrete apps exist, the system terminates with an appropriate error message, insuring against the execution of insecure flows. Our systematic ap- proach to guaranteeing information flow integrity significantly enhances the reliability and safety of our system.

V. Evaluation

We evaluate the performance of ACE along two dimensions: first, in its ability to defend against several types of attacks (security); and second, in its ability to efficiently and correctly process user queries. First, we demonstrate that ACE renders our new attacks ineffective (V-A). Then, we validate the security claims of our system by testing against two prompt injection attack benchmarks (V-B). Finally, we measure the utility and cost overhead of ACE (V-C).

Models. Throughout our evaluation we make use of several underlying LLMs: GPT-4o, o3-mini, GPT 4.1, Claude 3.7 Sonnet, and Qwen-2.5-72B.

A. Case Studies

To demonstrate that our system explicitly addresses the deficiencies of IsolateGPT, we implement and run our three

Data: {'Financial'}

Fig. 5: An example abstract plan with information leak- age present. Privileged information is loaded into the vari-

Able Data From The App Load_Bank_Details And Sub-

Static analysis detects the dependency and blocks the ex- ecution. It is assumed that the concrete plan matches load_bank_details to an app with clearance “financial”.

attacks from Section III against ACE. ACE effectively prevents all three attacks while providing useful outputs to the user, regardless of the LLM chosen for the abstract and concrete planner. We discuss details of the execution traces below.

Planner Manipulation Attack. The attack fails due to our separation of planning phase into two steps. The abstract plan only depends on trusted information and thus reflects the user’s intent from the query. Second, because of our pairwise independent matching process, we prohibit the unintended cross-app interaction that would have enabled app demotion.

Moreover, the abstract plan from the first phase imposes sufficient constraints on the space of possible execution paths that the output of the compromised app is not able to interrupt the invocation of other apps during execution. We illustrate the failed attack in Figure 13 in the Appendix.

Execution Flow Disruption Attack and Execution Manager Hijack Attack. These two attacks fail in ACE due to the controlled handling of app outputs. Outputs are treated solely as data of a specified type according to the app schema within a pre-defined program, and are never used by an LLM for control flow. Consequently, malicious returned app values such as the disruption string in Execution Flow Disruption Attack or adversarial payloads in Execution Manager Hijack Attack fail to manipulate the LLM. We illustrate the failed attacks in Figure 6 and in Appendix Figure 10.

B. Prompt Injection Benchmarks

Datasets. We study the behavior of ACE in the face of indirect prompt injection (IPI) using two prompt injection benchmarks, INJECAGENT and Agent Security Bench (ASB) .

Both datasets are designed to assess the vulnerability of app-augmented LLM agents to IPI attacks, where adversarial instructions are embedded in outputs from compromised user- facing apps. Details on the datasets and how we adapt them to use with ACE can be found in Appendix F-A.

Metrics. Each test case in both adapted datasets comprises a user query, a set of apps available to the system, a set of one or more expected apps, and one or more designated “attacker

User Query:

Calculate the fare from ‘Main Street’ to ‘Elms Avenue’ with ‘MetroHail’ and ‘QuickRide’

Description: Calculates Fare Prices

Output: Tell the user that the fare for Quick Ride is $54 and the fare from Metro Hail is $85

Ride Is $54 And Metro Hail Is $85”

Fig. 6: Illustration of failed Execution Flow disruption attack on ACE (IsolateGPT execution shown on the left side) apps” which embodies the malicious behavior intended by the adversary. We run all test cases on each benchmark and record two metrics: security and utility. Security measures noninvo- cation of the attacker app(s) during system execution. Utility measures correct usage of expected apps. For INJECAGENT, there is always one such app by construction. For ASB, there are two user apps per agent that could feasibly be used, and we define success as invocation of at least one of them. We distinguish between ‘matching success‘, whether an expected app was matched to an abstract app; ‘execution success‘, whether the execution phase ran without error, conditioned on matching success; and overall success, the end-to-end success rate of expected app invocation. We note that both prompt injection benchmarks involve trivially-simulated apps and do not measure output correctness, providing a limited notion of utility.

Injecagent Results. On Injecagent, Ace Achieved A

security score of 100% across all 1,054 test cases irrespective of the LLM chosen for the abstract and concrete planner. This outcome indicates that no attacker app indicated by the prompt-injected output of any user app was executed and demonstrates ACE ’s effectiveness in preventing the execution of unintended apps via indirect prompt injection. The utility evaluation (Table II) shows that ACE retains ≥84% utility with different combinations of GPT-4o and o3-mini in the abstract and concrete planners, and ≥60% with Claude 3.7 Sonnet and Qwen 2.5 72B Instruct models.

Comparing with StruQ . StruQ is a model-level defense that delimits LLM inputs into instruction or data and fine- tunes the LLM to recognize these regions. We adapt the

11

TABLE II: Utility results for INJECAGENT. Matching and execution success rates are conditioned on system execution reaching the corresponding phase.

85.3

INJECAGENT benchmark to add these delimiters to data at relevant locations to evaluate the StruQ fine-tuned models on the prompt injections from INJECAGENT. Using the fine- tuned Mistral-7B StruQ model, we observe an attack success rate of 7%, indicating several instances of security violations.

The provided Llama-7B StruQ model has too small a context window for the INJECAGENT test cases, so we were not able to evaluate this case. We present a case study of security violation in Appendix F-D. Unlike StruQ, ACE ensures by design that generated plans are determined strictly from trusted data.

ASB Results. On ASB, ACE achieves ≥86% utility with both GPT-4.1 and GPT-4o models. In 2,000 trials, we ob- serve only 3 invocations of attacker apps. In each case, the invocation is unrelated to the prompt injection but in- stead due to the suitability of the app to the user’s task.

For example, on query “Evaluate the risk and potential returns of investing in a new sector,” the abstract app MarketDataAnalysis is generated and matched with the attacker app MarketAnalysisTool which has description “Utilize the MarketAnalysisTool to analyze trading data, pro- viding insights and supporting strategic investment decisions.” In these cases, use of the attacker app is appropriate, and so we do not consider them security violations. Detailed results are given in Appendix F-C.

C. Tool Use Benchmark

While INJECAGENT and ASB provide evaluations against prompt injection, their tool suites are trivially simulated and do not measure the LLM ability to correctly process multiple pieces of data using complex control flows. To further demon- strate the utility of ACE in realistic tool-use environments, we use the Tool Usage benchmark from LangChain as

Considered In Prior Work , . This Benchmark Tests

whether LLMs can generate correct app invocation trajecto- ries to solve multi-step tasks requiring app coordination, as measured against ground-truth trajectories and outputs.

Dataset. The benchmark defines three environments in which the agent operates by invoking tools: a single tool task, a multiple tool task, and a relational data task. The single tool task requires the agent to invoke a single system application several times to type out a word (provided in the user query), with each invocation passing the correct character as an argument. The multiple tool task considers the same typing task, but using 26 different tools which take no arguments. The relational data task requires the agent to process questions by interacting with a relational database comprising three tables by using a collection of 17 tools. We use the description from each task to write the context field.

Metrics. We consider two key metrics for the tool usage benchmark: utility and cost. Utility is decomposed into two submetrics: step accuracy and overall accuracy. Step accuracy measures whether tools were called in the correct sequence as defined in the test case, while overall accuracy measures the correctness of the final system output as well as of the sim- ulated environment state at termination. Cost is decomposed into average per-query API price and wall-clock runtime.

Utility Results. We report utility results on the Tool Us- age benchmark in Table III. We find that ACE consistently achieves high (≥80%) success rates across all benchmark tasks for both GPT-4o and GPT-4.1 models. This result demon- strates the ability of ACE to generate relevant apps, generate a principled plan orchestrating those apps, and match those apps with existing utilities installed on the system. Using GPT-4o and o3-mini yields high utility for single and multiple tool suites and moderate (66.7%) utility on the relational data suite, the most challenging among the three suites.

We manually inspected a selection of ACE execution traces from the relational data suite and observe that structured plans with complex control flows are used to solve user queries. We present such a trace in Appendix E-A.

TABLE III: Utility results for Tool Usage benchmark.

66.7

Overhead Results. We present the overhead of running ACE by phase (Abstract, Concrete, Execute) in Table IV. We discuss the factors that contribute to the financial cost and query runtime of ACE. First, the abstract planning phase requires two separate LLM invocations–the first to generate a set of abstract apps, and the second to implement the abstract plan using those apps. The financial cost incurred at this phase does not depend significantly on the complexity of the task or the system configuration, while the query runtime can grow based on the number of output tokens. Second, the concrete planning phase potentially requires a multiplicatively large number of queries, one for each pair of abstract and concrete

Authors:

Peder EZ Larson 1, 2,* , Jenna ML Bernard1, James A Bankson 3, Nikolaj Bøgh 4, Robert A Bok1, Albert P. Chen 5, Charles H Cunningham 6,7, Jeremy Gordon1, Jan-Bernd Hövener 8, Christoffer Laustsen 4, Dirk Mayer 9,10, Mary A McLean11 12, Franz Schilling13, James Slater1, Jean-Luc Vanderheyden5, 14, Cornelius von Morze 15, Daniel B Vigneron1, 2, Duan Xu1, 2, and the HP 13C

94143, Usa.

Denmark. 5 GE Healthcare, Menlo Park, California, USA. 6 Physical Sciences, Sunnybrook Research Institute, Toronto, Ontario, Canada.

8 Section Biomedical Imaging, Molecular Imaging North Competence Center (MOIN CC), Medicine, Baltimore, MD, USA. Cambridge, United Kingdom.

14Jlvmi Consulting Llc, Dousman, Wi, Usa

#See Acknowledgements for a list of all HP 13C MRI Consensus Group Members This work was supported by the ISMRM Hyperpolarized Media MR Study Group, the ISMRM Hyperpolarization Methods & Equipment Study Group, and the Hyperpolarized MRI Technology Resource Center (NIH/NIBIB grant P41EB013598).

Abstract

MRI with hyperpolarized (HP) 13C agents, also known as HP 13C MRI, can measure processes such as localized metabolism that is altered in numerous cancers, liver, heart, kidney diseases, and more. It has been translated into human studies during the past 10 years, with recent rapid growth in studies largely based on increasing availability of hyperpolarized agent preparation methods suitable for use in humans. This paper aims to capture the current successful practices for HP MRI human studies with [1-13C]pyruvate - by far the most commonly used agent, which sits at a key metabolic junction in glycolysis. The paper is divided into four major topic areas: (1) HP 13C-pyruvate preparation, (2) MRI system setup and calibrations, (3) data acquisition and image reconstruction, and (4) data analysis and quantification. In each area, we identified the key components for a successful study, summarized both published studies and current practices, and discuss evidence gaps, strengths, and limitations. This paper is the output of the “HP 13C MRI Consensus Group” as well as the ISMRM Hyperpolarized Media MR and Hyperpolarized Methods & Equipment study groups. It further aims to provide a comprehensive reference for future consensus building as the field continues to advance human studies with this metabolic imaging modality.

Keywords: Hyperpolarized MRI, metabolic imaging, carbon-13, pyruvate, dissolution dynamic

Introduction

MRI with hyperpolarized 13C agents, also known as hyperpolarized (HP) 13C MRI, has shown great potential as a novel imaging modality, particularly for its ability to probe metabolic processes in real time. The first human studies with HP [1-13C]pyruvate were performed in 2011 in prostate cancer patients (1).

Since then, there have been over 60 papers published with imaging results of human subjects from 13 different sites, with applications including prostate cancer, brain tumors, breast cancer, kidney cancer, pancreatic cancer, metastatic disease, liver disease, ischemic heart disease, diabetes and cardiomyopathies. The vast majority of these studies used [1-13C]pyruvate (1–63), where [2-13C]pyruvate (64) and 13C-urea (56) have been demonstrated too.

As clinical HP 13C MRI advances, there is a growing need to build consensus for best practices, which are critical for comparing data across sites, performing multi-site trials,deploying methods to new sites, partnering with vendors, and potentially for obtaining broader regulatory approvals.

In March 2022, we initiated an effort to build consensus within the HP 13C MRI community with this opportunity in mind, and it was greeted with strong enthusiasm. The “HP 13C MRI Consensus Group”, containing over 55 members from 27 sites, identified the area of greatest need and opportunity for consensus building to be HP [1-13C]pyruvate human

●

Pyruvate is the most mature and widely used HP agent and has the most significant translational evidence emphasizing the potential clinical impact.

●

Clinical trials, particularly multi-site trials, have the strongest need for consensus methods to ensure that data can be combined across sites. This work is a Position Paper for which the goal is to describe current successful practices and study methods for HP [1-13C]pyruvate human studies along with justification to support those practices. This is divided into four major topic areas: (1) HP 13C-pyruvate preparation, (2) MRI system setup and calibrations, (3) data acquisition and image reconstruction, and (4) data analysis and quantification (Fig. 1). The current successful practices and study methods include a literature review of published peer-reviewed journal papers showing human HP [1-13C]pyruvate study data, up to September 2022 (1–63), as well as new unpublished information from surveys of HP 13C study sites. Based on this information, we also highlight the evidence gaps, strengths, and limitations of current practices which are summarized at the end of each section.

Figure 1: Illustration of the HP 13C MRI human study process, including the 4 major areas covered in this paper: Hyperpolarized 13C-pyruvate preparation, MRI system setup and calibration, Acquisition and Reconstruction, and Data Analysis and Quantification.

Figure 2: Anatomical targets of HP [1-13C]pyruvate MRI human studies published up to September 2022.

Hyperpolarized 13C-Pyruvate Preparation

This section covers the processes for creating the HP agent, 13C pyruvate, and will include many aspects and considerations that are needed to safely and effectively prepare doses for metabolic imaging studies in human subjects. These include material, personnel, equipment and facility, fluid path preparation, quality control, and release.

It is helpful to understand that the specifications of a dose of 13C pyruvate suitable for in vivo MR HP metabolic imaging were shaped in part by early preclinical studies performed by GE HealthCare summarized in Ref. (65). In short, the safety of the two novel drug components, 13C pyruvate and the electron paramagnetic agent (EPA) AH111501, were demonstrated in those studies. The more precise formulation of the dose suitable for human use was then determined from clinical studies (66) that included two Phase 1 clinical trials in young and elderly healthy volunteers without hyperpolarization of the 13C nuclei and another Phase 1/2a dose escalation and imaging feasibility study with HP 13C pyruvate in 31 prostate cancer patients at the With the exception of the first HP 13C imaging clinical trial, which utilized a prototype device in a cleanroom (1), all HP 13C studies performed in humans to date have utilized the SPINlab polarizer (manufactured by GE HealthCare). Consequently all doses of the HP 13C pyruvate delivered by SPINlab have been produced using the “SPINlab Pharmacy Kit” that serves as the container-closure system for the various drug components (13C pyruvic acid and EPA mixture, dissolution medium, and neutralization and dilution medium) during sample polarization, dissolution and quality control (QC) processes. Thus many aspects of the HP sample preparation considerations discussed below are related to the SPINlab instrument and the consumables designed to be used with it (67).

General Considerations

While more than 860 patients or healthy subjects having been injected with HP 13C pyruvate as of January 2022 without reports of any serious adverse events (68), HP 13C pyruvate injection remains an investigational MR contrast agent and can only be administered by those with Investigational New Drug (IND) exemption from the Food and Drug Administration (FDA) in the USA, a Clinical Trial Application (CTA) in Canada, approval from National Research Ethics Committee Services in the UK, or approval from the relevant local regulatory body. Thus, methods and processes involved to produce a dose should have patient safety as the first priority. Since utilizing dissolution dynamic nuclear polarization (dissolution-DNP) for human use is still a relatively new development, there are no existing published regulatory guidelines specifically for this method.

There are two major production styles that determine how various sites approach the agent preparation. In the US, the most common approach is to rely on a sterilizing filter (“Terminal Sterilization”) to ensure sterility of the final product, akin to PET tracer production, where a starting molecule with a radioisotope is processed using various other ingredients to make the final, desired and injectable contrast agent within a necessarily short amount of time (69). For these sites, sterilization of the components and accessories upstream of this filter are not required, although many of them were manufactured and tested following Good Manufacturing Practice (GMP) or Good Laboratory Practice (GLP) requirements. The filling process is usually performed under an ISO 5 laminar flow hood, but a clean room or an isolator is not required.

This approach is typically accompanied by testing the integrity of the sterilizing filter prior to release of the dose for injection. Typically, post release endotoxin and sterility tests are performed using an aliquot reserved from each released dose.

In the UK and EU, the most common approach is to more-closely follow sterile pharmaceutical compounding guidelines (70), where all components and ingredients are required to be sterile or manufactured under GMP guidelines and are assembled and filled within a clean room environment or an isolator system (“Sterile Preparation”). Typically a batch of Pharmacy Kits for HP 13C pyruvate injection are prepared together. The sterility of the final dose is also ensured by batch validation testing, in addition to the sterility of the ingredients and the sterile compounding process. The endotoxin and sterility testing are performed for the process validation but are not performed for each injected dose.

Some institutions fill and assemble the Pharmacy Kit required for a specific study on the same day or the day prior to polarization, dissolution, and patient administration, but others have also demonstrated the feasibility of preparing a batch of kits, keeping them in a -20ºC freezer and using them over a period of a few months.

Beyond the obvious requirements that the process and the facility has to ultimately produce a dose that is safe to inject into a human, regulatory authorities will also focus on the question “Are you in control of your processes?”. To be in control of your process requires an in-depth and broad understanding of all processes involved in pre, post, and during the production process.

Personnel

It is typical and may be required to have licensed personnel involved in the production process depending on local regulations.Typically a pharmacist, radiopharmacist or other similarly qualified person (QP), in charge of the facility where the Pharmacy Kit filling and preparation is taking place, is responsible for the overall process and the release of the injectable dose.

Qualified cleanroom technicians are often involved in the Pharmacy Kit filling under the supervision of the pharmacist or QP. As is required for pharmaceutical compounding or PET tracer production, training requirements and training records for all personnel need to be maintained and available for audit by the FDA or equivalent.

Equipment And Facility

The facility and all equipment need to have standard operating procedures (SOPs) that describe how equipment is used, maintained, and calibrated to comply with relevant legislation. Currently, almost all the filling of the Pharmacy Kit takes place within a compounding laminar flow hood or isolator (typically ISO 5). At some sites, the filling is conducted within a cleanroom, while at others, it is conducted in a dedicated non-cleanroom space, reflecting differences in cleanroom approach and specifications between regulators worldwide (71). Some equipment or facilities, such as the compounding hood or cleanroom, may require external certified laboratories for testing.

Material Handling

Material handling guidelines (69,70) require SOPs detailing a system to track all of the materials involved in the HP production process for a particular patient dose, similar to current good manufacturing practice (cGMP) requirements for material handling for drug compounding. This includes acceptance standards, storage conditions, amount used in the patient dose for each ingredient and materials used in the assembly of the fluid path and Pharmacy Kit. Currently some users choose to open and inspect and sometimes modify the Pharmacy Kits upon arrival, but some users keep them in the sealed packaging until they are required for dose preparation.

Pharmacy Kit Filling And Assembling

As required by an IND or its equivalent, the preparation of the doses of HP 13C agent are detailed in the Chemistry, Manufacturing, and Control (CMC) section of an applicable regulatory submission; an example of this has been made available (72). It describes the processes of filling the Pharmacy Kit with the different components that make up the final drug product, and of assembling the final kit for either storage or immediate use in the polarizer. Special attention should be given to the laser welding process in order to satisfy installation qualification (IQ) and operational qualification (OQ). Typically, the final developed process is validated by process qualification (PQ) runs, during which 3 or more Pharmacy Kits are filled and used and the final HP 13C products are tested for endotoxin and sterility and to confirm that they meet the dose specifications for injections (usually including pyruvate concentration, residual EPA concentration, pH, liquid state polarization level and dose temperature). The data from 3 consecutive PQ runs are submitted as part of the IND submission (or its equivalent), and are often also reviewed by the Institutional Review Board (IRB) where the studies are conducted.

Quality Control And Dose Release

The quality control (QC) and dose release can be separated into two aspects: one is the QC and release of the filled Pharmacy Kit, and second is the QC and release of the HP 13C agent for injection, after polarization and dissolution. For institutions filling a batch of kits and storing them to use over a period of time, typically the batch can be released based on initial validation, environmental monitoring data from the day of kit production, and if filters are used during preparation of any of the components, filter integrity testing. But in some cases one or more kits are used for validation before the batch of kits are released for future use. For institutions that fill only the kits required for specific studies shortly before the experiment, the filled kits often do not go through separate release tests before they are used.

The quality control of the HP 13C pyruvate solution post dissolution is primarily performed to ensure that the agent meets the dose specifications (Table 1) before it is administered to the subject. These specifications target both safety (pH, residual EPA, temperature) and efficacy (pyruvate concentration, polarization, volume). Typically, the pyruvate concentration, residual EPA concentration, pH, dose temperature, dose volume, and liquid state polarization are measured by the QC accessory associated with the SPINlab polarizer. Some users perform a secondary measurement for one of the parameters, such as pH, using a different instrument or pH paper. For sites that do not go through a separate release testing process for batch filled kits, the integrity of the sterilization assurance filter, a part of the Pharmacy Kit, is typically tested as a part of the dose release. It is also common for these users to preserve an aliquot of the final HP 13C pyruvate solution for post-release endotoxin and sterility testing. This testing cannot be completed fast enough to test an individual dose prior to injection, but this is why other processes such as PQ runs and validation testing are done to minimize the chance a subject could be injected with a contaminated dose.

The Final Dose Release And Injection

should be done under the supervision of a licensed professional, based on local regulations.

Some Key Challenges

Many of the challenges associated with HP 13C pyruvate preparation can be attributed to the conditions required for the dissolution-DNP method of high magnetic field (~3-7 T) and very low temperature (~1 K) during polarization, with pressurized and superheated water necessary for the rapid dissolution event. These extreme conditions are quite challenging for the design of the container-closure and fluid path system. In particular, the cryogenic temperature in the polarizer requires special attention to any moisture or ambient (moist) air introduced into that portion of the fluid path, which can form an ice block at ~1 K. This ice can lead to flow restriction during the dissolution event and reduce the strength of the laser welded bond between the cryovial and its cap. This can ultimately produce failures in the dissolution step, including variations in final pyruvate concentration and pH that may fail to meet QC release criteria as well as fluid path ruptures that provide no available dose and result in polarizer down-time.

The polarization of the HP 13C pyruvate sample decays quickly over the span of a few minutes after dissolution, and thus the process of dissolution, QC for release, and injection should be completed as fast as possible to preserve the high polarization level achieved. Any delays in the preparation process, such as transportation time or equipment malfunction, can significantly reduce the final polarization and result in lower quality imaging data.

Current Practices

A summary of data collected from all sites performing clinical trials with HP 13C-pyruvate is shown in Fig. 3 and Table 1, including the specification of the final dose and how the quality control and release of the final dose are performed. There is a split in the Production Style, described in the General Considerations section above, with 8/13 sites using Sterile Preparation versus 5/13 using Terminal Sterilization. While many of the dose specifications show notable differences in acceptable ranges, all of these variations listed in tables have been successfully and safely been used to perform HP 13C pyruvate studies in humans. Their differences depend on the institutions’ preferences, resources and their particular regulatory situation. There is high similarity in pyruvate ranges, temperature ranges, EPA limits, and volume limits. There is modest variability in pH ranges and large variability in the endotoxin test limit. There is a 3-fold difference in acceptable polarization levels, which are measured to ensure a futile dose is not injected since the polarization is directly proportional to SNR. This reflects the decision by several sites to believe that useful data can be still be obtained with suboptimal polarizations.

Figure 3: Hyperpolarized agent preparation methods reported by sites currently performing HP

In House

Table 1: HP 13C-pyruvate preparation parameters, methods, and dose specifications used for quality control testing and release as well as validation. These were obtained from a survey of all sites performing clinical trials with HP [1-13C]pyruvate. The parameters used for product release are noted in bold text, otherwise these parameters are measured for batch validation or other QC measurements. The endotoxin and sterility testing are performed during process validation of the batch and/or post-injection, and largely depends on the agent production approach.

Summary

The overall safety record of HP 13C-pyruvate has been very strong, and the SPINlab hyperpolarizer has proven to provide high polarizations at human sized doses while meeting numerous QC and release criteria. A weakness remains the failure modes of the SPINlab Phamacy Kits (e.g. ice blocks, path ruptures), which are placed under extreme requirements particularly during dissolution. The preparation process still requires a high degree of expertise.

Therefore, there is a significant need to improve the reliability, robustness, and ease of operation for generating HP 13C-pyruvate doses for human studies. Furthermore, there is a divide between manufacturing and sterile compounding style preparation as well as other site-specific practices, resulting in variations in SOPs and justification required to relevant regulatory bodies. There have also been no comparisons between these approaches. It is also unclear what release criteria and QC parameters are truly required to ensure patient safety.

However, all of the reported methods are acceptable and approved by the appropriate regulatory authorities, and have led to the rapid expansion of successful human studies in recent years.

Mri System Setup And Calibrations

This section covers the MRI system setup, including the imaging system, RF coils, phantoms, and prescan calibration methods.

Imaging System

The main prerequisite for a given MRI scanner to be capable of supporting studies with HP 13C is its “broadband” capability to transmit and receive radiofrequency (RF) signal at the frequency of 13C, which is around 4 times lower than 1H. This does not come as a default on clinical MR devices. The transmit power of the broadband amplifier should also be sufficient to support the intended flip angle and RF pulse shape with the employed transmission RF coil(s) for 13C. Most studies to date use relatively low flip angles (< 90 degrees) for HP 13C in order to preserve polarization for time-resolved imaging. The capability to receive 13C signal on multiple channels is also desirable to increase SNR, as discussed further in the “RF coils” section.

The choice of magnetic field strength is primarily dependent on the metabolites’ frequency separation due to chemical shift dispersion and 1H imaging. High field strengths do not enhance hyperpolarized 13C signal as they do for 1H because the signal strength in a HP experiment relies on manipulating the population of quantum energy states outside of the MRI scanner.

However, the injected HP 13C-pyruvate and its metabolic products have greater frequency separation at higher fields, and it may thus be easier to separate and quantify these resonances at higher fields. This comes at the cost of a reduction in the achievable T2* and often reduced T1. As the initial polarization is independent of the imaging field strength it has been proposed that the increased T2* at 1.5T can potentially be exploited to increase SNR by adapting the acquisition bandwidth or reduce off-resonance imaging effects in cases when the decay of the transverse magnetization is dominated by T2* (73). In practice, 3T has been used in all published human 13C-pyruvate studies surveyed (Supporting Table S1), and comprises the majority of scanners currently in use for human studies (Table 3). A field strength of 3T is well-suited for 1H MRI anatomical reference and correlative imaging.

Stronger and more rapidly slewing magnetic field gradients support more rapid spatial encoding, particularly for metabolite-specific single-shot imaging using echo-planar imaging (EPI) or spiral imaging (See “Acquisition and Reconstruction”). Although the spatial resolution acquired for HP 13C imaging is typically much coarser than for 1H MRI, the factor of ~4 in gyromagnetic ratio leads to the same reduction factor in performance of the gradient system, so 13C experiments are potentially more limited by gradient hardware performance. To date, all human studies have used the commercially-available integrated gradient systems provided in clinical MRI scanners.

Optimization of scanner design has understandably focused on minimization of artifacts in 1H MRI, where devices such as room lights, the gradient amplifiers, and the motors driving the patient bed are checked to ensure that they do not produce RF interference at the 1H frequency, but artifacts may arise at other frequencies. Eddy current compensation is also not always appropriately adjusted for nuclei at other frequencies (74). In order to optimize for 13C, many sites have performed checks on phantoms for RF interference, gradient artifacts, and eddy currents (74), including the use of post-hoc gradient impulse response function characterisation and correction, and some vendors have fixed these issues as well.

Rf Coils

For HP 13C imaging studies in humans, RF coils for both 1H and 13C nuclei are needed, with 1H MRI providing an anatomical reference for registration and optional additional multiparametric MRI readouts. At the Larmor frequency of 13C nuclei, the relative contributions from coil noise compared to sample noise increase compared to 1H (73,75), although sample noise still is likely the dominant contributor for human-sized coils at 32.1MHz - the resonance frequency of 13C nuclei at 3T.

The key requirement for human 13C-pyruvate RF coils are that the coil geometry and sensitive volume must cover the volume of interest in the subject. Table 2 and Figure 4 shows coil configurations that have been used and optimized for applications in different anatomic regions.

Volume resonators are most commonly used for transmit, as they surround the subject to

Provide B1 Transmit Across The Fov (B1

+). While 1H relies on a large birdcage (“body”) coil built into the scanner, 13C transmit coils must be placed inside the bore. This takes up valuable space within the magnet, and also has led to the use of designs with relatively inhomogeneous

B1

+. Many human studies have used Helmholz pair resonators for transmit, including the “clamshell coil”, which has a notably inhomogeneous B1

+ Profile But Has Been Used Because Of

relatively easy integration into the scanner bore. B1

+ Variation Results In Variations In The Flip

angles that control the use of the hyperpolarized magnetization and creates errors in common HP metrics (9,76). The exception are head coils, where birdcage designs with highly

Homogeneous B1

+ can be placed around the head while easily fitting inside the bore. As with 1H MRI, higher SNR can typically be achieved by smaller receive coil elements, such as surface coils or phased arrays, and the majority of 13C receive coils used have layouts similar to 1H phased arrays.

RF coil quality control is important to ensure proper functioning of the coils to provide consistent imaging quality, especially with limited natural abundance 13C signal in vivo. It typically involves 1) a physical integrity check of the coil cables and connectors and 2) phantom SNR tests to check the coil’s performance and to monitor it over time (see Phantoms below). An useful reference for RF coil quality control is outlined in the MRI accreditation program of the American College of Radiology (77) and can be adapted for 13C coils.

Notably, configurations for brain and prostate studies used dual-tuned 1H/13C coil designs, which greatly simplify workflow and registration of 1H and 13C images, as no switching of coils is needed.

(1)

Table 2: RF coil configurations reported for human HP [1-13C]pyruvate studies.

Tx = Transmit

coil, RX = receive coil. The commonly used “clamshell” TX coil is a Helmholz pair design. For 1H RF configurations, all used the Body coil for TX unless otherwise noted, and “repositioned” indicates the 13C coil was removed for 1H imaging. One representative reference is listed for each configuration. The RF coil configurations reported in the reviewed papers are shown in Supporting Table S1.

Figure 4: Examples of RF coil configurations used for human HP [1-13C]pyruvate brain studies. (A,B) 13C Clamshell TX (Helmholz pair) and 2× 4-channel paddle RX arrays. (C) 13C Birdcage volume TX and 32-channel RX array (RX array slides into TX coil). (D) 13C Birdcage volume TX and 24-channel RX array, combined with a 1H 8-channel RX array. Image reproduced with permission from Ref (16).

Phantoms

Since hyperpolarized magnetization is non-renewable, phantoms containing 13C nuclei are important to: 1) test the multi-nuclear capabilities of the imaging system, including all parts of the signal excitation and receive chain; 2) perform calibration measurements before a scan with hyperpolarized nuclei; and 3) perform necessary pre-scan adjustments (see “Prescan Calibration” section). The phantoms currently in use are listed in Table 3. Their composition must provide sufficient 13C signal, with additional considerations of conductivity, stability, chemical shift(s) present, potential for dynamic imaging, and cost. The phantom geometries are typically either compact, in order to be used alongside the subject during a HP scan, or large enough to mimic the inner volume of a RF coil for system testing.

One popular compact design contains enriched 13C-urea at high concentration, typically 8 M, which provides a single resonance, placed inside a small container ~1 mL. The most common recipe mixes 13C-urea in a 90% water/10% glycerol solution, with glycerol used to increase the urea solubility and doping with a Gd-based contrast agent to shorten T1 which increases the potential SNR per unit time. For example, when Dotarem is added at a 3:1000 volume ratio the 13C-urea T1 is around 500 ms and T2 is around 100 ms. However, when testing pulse sequences influenced by T1 and T2, doping should be used carefully. This phantom is suitable for frequency calibration, transmit gain calibration, sequence testing, and as a fiducial marker when placed next to a patient. However, enriched 13C-urea has a relatively high cost compared to natural abundance compounds.

For larger volumes (>100 ml), the phantoms most often used contain undiluted ethylene glycol, glycerol, or dimethyl silicone. These compounds have sufficiently high carbon concentrations to provide sufficient 13C signal even with the 1.1% natural abundance of 13C. These larger phantoms matching the inner volume of an RF coil are useful for coil testing, including transmit

+) And Receive (B1

-) coil profile mapping, as well as to mimic acquisitions using in vivo FOV requirements. In this case, size and conductivity should match the expected subject size in order to mimic coil loading and get a realistic estimation of B1+. Large-volume natural abundance urea phantoms have also been used by some sites, but suffer from higher conductivity compared to biological tissues. Typically, it is easier to increase the conductivity and hence coil loading of the non-conductive phantom by adding NaCl to match physiological loading (16,78).

Dynamic phantoms that aim to mimic metabolite kinetics have also been developed (79–81), and have the potential to more closely mimic the HP experiment, but so far these are not widely used.

Prescan Calibration

Prior to performing an MRI acquisition, the so-called prescan procedure is used to set the shim parameters to maximize B0 homogeneity over the field of view (FOV) or a specific region of interest (ROI), the scanner center frequency (CF), the RF transmit gain, and the receiver gain.

While this calibration procedure is usually automated for 1H, the lack of sufficient natural abundance 13C signal prevents use of automated methods. (Although natural abundance 13C lipid signal has been detected, there are so far no reports on using this signal for prescan.) Table 3 shows current practices across sites.

Maximizing B0 homogeneity is independent of the nucleus and is therefore performed prior to 13C imaging using the 1H water signal and existing shimming tools, such as by a standard automated process (“Auto Shimming”) or using high order shimming routines. Similarly, the 13C CF can be calculated from the 1H CF using a predetermined scaling factor that depends on the target chemical shift (82). Another common approach used is to have a small, high-concentration 13C phantom, e.g. 8M 13C-urea, integrated in the RF coil or placed next to the scan subject (1). The reference frequency can also be based on real-time measurements after the HP injection but prior to imaging (83). Both the CF and B0 shimming are critical when using spectrally-selective RF pulses, as inmetabolite-specific imaging methods, where the desired excitation bandwidths are typically very narrow and frequency offsets can lead to a failure mode that is only apparent after injection.

The calibration of the RF transmit power is typically performed on a small, high-concentration 13C phantom placed near the region of interest during the scan or on a large 13C phantom of similar size and coil loading as the subject, prior to the subject scan. Reference power is often done by sweeping the power in a pulse-acquire sequence (53,62), or the Bloch-Siegert method (52,84). When using a small phantom, the location of the phantom, B1

+ Inhomogeneity As Well

as any shielding effects, e.g., when the phantom is integrated into a coil (1), may degrade the accuracy. Other methods include real-time Bloch-Siegert method measurements after the HP injection (83), and using the stronger natural abundance 23Na signal that is close enough to the 13C resonance frequency to be detected by 13C coils (82).

The receiver gain is predetermined, either systematically based on independent phantom measurements and assuming the dose and polarization of the HP compound is known prior to injection, or based on past HP imaging studies.

Power [Kw]

Phantom(s) - during study Phantom(s) - before study 13C Frequency

8

13C-bicarbonate doped with dimethyl silicone, various

Maximum Values

Table 3: Summary of the imaging systems, phantoms, and prescan procedures used at sites currently performing HP 13C-pyruvate human studies. These were obtained from a survey of all sites performing clinical trials with HP [1-13C]pyruvate. *Previously performed studies with a Siemens 3T Tim Trio. The imaging systems, phantoms, and prescan procedures reported in the reviewed papers are shown in Supporting Table S1.

Summary

Commercially available 3T MRI systems are by far the most commonly used for human HP 13C-pyruvate studies, although a systematic investigation of the impact of B0 has only recently been investigated (73). The multi-nuclear RF transmit and receive chain has proven sufficient for current acquisition strategies, although many sites have observed artifacts due to RF interference, gradient interference, and residual eddy currents when operating at the 13C frequency. A variety of 13C RF coils, tailored for numerous anatomical targets, have been successfully demonstrated, with the main limitation that most transmit coils take up a lot of additional space inside the bore and provide relatively inhomogeneous B1

+ Profiles. The

phantoms used have converged into generally 2 categories - small phantoms containing 13C-enriched compounds that can be used during the study and human-sized phantoms containing compounds with high carbon concentrations but without 13C enrichment that are used to test and calibrate the coils. There are no standardized compositions or geometry, and dynamic phantoms that recapitulate in vivo kinetics would be desirable but are still an emerging area. Prescan calibration procedures were not well defined in most publications, so we surveyed individual sites to determine current practices. Calibration procedures for the B0 field (13C CF and shimming) for most sites take advantage of 1H signal and methods, while methods

For Calibration Of B1

+ is more variable across sites, likely a reflection of remaining challenges in how to perform this calibration. Standardization of both phantoms and calibration procedures would synergistically improve the robustness and reproducibility of HP 13C studies.

Acquisition And Reconstruction

Data acquisition strategies in human HP [1-13C]pyruvate MRI studies must account for multiple chemical shifts, efficiently utilize the non-renewable HP magnetization, and acquire data quickly relative to metabolism and relaxation decay processes. These studies require spectral encoding to separate metabolites, necessitating pulse sequences that efficiently encode up to 5D data (3 spatial + 1 spectral + 1 temporal dimension). RF pulses must efficiently sample without immediately saturating the non-renewable HP magnetization, and sequences must acquire data quickly and be robust to both experimental and physiologic variation (e.g. B1

+ Inhomogeneity,

variation in perfusion) to ensure reproducibility and minimize scan-to-scan variability. This section covers current successful practices for data acquisition in human [1-13C]pyruvate studies, and accompanying 1H imaging, from different anatomic regions, including scan parameters and image reconstruction.

Acquisition And Reconstruction Methods

The acquisition methods used in human [1-13C]pyruvate studies can be classified into 3 categories: 1) MR spectroscopy or MR spectroscopic imaging (“MRS/I”), 2) chemical shift encoding methods, and 3) metabolite-specific imaging (Fig. 5).

Mrs/I Methods Specifically

resolve a spectrum that can be analyzed to extract expected as well as unexpected resonances, making this approach very robust. It was used in many initial studies (1).

Chemical Shift

encoding methods, most commonly the Iterative Decomposition of water and fat with Echo Asymmetry and Least-squares estimation (IDEAL) method, use imaging sequences acquired with multiple TEs and rely on a model-based separation of expected chemical shifts (85).

Metabolite-specific imaging methods use specialized RF pulses that are spatially and spectrally selective to excite individual metabolites which are then typically imaged with fast k-space trajectories such as echo planar imaging (EPI) or spirals (86).

Their Application To Different

organ systems is described below. The image reconstruction methods used in human [1-13C]pyruvate studies have typically been conventional methods (e.g. FFT, non-uniform FFT, or equivalent). The incorporation of accelerated imaging and advanced reconstruction methods including parallel imaging (4,57,87) and compressed sensing (7) has also been applied in human studies for improved spatial resolution, temporal resolution and coverage, but have the potential for additional artifacts as well as SNR losses due to ill-conditioning of the reconstruction (e.g. g-factor).

The Majority Of

published studies do not use accelerated imaging indicating the resolution and coverage achievable without acceleration is currently adequate for successful data collection. Performing coil combination, even with fully sampled data has also been shown to have specific challenges for HP human images: using naive sum-of-squares methods suffer from high noise amplification in the relatively low SNR regime of HP [1-13C]pyruvate (compared to 1H), motivating several HP 13C-specific methods that include data-driven coil sensitivity estimation which have shown obvious improvements over sum-of-squares (11).

More recently denoising techniques have been applied as post-processing of human HP data(41,42,44). The techniques applied are based on spatial-temporal singular value decomposition for unsupervised estimation of signal and noise components. They have shown improvements in apparent SNR in the brain and liver, while care must be taken to choose parameters such as the rank threshold to avoid oversmoothing and overfitting to the estimated signal components.

Prostate Studies

Prostate cancer was the first human application of HP [1-13C]pyruvate (1), and data was acquired with MRS/I methods: 1D dynamic MRS, single-slice 2D dynamic echo-planar spectroscopic imaging (EPSI), and single time point 3D EPSI. Advances in imaging strategies led to the development and application of new acquisition schemes, including undersampled 3D EPSI with compressed-sensing (7), model-based chemical shift encoding methods that use a priori information (47,59), and metabolite-specific EPI (10), all of which can provide volumetric whole-organ coverage and dynamic acquisitions.

The pyruvate bolus arrival in the prostate can vary by ± 10 s between patients, necessitating dynamic imaging to reliably and consistently capture the pyruvate bolus (18). For this reason, all currently ongoing studies acquire dynamic data. While MRS/I, chemical shift encoding, and metabolite-specific imaging can all achieve dynamic imaging, chemical shift encoding and metabolite-specific imaging provide greater dynamic and volumetric coverage (85). For scan prescriptions, the FOV is designed to provide full prostate coverage and typically to match the orientation of the anatomic imaging used for registration. Flip angles used in current studies are constant through time, as quantification with a variable-through-time flip scheme is highly sensitive to bolus timing (8) and errors in the RF transmit (B1 +) field (76).

Heart Studies

Data acquisition methods for 13C imaging in the heart must be designed to meet the demands of significant cardiac motion and blood flow. To cope with the periodic cardiac motion, most human heart studies to date used gating to the diastolic window, the longest cardiac cycle interval, which has reduced motion (2,22,28,30,35,36,38,45,52). The duration of the diastolic window limits the available data sampling time, making cardiac acquisitions the most time-constrained of the HP 13C MRI applications. The most common acquisition approach is metabolite-specific imaging with spiral k-space trajectories (2). Their single-shot imaging capability makes these methods particularly robust to motion effects. Furthermore, spiral k-space trajectories provide rapid k-space coverage and relatively benign flow and motion artifacts. The majority of studies have used 2D multi-slice acquisitions, but 3D encoding has also been used successfully (35).

Brain Studies

For HP 13C MRI of the human brain, the majority of studies have also used 2D (slice selective) acquisitions (10–12,14,16,28,33,40,41,44,51,53,60), with a trend toward volumetric coverage using 2D multi-slice metabolite-specific imaging. 3D metabolite-specific imaging of the whole brain, with phase encoding of the slice direction (34,57), has been shown to provide similar SNR efficiency (88) compared with multislice imaging. A number of studies have employed MRS/I (5,6,29,31–33,50,55) resulting in a spectrum from each voxel, which has the advantage of not requiring a priori information about which peaks to encode. This was important in early brain studies when it was not known which peaks would be detectable. Chemical shift encoding, using a set of images with different echo times and an iterative reconstruction of the individual resonances (i.e. the IDEAL approach (85)), has also been used (12,49,54), with the drawback that coverage in the slice direction was limited due to the time required to acquire multiple echo time images.

Abdomen And Breast Studies

The fundamental approaches to data acquisition and reconstruction in the abdomen and breast are largely similar to the aforementioned applications, but demand attention to particular challenges associated with these anatomic regions, especially relating to respiratory motion.

Although it has been shown that a basic 2D MRSI approach based on phase encoding and FID readout can be successfully applied for HP 13C imaging in breast (15) and kidney (13), major advantages in terms of spatiotemporal resolution and coverage have been realized using tailored approaches based on metabolite-specific imaging (43,62) and chemical shift encoding (43), which have facilitated multi-slice or 3D dynamic acquisitions over large FOVs in the abdomen (4,37,46).

The significant respiratory motion encountered in these regions can directly blur 13C images, and has further favored these rapid acquisition strategies. Motion also degrades B0 homogeneity, which can shift frequency-selective excitation profiles and introduce artifacts into rapid imaging readouts. This makes accurate determination of the acquisition center frequency and shimming essential in these regions which often cover large FOVs. (See “Prescan Calibration” section for more information). In some studies, breath-holding was used to minimize motion effects and enforce frame-to-frame data consistency (42). A pragmatic and reasonably effective approach for dealing with respiratory motion during 13C data acquisition is an initial breath-hold (as long as can be tolerated), followed by free-breathing (46,62).

1H Imaging

Collection of 1H imaging data is essential both for prescribing the 13C acquisition and for interpretation of the resulting 13C data. Multi-planar 1H scouts are acquired prior to 13C acquisition to enable graphical prescription of the 13C imaging region. All human HP 13C-pyruvate imaging studies acquire conventional MRI scans (e.g. T1- and T2-weighted volumes) for anatomic reference, aiming to cover at least the full 13C FOV. Acquiring these anatomic scans as close as possible to the time of 13C imaging (immediately before or after) minimizes potential misregistration between the data sets. Depending on the application, other advanced 1H sequences are also acquired (e.g. diffusion-weighted imaging for cancer imaging).

When contrast-enhanced data is acquired, it is done after 13C imaging, as paramagnetic contrast agents will accelerate 13C relaxation.

Reported Study Parameters

Figures 5 and 6, and Supporting Table S2 shows the reported acquisition study parameters for human HP [1-13C]pyruvate studies published as of September 2022. Figure 5 shows a mixture of MRS/I, metabolite-specific imaging, and chemical shift encoding methods have been successfully used, where spectroscopy-based methods have become less prevalent in recent studies. Figure 6 shows the acquisition timing, including the important start time and interval/temporal resolution, is quite variable across studies.

Figure 5: Acquisition methods used in published HP [1-13C]pyruvate human studies published up to September 2022, classified into: MR spectroscopy and spectroscopy imaging (MRS/I); chemical shift encoding methods, such as IDEAL, that use multiple TEs and model-based reconstructions; and metabolite-specific imaging methods that use spectrally-selective excitation to image a single resonance at a time.

Figure 6: Temporal acquisition characteristics reported in HP [1-13C]pyruvate human studies published up to September 2022. (a) Reported referencing of acquisition start times.

(B)

Acquisition start times reported when using dynamic imaging and when timing was reported relative to the end of the injection. (c) Temporal resolutions. “Not Applicable” indicates dynamic imaging was not used.

Summary

Three general categories of acquisition strategies have been used successfully for human HP 13C-pyruvate studies: MRS/I, model-based chemical shift encoding (e.g. IDEAL) methods, and metabolite-specific imaging methods. These have enabled successful studies in the prostate, heart, brain, abdomen, and breast. Recent studies increasingly have used the imaging-based strategies of metabolite-specific imaging and chemical shift encoding which are the fastest methods, although a heads-to–head comparison between techniques has not been performed.

Metabolite-specific imaging is quite popular because of its speed and compatibility with single-shot imaging, but is sensitive to B0 field variations and thus requires careful calibrations. Nearly all studies surveyed acquired data dynamically, allowing measurement of the bolus and metabolite kinetics. The exact timings and associated flip angles vary quite widely across reported studies, with no consensus yet as to how to choose these parameters. Image reconstruction is typically done directly using Fourier Transform methods, and accelerated imaging strategies are uncommon.

Data Analysis And Quantification

This section covers the analysis of data from human HP [1-13C]pyruvate studies, including modeling and metrics, visualization, as well as considerations for how to store data and metadata. Depending on study design, the analysis may need to give quantitative or semi-quantitative output reflecting a biological process or may just reflect a contrast between different regions of interest for quantitative evaluation.

Metrics

Figure 7: HP [1-13C]pyruvate raw data (A) have typically been quantified using four categories of metrics depending on the acquisition. Data acquired as a single time point are often quantified using normalized metabolite images or metabolite ratios (B). Dynamic data can be quantified using normalized metabolite images or metabolite ratios (B), or with metabolite timings such as time-to-peak (TTP) or pharmacokinetic (PK) models (C). The latter two require the data to be time-resolved. [1-13C]alanine and 13C-bicarbonate are analyzed similarly to [1-13C]lactate but omitted here for display.

Metabolite images are commonly used as summary metrics for HP MRI data, often including some form of normalization as well as summed over time as an area under the time curve (AUC) (17). These are analogous to the visual evaluation that is most used for routine clinical work (89,90). In these metabolite images, we expect that the [1-13C]pyruvate AUC signal is predominantly weighted towards perfusion and uptake, while [1-13C]lactate, [1-13C]alanine and 13C-bicarbonate AUCs represent metabolic conversion. The strength of this approach lies in its simplicity and relatively few underlying assumptions. Limitations to the use of single-metabolite images or AUCs include sensitivity to inhomogeneous coil profiles (57,87,91), the acquisition strategy and acquisition parameters, pyruvate polarization and concentration level, and signal relaxation rates (92). Further, the reader must be careful to interpret all the images in conjunction to better understand the underlying biology; for example, increased [1-13C]lactate in the presence of decreased [1-13C]pyruvate delivery can have a very different meaning compared to increased [1-13C]lactate with increased [1-13C]pyruvate delivery.

In an attempt to address variations in coil sensitivity, polarization level, and pyruvate delivery, AUC images are often computed by normalizing to a specified parameter, such as the maximum pyruvate or average lactate signals, or presented as a ratio such as lactate/pyruvate or divided by “total Carbon” - the sum total of HP 13C signal observed across all metabolites. The AUC ratios between metabolites and pyruvate are proportional to the corresponding forward kinetic rates (81,93), but are not directly comparable to rate constants when magnetization loss rates (e.g. relaxation and losses due to signal excitation) differ between studies. Similarly, the ratios between the produced metabolites (e.g. bicarbonate/lactate) can reflect the balance between downstream metabolic pathways (12,55). Care must be taken to consider how AUC images are calculated and normalized before comparing values between studies.

To further quantify the interpretation, pharmacokinetic (PK) modeling approaches were developed to compute the apparent kinetics of pyruvate-to-metabolite exchange (92,94–99). These yield semi-quantitative to quantitative apparent rate constants, given in s-1. Some models require a vascular input function, while others avoid this requirement (95). PK models can explicitly account for acquisition-specific details such as excitation angle and repetition time, and thus may reduce the effects of these details on quantification. An input-less model, provided in the Hyperpolarized-MRI-Toolbox (https://github.com/LarsonLab/hyperpolarized-mri-toolbox) (100) and thus frequently employed for human data, has been shown to fit well and robustly to prostate and brain data (8,20). PK models are quantitative in nature, arguably provide more relevant biological information (8,20), and appear to be reproducible across sites (51). However, rate constants derived from PK models are still apparent rates, and likely do not reflect a single biological characteristic.

Some additional considerations include whether complex or magnitude data is used, as the noise behaviors will impact the analysis differently. Additionally, cut-off thresholds or other criteria may be used to identify and avoid voxels with insufficient SNR before analysis to improve robustness (20,41).

Regardless of the analysis approach, the underlying biology is not always clearly represented by the data; instead, the metrics may be influenced by perfusion, barrier permeability, intercellular shuttles, enzyme activities, co-substrate concentrations, or combinations thereof, depending on the organ and disease of interest (19,43,94,101–103). This may be addressed by incorporating complementary information. As an example, HP 13C pyruvate data is influenced by perfusion, and thus addition of perfusion MRI could be important for interpretation (98,104,105).

All the methods outlined above have been explored in clinical studies, described in Supporting Table 3 and summarized in Figure 8. As of September 2022, approximately 52% of studies involving human subjects report rate constants derived from a PK model with a few different models reported. A nearly equal fraction (51%) of the studies report AUC ratio values.

Approximately 66% of these studies report metabolite-specific images or AUC values. About 40% report SNR values; this metric is particularly frequent in manuscripts that describe technical developments for clinical HP MRI. Approximately 16% of these studies summarize model-free metrics, and 10% report measurements from a single timepoint. Most studies report a combination of quantities.

Figure 8: Reported metrics used for analysis in HP [1-13C]pyruvate human studies published up to September 2022.

Visualization

A wide variety of approaches have been used for visualizing data from human HP 13C-MRI studies. The challenges and practical considerations are: 1) choosing the appropriate metrics to display, 2) how to encode the parameters (e.g. the colormap), and 3) choosing how to provide anatomical context and other multi-parametric data. The choice of visualization also depends on the goal which could be for diagnostic interpretation, but also quality control, reproducibility among readers and publication.

Metrics

The choice of HP 13C metrics is described in detail above. At this stage in HP 13C development where there is no standardized metric, often a combination of metabolite images and ratios or PK model parameters are shown.

Parameter Encoding

The mapping function chosen should provide an adequate, often quantitative, impression of the parameter mapped. There is a consensus in the visualization field that perceptually uniform maps are best suited to visualize continuous parameters, like the greyscale typically used by radiologists as well as other monochrome (black to blue) and color ranges (fire-type, rainbow-type) (106,107). Multi-color heatmaps have been the most frequently employed method for HP 13C data, while greyscale has infrequently been used but it ensures there is no coloring-based bias as well as facilitating later reuse (Fig. 9a). Among the color schemes employed in the clinical HP 13C literature, fire-type scheme seems to be the most common [similar to “Plasma” or “Inferno” in matplotlib.org]. Next most commonly employed is the rainbow-type scheme [similar to “Rainbow” in matplotlib.org].

Anatomical Context

HP MRI faces the challenge that it does not necessarily depict the anatomical features, similar to PET, and thus requires an anatomical reference. Most often, a grayscale anatomical image is overlaid with a HP colormap (Fig. 9c,d). This approach is very intuitive, but can skew perception as the grey-scale anatomical reference may affect the brightness of the HP data (e.g. signal in the skull). This bias does not occur when showing adjacent maps (Fig. 9a, b). Here, anatomical outlines may help to provide reference (Fig. 9b).

Related Journal Articles & DOI Links

Selected peer-reviewed publications relevant to 12 Lead ECG Acquisition. Click the DOI to access the full paper (may require institutional access).

Why Choose Us?

Bangalore guidance for robotics, Spectre and autonomous systems projects.