ActGuard improves security of language model tools with less content filtering
ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents
Cryptography and SecurityArtificial Intelligence
Summary
Language models that use external tools can be tricked by harmful input that causes unsafe tool actions. The authors propose ActGuard, which checks whether the model’s planned tool use and parameters are unusual before acting. It only blocks parts confirmed to cause unsafe actions rather than filtering lots of content blindly. This way, legitimate actions stay flexible while attacks are stopped effectively. Tests show ActGuard cuts attacks like top defenses but keeps task usefulness nearly unchanged.
What this means in practice
- •For ai platform teams: Protect AI tool-using agents from malicious inputs by auditing planned actions before execution to maintain security with minimal impact on functionality.
- •For enterprise security teams: Enhance security monitoring for automated systems that invoke external tools by detecting and mitigating suspicious deviations in tool operations from expected behavior.
Authors
Bingzheng Wang, Xiaoyan Gu, Wentao Wang, Xingyou Yang, Hongcheng Li, Rong Yin
Abstract
Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prompt injection (IPI) attacks. Existing defenses mainly rely on prompt hardening, content filtering, pre-generated plans, or permission constraints. These approaches often struggle with complex tasks or over-sanitize external content, making it difficult to balance security and utility. The key challenge is therefore to preserve execution flexibility while precisely identifying and removing the malicious content that actually induces unsafe actions. To address this challenge, we propose ActGuard, a pre-execution action auditing framework. Rather than judging whether external content is inherently suspicious, ActGuard assesses whether it causes the current action to deviate from a locally reasonable expectation. At each step, ActGuard predicts the tools likely to be used by the upcoming action and constructs a local tool prior without constraining the execution trajectory. Before execution, it compares the candidate action against this prior and performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations in tool selection and action parameters. A verifier then examines the localized evidence, masks only spans confirmed as malicious, and regenerates the action from the sanitized context. This design preserves legitimate planning flexibility while minimizing information loss from indiscriminate filtering. We evaluate ActGuard on challenging benchmarks for tool-using agents. Results show that ActGuard reduces attack success rates to a level comparable to state-of-the-art defenses while maintaining task utility close to the no-attack setting, achieving a favorable security-utility trade-off. Our code is publicly available at: https://github.com/binzhwang/ActGuard.