Tool call safety improved by matching calls to implementation authority
When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
Artificial IntelligenceCryptography and SecuritySoftware Engineering
Summary
Sometimes, software tools call other parts of a program in ways that look the same but actually do different things, which can cause problems with security and trust. The authors show this happens when the connection between the call and its handler changes over time, called schema-epoch drift. They propose a method called formation-consistent dispatch (FCD) that keeps track of how calls relate to their actual implementations and the security permissions involved, so calls only proceed if they meet safety checks. Their tests across many software releases showed FCD can correctly allow safe calls and block unsafe ones, even as software changes over time.
What this means in practice
- •For software platform engineers: Ensure secure execution of tool calls despite software updates by matching calls to verified effect profiles.
- •For security operations teams: Prevent unexpected privilege escalations from tool dispatch changes by enforcing formation-consistent approval.
Authors
Geonwoo Kim, Brent ByungHoon Kang
Abstract
Tool-enabled agents form calls from model-visible interfaces, while hosts later select their implementation. Standard dispatch omits the descriptor-handler relation. An unchanged and schema-valid call can therefore acquire a different security effect during rollout, reconnect, or delayed approval. We call this failure schema-epoch drift. We present formation-consistent dispatch (FCD), which connects implementation analysis to execution authority. Reviewed profiles produce provenance-bound over-approximations of declared in-scope effects from official source. Under a closed-target approval policy, a verifier applies each formed call to a summary and captures a successor only when its effects fit the call's security contract. Atomic admission and a final-hop fence preserve this decision to the effect. The exact source retains priority, and the captured successor becomes eligible only after source retirement. Stock releases and deployment changes reproduced the failure. Four profiles covered 32 official releases: 29 required no release-specific change and three escalated. A frozen 16-release expansion matched a separate source oracle. In a preregistered stock comparison, FCD completed all three pending calls whose effect remained private and blocked all three whose omission became public. Exact pinning and release-wide denial stopped all six calls, while release-wide approval completed all six but produced three public effects. A separate lifecycle experiment carried a formation-captured certificate across source retirement. The same safe certificate installed later governed new formations without expanding the pending call's authority.