ToolFence improves security and efficiency for tool-using AI agents
ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
Cryptography and SecurityArtificial Intelligence
Summary
Large language models (LLMs) that use tools can be tricked by harmful inputs that sneak in through trusted instructions and untrusted data sharing the same space. The authors identified a new security risk where attackers manipulate tool inputs without changing the tool itself, called the within-tool attack. They developed ToolFence, a method that controls what the AI can do by checking permissions before running, so it can spot and block these sneaky attacks. ToolFence also speeds up decision-making by reducing the need to ask for approval on every action, making the process faster and safer.
What this means in practice
- •For ai software developers: Protect AI agents that integrate external tools from malicious input manipulation while keeping runtime fast and efficient.
- •For cloud service operators: Enhance security for hosted AI services by enforcing strict authorization on tool use to prevent indirect attacks.
Authors
Yanjie Li, Xiangyu He, Xuelong Dai, Bin Xiao
Abstract
Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.