ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Yanjie Li; Xiangyu He; Xuelong Dai; Bin Xiao

cs.CRSep 29, 2026

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Authors: Yanjie Li, Xiangyu He, Xuelong Dai, Bin Xiao

Organizations: Hong Kong Polytechnic University · Shandong University

Abstract

Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.

Figures & tables

Figure 1: ToolFence pipeline. ToolFence framework. Given an authenticated user query and a tool set, ToolFence first constructs an authorization blueprint. During execution, every proposed tool call is checked by a deterministic monitor on the fast path. If the call is not covered by the static blueprint, ToolFence invokes a runtime capability grant to approve or deny the capability shape, and approved shapes can be reused through a cross-session cache.

	Qwen3-max					GPT-4o (gpt-4o-2024-08-06)
Defense	Clean U. $\uparrow$	U@A $\uparrow$	Overall ASR $\downarrow$	Cross-tool $\downarrow$	Within-tool $\downarrow$	Clean U. $\uparrow$	U@A $\uparrow$	Overall ASR $\downarrow$	Cross-tool $\downarrow$	Within-tool $\downarrow$
No Defense	42.70	31.85	21.20	20.08	28.11	84.20	51.00	38.01	36.80	45.50
Repeat Prompt	37.18	29.45	10.95	10.23	15.42	81.00	66.10	17.91	16.70	25.40
Spotlighting	39.33	32.83	18.56	17.54	24.90	82.50	55.40	22.83	21.50	31.00
Tool Filter	30.44	31.88	1.67	0.45	9.18	78.60	60.50	6.76	4.90	18.20
SecInfer	39.45	34.80	14.31	13.30	20.50	86.50	72.40	14.51	13.00	23.80

Table 1: Attack results on the Agentdojo benchmark evaluated on Qwen3-max and GPT-4o. Clean U. denotes benign-task utility and U@A denotes utility under attack. Overall ASR is computed over the 609 user-attack pairs (524 cross-tool pairs and 85 within-tool pairs) and is averaged over 6 different attacks. Higher utility and lower ASR are better.

Panel of Figure 2 — Figure 2: Attack success rate across six indirect prompt-injection strategies on Qwen3-max. We separately report cross-tool escalation and within-tool hijacking. Tool Filter remains vulnerable to within-tool attack. In contrast, ToolFence maintains consistently low ASR across both attack categories. Error bars indicate paired 95% bootstrap confidence intervals across five random seeds.

Figure 3: Overall ASR across the four AgentDojo suites on Qwen3-max. ToolFence achieves consistently low ASR across all four suites.

Configuration	U@A $\uparrow$	ASR $\downarrow$	Judge/Task $\downarrow$	Runtime $\downarrow$
Per-call Runtime Judge	31.20	4.35	6.35	3.20 $\times$
Blueprint + Deterministic Monitor	25.60	0.45	0.00	1.45 $\times$
+ Dynamic Runtime Capability Grant	30.40	0.18	1.84	2.78 $\times$
+ Cross-Session Capability Cache	31.80	0.18	1.05	1.96 $\times$
Full ToolFence (+ Read Auto-Allow)	32.45	0.20	0.82	1.90 $\times$

Table 2: Ablation of ToolFence on Qwen3-max. U@A denotes utility under attack. Lower ASR, judge calls, and runtime overhead are better.

Figure 4: Mean end-to-end runtime per evaluation sample on GPT-4o and Qwen3-max.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Suite	Pairs	Escalation	Within-tool	Ambiguous
Workspace	240	222	18	0
Slack	105	86	19	0
Travel	140	114	6	20
Banking	144	102	42	0
Total	629	524	85	20

Appendix

Table 3: Composition of the parameter-aware AgentDojo split.

Defense	Clean U. $\uparrow$	U@A $\uparrow$	Overall ASR $\downarrow$	Cross-tool $\downarrow$	Within-tool $\downarrow$
No Defense	50.39	32.47	13.98	12.97	20.19
Repeat Prompt	57.61	45.70	11.01	10.47	14.35
Spotlighting	59.30	43.48	19.88	18.86	26.21
Tool Filter	37.93	29.98	1.41	0.39	7.69
SecInfer	60.20	50.80	10.26	9.20	16.80
PromptArmor	50.10	40.20	6.12	5.20	11.80

Appendix

Table 4: AgentDojo results on Mistral-Small-3.1-24B-Instruct-2503. Clean U. denotes benign-task utility and U@A denotes utility under attack. Overall ASR is computed over the 609 non-ambiguous pairs. Results are averaged over six attack strategies. Higher utility and lower ASR are better.

Explore similar work

ToolGuardian: Declarative Security for AI Agent-Tool Interactions
Jul 23, 2026Arun Ravindran, Saurabh DeochakeAuthorization Agentic Deployments
Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Sep 21, 2026Kaiyuan Zhang, Yuke Peng, Ke Jiang +1Authorization Runtime Enforcement
Southern University of Science and Technology
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Oct 1, 2026Fengpeng Li, Qizhou Wang, Yuke Hu +5Language-Model Agents Attack-Success Rate
PRADA Lab, King Abdullah University of Science and Technology · Imperfect Information Learning Team, RIKEN Center for Advanced Intelligence Project · State Key Laboratory of Internet of Things for Smart City, University of Macau +2

Jul 23, 2026, cs.CRJ/K move · Enter open · S save

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

Arun Ravindran, Saurabh Deochake

Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA

Authorization Agentic Deployments Large Language Model Policy Optimization

Open paper AskPDF arXiv

LLM agents increasingly rely on external tools, expanding capability while creating a new security boundary: third-party tools may appear benign at the interface level while embedding unsafe behavior in implementation. Existing defenses rely on weak metadata, collapse characterization and policy judgment into a single decision, or use heuristic/LLM enforcement that lacks deterministic, auditable reasoning over task context and multi-tool composition. This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions through pre-admission vetting and task-aware runtime authorization. ToolGuardian uses progressive characterization to convert evidence into structured facts: descriptions capture declared intent, system-call traces expose coarse behavior, mock execution reveals observed effects, and source analysis identifies latent behavior. ToolGuardian's core contribution is an Answer Set Programming (ASP)-based declarative policy layer that reasons explicitly over capabilities, effects, task context, and composition. We compare ASP against heuristic and LLM-based policy realizations using identical inputs and output contracts. We evaluate ToolGuardian on 16 MCP-style tools, including 8 malicious variants derived from real open-source tools, and 20 runtime scenarios. For vetting, ASP reaches a deny-class F1 of 0.86 and 88% accuracy using description, syscall, and observed-effect evidence. For runtime authorization, fully specified realizations classify all scenarios correctly, while ablations show that removing compositional and conformance rules substantially degrades performance.

Abstract

Explore similar work

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents