Instead of filtering questionable content, ToolFence compiles a plan of typed authorizations before execution and distinguishes the values desired by the user from those derived from unreliable observations.
An agent that manipulates tools keeps its user's instructions and everything sent back to it by external calls in a single context. It's this mix that makes indirect policy injection so difficult to contain: hostile content housed in a page or document presents itself with the same authority as the original request. Multipath consensus defenses aren't enough, say Yanjie Li, Xiangyu He, Xuelong Dai, and Bin Xiao, because they look at aggregated content or output instead of allowing effects. The most devious case is the intra-tool attack: the agent does call the expected tool, but with backhanded arguments.
ToolFence moves the preflight control. The system compiles, before execution, a typed authorization plan, and then enforces it by a deterministic monitor. When this plan proves incomplete, a judge is called upon not to arbitrate each concrete call, but to grant new capabilities—a granularity that avoids paying for costly reasoning at each step. Provenance traceability also makes it possible to separate the values actually authorized by the user from those inherited from untrusted observations, which directly targets the intra-tool attack.
On the AgentDojo test bench with Qwen3-max, the approach reduces the overall success rate of attacks to close to zero, for a loss of usefulness of 3.80 percentage points on own tasks and an additional execution cost that the authors describe as practicable — a point that they contrast with data flow control à la CaMeL, which is more robust in terms of guarantees but penalized by its latency.
Read the full article on the original source
Go to the source →