Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents

arXiv:2607.08395 · cs.CR, cs.CL · Submitted 2026-07-09 · Read on arXiv

Puji Wang, Yingchen Zhang, Ruqing Zhang, Jiafeng Guo, Xueqi Cheng

cs.CR, cs.CL

Submitted: 2026-07-09

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• AI Agents — 20× in this paper · explained in 2 episodes
• Benchmark — 10× in this paper · explained in 2 episodes
• Ablation — 6× in this paper · explained in 1 episode
• Attack Success Rate — 5× in this paper
• Pass Rate — 4× in this paper
• Provenance — 4× in this paper · explained in 4 episodes
• Benchmarking — 3× in this paper · explained in 4 episodes
• Core — 3× in this paper · explained in 2 episodes
• Deferral — 3× in this paper · explained in 2 episodes
• Human Rate — 3× in this paper
• Robustness — 3× in this paper · explained in 5 episodes
• Trace — 3× in this paper · explained in 2 episodes
• Alignment — 2× in this paper · explained in 1 episode
• Calibration — 2× in this paper · explained in 7 episodes
• Large Language Models (LLMs) — 2× in this paper · explained in 6 episodes
• Refusal Rate — 2× in this paper
• Abstraction — 1× in this paper · explained in 1 episode
• Action Space — 1× in this paper · explained in 1 episode
• Actionability — 1× in this paper · explained in 3 episodes
• Agent Memory — 1× in this paper · explained in 1 episode
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 3 episodes

Sources

• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
• StruQ: Defending Against Prompt Injection with Structured Queries
• Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents
• LlamaFirewall: An open source guardrail system for building secure AI agents
• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents
• ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers
• G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment
• Prompt Injection attack against LLM-integrated Applications
• Formalizing and Benchmarking Prompt Injection Attacks and Defenses
• Toward Securing AI Agents Like Operating Systems
• Identifying the Risks of LM Agents with an LM-Emulated Sandbox
• Agent-Sentry: Bounding LLM Agents via Execution Provenance
• Authenticated Delegation and Authorized AI Agents
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• Voyager: An Open-Ended Embodied Agent with Large Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs