ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

arXiv:2609.37196 · cs.CR, cs.AI · Submitted 2026-09-29 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-29

Updated: 2026-09-29

Terminology

• Provenance — 45× in this paper · explained in 4 episodes
• Benchmark — 9× in this paper · explained in 2 episodes
• Robustness — 8× in this paper · explained in 5 episodes
• Ablation — 4× in this paper · explained in 1 episode
• Aggregation — 3× in this paper · explained in 1 episode
• Failure Modes — 3× in this paper · explained in 3 episodes
• Benchmarking — 2× in this paper · explained in 4 episodes
• Core — 2× in this paper · explained in 2 episodes
• Fine-Tuning — 2× in this paper · explained in 5 episodes
• In International Conference on Learning Representations — 2× in this paper
• Ablation study — 1× in this paper · explained in 1 episode
• Adaptability — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Generative AI — 1× in this paper · explained in 2 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Meeting of the Association for Computational Linguistics — 1× in this paper
• Trace — 1× in this paper · explained in 2 episodes
• Verifier — 1× in this paper · explained in 2 episodes

Sources

• Defeating Prompt Injections by Design
• PISanitizer: Preventing Prompt Injection to Long-Context LLMs via Prompt Sanitization
• A Critical Evaluation of Defenses against Prompt Injection Attacks
• Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
• Prompt Injection attack against LLM-integrated Applications
• SecInfer: Preventing Prompt Injection via Inference-time Scaling
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks
• Lessons from Defending Gemini Against Indirect Prompt Injections
• Prompt Injection Attack to Tool Selection in LLM Agents
• PromptArmor: Simple yet Effective Prompt Injection Defenses
• ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
• Defending Against Prompt Injection with DataFilter
• ReAct: Synergizing Reasoning and Acting in Language Models
• GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
• WebArena: A Realistic Web Environment for Building Autonomous Agents
• PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs