SecureGARD puts a semantic gate on tool calls: zero observed attack success across three benchmarks and two backbones
Synopsis
Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.
Interpretation
A tool call is no longer admitted on its interface name and arguments alone; it is first translated into a shared semantic action and then checked against action–state dependencies before execution. Earlier defenses mainly constrain prompts, concrete tool interfaces, data flows, or execution trajectories, so semantically equivalent tools often need separately defined constraints and execution failures do not necessarily reveal the underlying state dependencies. On AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% for both GPT-4o-mini and Qwen3.8-Flash; the undefended GPT-4o-mini agent shows attack success rates from 27.3% to 50.0%, and DRIFT lowers this to 2.3%–4.7% without eliminating it.
At runtime each action is judged ready, waiting, or forbidden, where waiting marks an unmet but recoverable prerequisite, so the agent can replan within bounds without widening its authorization. The ontology separates reusable action–state rules from facts verified in the current episode; the rules are frozen before evaluation, and online execution can update only episode facts and task state. The ontology is evolved only from the AgentDojo training split and then transferred unchanged to ASB and AgentDyn; on Qwen3.8-Flash ASB, clean and attacked utility rise over DRIFT from 29.3% and 16.5% to 35.3% and 22.3%.
Reusable action–state axioms are proposed offline from verified training executions and accepted only after passing several checks. An offline LLM proposes candidate axioms from bounded evidence summaries, and that model cannot directly modify the ontology or take part in runtime adjudication. Candidates must correct ontology errors exposed by training failures, stay logically consistent, preserve protected entailments, and pass held-out validation; on ASB, after 24 accepted axioms, the frozen ontology lowers observed attack success from 4.3% to 0.0% while all six predefined regression checks are retained.
Perspective
The evaluation covers benign executions and indirect prompt-injection settings on AgentDojo, ASB, and AgentDyn; ASB is restricted to its prompt-injection subset aligned with the threat model, excluding memory poisoning, backdoors, and mixed attacks, and the ontology is evolved only from the AgentDojo training split before being transferred unchanged to the other two benchmarks.
The authors note that the design still depends on the granularity of seed axioms and the coverage of verified training evidence, that the relation vocabulary does not yet capture richer temporal, conditional, or cross-action dependencies, and that behavior in longer-horizon tasks and rapidly evolving tool environments remains underexplored; the appendix states that zero observed attack success is not an absolute security guarantee.