SecureGARD puts a semantic gate on tool calls: zero observed attack success across three benchmarks and two backbones
Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.