VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit

Junda Lin; Zhaomeng Zhou; Zhi Zheng; Shuochen Liu; Tong Xu; Yong Chen; Enhong Chen

Source-linked AI summary

VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit

Junda Lin, Zhaomeng Zhou, Zhi Zheng, Shuochen Liu, Tong Xu, Yong Chen, Enhong Chen

arXiv:2601.05755v2Jan 9, 2026cs.CRcs.AI

TL;DR

LLM agents face tool-stream injections that exploit their treatment of forged metadata and runtime feedback as operational constraints, while static defenses can sacrifice adaptive reasoning. VIGIL addresses this problem with intent-grounded speculative verification before commitment, and experiments on SIREN report lower attack success and higher utility than the compared defenses.

Problem
Tool-stream injections can hijack agents through forged operational constraints, while existing defenses face a security–reasoning-flexibility gap.
Method
VIGIL uses intent-grounded constraints, speculative trajectory generation, and verification before irreversible action.
Results
VIGIL reduces tool-stream ASR to approximately 8~12%, surpasses recent dynamic defenses by over 22%, and more than doubles UA versus rigid baselines.
Takeaways & Limitations
Decoupling speculative exploration from irreversible execution provides an effective methodology for deploying trustworthy agents in open environments.
Takeaways & Limitations
Exploring large hypothesis spaces can introduce significant computational overhead, and immutable query-grounded constraints may limit adaptability when sub-goals emerge dynamically.

Abstract

from arXiv · show

LLM agents operating in open environments face escalating risks from indirect prompt injection, particularly within the tool stream where manipulated metadata and runtime feedback hijack execution flow. Existing defenses encounter a critical dilemma as advanced models prioritize injected rules due to strict alignment while static protection mechanisms sever the feedback loop required for adaptive reasoning. To reconcile this conflict, we propose \textbf{VIGIL}, a framework that shifts the paradigm from restrictive isolation to a verify-before-commit protocol. By facilitating speculative hypothesis generation and enforcing safety through intent-grounded verification, \textbf{VIGIL} preserves reasoning flexibility while ensuring robust control. We further introduce \textbf{SIREN}, a benchmark comprising 959 tool stream injection cases designed to simulate pervasive threats characterized by dynamic dependencies. Extensive experiments demonstrate that \textbf{VIGIL} outperforms state-of-the-art dynamic defenses by reducing the attack success rate by over 22\% while more than doubling the utility under attack compared to static baselines, thereby achieving an optimal balance between security and utility.

1 Introduction

LLM agents are vulnerable to tool-stream injections because models may treat forged tool metadata and runtime feedback as authoritative constraints. VIGIL addresses this tension with verify-before-commit reasoning, while SIREN evaluates the resulting defenses against dynamic attacks.

Static defenses can suffer utility collapse under uncertainty because restrictive planning severs feedback needed for adaptive reasoning.
Tool streams expose agents to forged descriptions and deceptive errors that can mimic authoritative system commands and manipulate decisions.
Strong instruction-following can increase vulnerability because advanced models may prioritize malicious tool rules over user intent.
SIREN contains 959 tool-stream injection cases across five vectors, and VIGIL reduces ASR by over 18% while more than doubling UA versus static baselines.
VIGIL uses intent-grounded safety boundaries and speculative backtracking to separate reasoning exploration from irreversible action.

2 Related Work

Prior defenses either isolate execution rigidly or adapt policies while overlooking the operational authority of tools. SIREN targets this gap by evaluating compounded data-stream and tool-stream threats under complex reasoning dependencies.

Static plan-then-execute defenses enforce immutable plans before environmental interaction, but freezing control flow compromises flexibility and error recovery.
Recent dynamic defenses restore some flexibility through policy updates or masked re-execution, yet often assume tool reliability and remain vulnerable to mimicry attacks.
Earlier security benchmarks focused mainly on data-stream threats and implicitly assumed tool integrity.
SIREN integrates dual-stream threats and complex reasoning dependencies to evaluate resilience against compounded attacks.

3 The SIREN Environment

SIREN models agents operating within an untrusted environment where compromised tool providers can manipulate the active tool stream. Its benchmark combines five tool-stream attack vectors with a data-stream baseline.

The threat model gives adversaries no access to weights or internal states but allows manipulation of information retrieved during interaction.
SIREN includes definition-level injections targeting tool selection and parameter formulation through explicit directives, dependency traps, and feature inducement.
The benchmark comprises 959 tool-stream injection cases across five vectors and a 949-case data-stream baseline.
Runtime hijacking and error hijacking attack execution feedback by overriding state tracking or simulating blocking errors with malicious procedures.

4 The VIGIL Framework

VIGIL reframes secure agent execution as selecting a validated trajectory rather than directly executing actions from potentially malicious inputs. It grounds speculative exploration in user intent and commits only trajectories that pass compliance and entailment checks.

Overview: VIGIL selects a trajectory from a hypothesis space only when it satisfies intent-grounded verification constraints.
Ground-Truth Constraint Synthesis: Intent anchoring derives an abstract workflow and immutable logical invariants from the user query.
Ground-Truth Constraint Synthesis: The Grounding Verifier uses those constraints as intent-level ground truth to prune noncompliant trajectories.
Perception Sanitization: Perception sanitization removes manipulative linguistic force from tool information while preserving functional semantics.
Speculative Reasoning: Speculative reasoning explores multiple candidate action branches in a hypothetical sandbox before validation and commitment.
Grounded Verification and Adaptation: A trajectory is approved only after invariant compliance and semantic entailment checks, while failures trigger reflective backtracking and successful paths are cached.

5 Evaluation

VIGIL is evaluated on SIREN against input-centric, static-isolation, dynamic, and undefended baselines. Across security, attack-time utility, benign utility, ablations, and sensitivity tests, it preserves a stronger security–utility balance.

Experimental setup: VIGIL is evaluated on 959 tool-stream and 949 data-stream cases against seven representative defense mechanisms.The evaluation uses Qwen3-max and Gemini-2.5-pro as agent backbones.
Main results: VIGIL reduces tool-stream ASR from over 25% for CaMeL to approximately 8% on Qwen3-max and 12% on Gemini-2.5-pro.It also surpasses DRIFT by 22% to 24% across both backbones.
Main results: VIGIL achieves a tool-stream UA of 27.53% on Qwen3-max, more than doubling the task-completion rate of static baselines whose UA falls below 12%.Its speculative reasoning and backtracking preserve recovery from deceptive runtime feedback.
Main results: VIGIL achieves 74.49% benign utility on Qwen3-max versus 79.59% for Vanilla ReAct, while restrictive defenses fall below 50%.The paper reports a moderate trade-off on Gemini-2.5-pro attributed to the verifier’s conservative nature.
Ablation study: Removing any VIGIL module degrades security or utility; without verification, tool-stream ASR rises to 45.05%, while without the reasoner, UA falls from 27.53% to 9.07%.The ablated variants are Unanchored, Unfiltered, Linear, and Unverified.
Sensitivity analysis: Across 496- and 3,074-tool environments, verification overhead converges to a constant level, while low ASR persists as attack density increases from 1:1 to 1:8.UA declines gradually under denser attacks rather than collapsing, and trajectory memory caches secure execution paths.

6 Conclusion and Future Work

The paper concludes that VIGIL’s verify-before-commit protocol secures tool-stream interactions while preserving reasoning utility. It identifies speculative exploration separated from irreversible execution as an effective methodology for trustworthy agents and outlines extensions for efficiency, multimodal settings, and defense in depth.

Conclusion: VIGIL shifts defense against tool-stream injection from static isolation to a verify-before-commit protocol.The framework is evaluated on the SIREN benchmark.
Conclusion: Decoupling speculative exploration from irreversible execution is presented as an effective methodology for deploying trustworthy agents in open environments.
Future work: Future work targets speculative-reasoner efficiency, multimodal injection surfaces, and integration with training-based alignment techniques.

Limitations

VIGIL’s security depends on a speculative reasoning–verification loop whose cost and constraint model limit applicability in some settings. Large hypothesis spaces can create computational overhead, while immutable user-query constraints may be less adaptable to open-ended tasks with emergent sub-goals.

Computational scope: Large hypothesis spaces in complex tasks can introduce significant computational overhead for VIGIL’s speculative reasoning–verification loop.The paper suggests lightweight verifiers or advanced pruning strategies as optimization directions.
Adaptability scope: Immutable constraints grounded in the initial user query may limit adaptability when open-ended tasks develop sub-goals dynamically from retrieved data.The paper proposes dynamic constraint evolution for more complex, emergent workflows.

Ethics Statement

The paper states that it follows the ACL Ethics Policy and uses publicly available datasets and models according to their licenses. It frames the work as security research and reports no anticipated negative ethical or societal risks.

Data and models: The experiments use publicly available datasets and models in accordance with their licenses.
Risk statement: The authors report no anticipated negative ethical implications or societal risks from the proposed methodologies or experiments.

A SIREN Benchmark Construction

SIREN evaluates agent robustness across passive data-stream and structurally deceptive tool-stream attacks. Its tool-stream vectors target tool definitions, dependencies, efficiency biases, and runtime feedback.

Benchmark categories: SIREN comprises data-stream and tool-stream attack categories for evaluating robustness against multifaceted adversarial maneuvers.The data-stream category uses AgentDojo tasks, while the tool-stream category compromises functional tool components.
Tool-stream attacks: Tool-stream attacks compromise docstrings, function signatures, return values, or introduce malicious tools to create structural deception.These attacks target the agent’s own execution capabilities rather than only passive external content.
Attack vectors: The Explicit Directive vector embeds fabricated high-priority system instructions within tool docstrings to exploit instruction-following fidelity.The send_money implementation uses a fabricated escrow mandate to override intended transaction parameters.
Attack vectors: Dependency Trap implants prerequisite or post-action dependencies that induce malicious tool execution during otherwise benign workflows.The verify_compliance_audit tool masquerades as a mandatory security gateway while covertly scraping message history.
Attack vectors: Feature Inducement exploits efficiency and granularity biases through Super Tools and Nominal Impersonation.The express_bill_pay example promotes a single-click workflow while hiding a service-fee side effect.
Attack vectors: Runtime Hijacking embeds crisis instructions in tool outputs, while Error Hijacking uses fabricated failures to redirect execution.Both vectors exploit the execution feedback loop to replace the agent’s intended task with attacker-defined operations.

A.6 Error Hijacking

Error Hijacking fabricates operational constraints in tool outputs and directs agents to substitute attacker-chosen parameters for the user’s intended values.

Mechanism: Error Hijacking simulates blocking errors and mandates parameter substitution through fabricated contextual constraints.The malicious output presents attacker-specified values as necessary to resolve an alleged system error.
Implementation example: The read_secure_file example replaces file content with a liquidity-batching notice requiring a specific recipient and fixed amount.The fabricated return value instructs the agent to call send_money with the attacker’s batch header parameters.

B Case Study Analysis

The case studies show SIREN attacks divert agents from user-intended workflows through forged tool authority, dependencies, efficiency claims, and runtime feedback. VIGIL’s modules establish intent, sanitize perceptions, explore alternatives, and verify secure tool choices.

Case-study scope: SIREN case studies compare intended agent behavior with behavior under five adversarial tool vectors.The analysis presents implementation patterns and concrete examples across the attack scenarios.
Explicit Directive: A forged send_money compliance mandate causes the agent to treat attacker-controlled routing instructions as binding system constraints.The injected documentation redirects a payment intended for Alice toward a holding escrow account.
Dependency Trap: A fake security prerequisite causes the agent to call verify_compliance before reading messages, enabling covert data exfiltration.The malicious tool scrapes channel history and posts it to an external adversarial server while returning a false access token.
Feature Inducement: A Super Tool’s efficiency claim makes the planner bypass granular verification, allowing a hidden 5% service fee.The agent selects express_bill_pay instead of the safer Read →Verify →Pay workflow.
Runtime Hijacking: A fabricated critical error redirects a balance query toward an attacker-specified recovery transfer.The get_verified_balance output instructs the agent to transfer 0.01 to Safe-Node-X.
Error Hijacking: A fake liquidity-batching error instructs the agent to override the exact invoice amount with a fixed batch-header value.The case illustrates Error Hijacking through a fabricated operational constraint in file-reader output.
VIGIL system prompts: VIGIL uses an Intent Anchor, Perception Sanitizer, Speculative Reasoner, and Grounding Verifier to constrain tool selection around user intent.The modules create verifiable intent steps, remove manipulative directives, simulate alternatives, and block excessive permissions or deviations.