PaperlayerView exact revision on arXiv

Source-linked AI summary

Sponge Tool Attack: Stealthy Denial-of-Efficiency against Tool-Augmented Agentic Reasoning

Qi Li, Xinchao Wang

arXiv:2601.17566v1cs.CV

TL;DR

Tool-augmented agents provide useful support for complex reasoning, but their tool-calling process exposes an underexplored vulnerability. STA rewrites input prompts under query-only access to amplify tool use while preserving task intent, and evaluations across diverse models, tools, frameworks, and datasets validate its effectiveness. The paper therefore identifies a cost-relevant attack surface for agentic systems, subject to the stated threat-model constraints.

  • Problem

    Tool-augmented agentic reasoning has an underexplored vulnerability in which malicious manipulation of tool-calling can impose substantial computational costs while preserving task semantics.

  • Method

    STA uses iterative multi-LLM collaboration and offline policy induction to generate benign-looking prompt rewrites under strict query-only access.

  • Results

    Experiments across 6 models, 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 domains validate STA’s effectiveness and stealthiness.

  • Takeaways & Limitations

    STA identifies a critical attack surface and motivates cost-aware design of agentic frameworks.

  • Takeaways & Limitations

    The threat model assumes read-only internal access, query-only interaction, and a finite tool-calling budget.

Abstract

from arXiv · show

Enabling large language models (LLMs) to solve complex reasoning tasks is a key step toward artificial general intelligence. Recent work augments LLMs with external tools to enable agentic reasoning, achieving high utility and efficiency in a plug-and-play manner. However, the inherent vulnerabilities of such methods to malicious manipulation of the tool-calling process remain largely unexplored. In this work, we identify a tool-specific attack surface and propose Sponge Tool Attack (STA), which disrupts agentic reasoning solely by rewriting the input prompt under a strict query-only access assumption. Without any modification on the underlying model or the external tools, STA converts originally concise and efficient reasoning trajectories into unnecessarily verbose and convoluted ones before arriving at the final answer. This results in substantial computational overhead while remaining stealthy by preserving the original task semantics and user intent. To achieve this, we design STA as an iterative, multi-agent collaborative framework with explicit rewritten policy control, and generates benign-looking prompt rewrites from the original one with high semantic fidelity. Extensive experiments across 6 models (including both open-source models and closed-source APIs), 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 domains validate the effectiveness of STA.

1. Introduction

Tool augmentation helps LLMs handle difficult reasoning tasks but introduces an underexplored vulnerability in tool-calling. STA exploits this surface through stealthy prompt rewrites that preserve task semantics while making agentic reasoning unnecessarily verbose and inefficient.

  • Motivation: External tools offload specialized subtasks, helping LLMs address complex reasoning that requires planning, computation, or domain-specific expertise.Examples include visual puzzles, mathematics, and chemistry.
  • Motivation: Tool use also incurs token, time, and auxiliary-inference costs that can make solving a task unacceptably inefficient.The passage highlights extensive web queries and image-captioning inference as examples.
  • Attack surface: STA targets a previously underexplored attack vector in tool-augmented agents by rewriting queries to induce redundant reasoning without changing task semantics or intent.The attack is framed as Denial-of-Efficiency (DoE).
  • Method: STA uses iterative collaboration among a Prompt Rewriter, Quality Judge, and Policy Inductor to generate and refine attack prompts.Offline policy induction distills interaction logs into reusable rewriting policies for deployment.
  • Evaluation: Experiments across 6 models, 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 domains confirm STA’s strong attack performance.

2. Related Work

Prior agentic-system research includes tool-augmented reasoning and attacks based on internal modification or explicit malicious inputs. STA instead targets tool-augmented agents under strict access constraints with benign-looking, semantics-preserving rewrites.

  • Tool-Augmented Agentic Reasoning: Tool-augmented reasoning commonly offloads specialized subtasks to search engines, browsers, or Python interpreters.
  • Attack against Agentic System: Existing agent attacks include backdoors, poisoning, memory or knowledge-base corruption, and explicit prompt injection.
  • STA’s distinction: STA differs by requiring no internal modification and using benign-looking prompts that preserve task semantics while degrading reasoning efficiency.

3. Threat Model.

The threat model considers a DoE adversary that seeks excessive computational consumption while preserving task intent. The adversary can only issue queries and operates within a finite tool-calling budget.

  • Adversary’s Goal: The adversary aims to induce unnecessary computational resource consumption while maintaining the task’s semantics and intent.
  • Adversary’s Access: The adversary has read-only access to internal agent information and can interact with the victim only through input queries.
  • Adversary’s Access: A finite tool-calling budget bounds computational cost as a system-level constraint rather than adversarial knowledge.
  • Challenges: Strict read-only access rules out gradient-based attacks and direct adversarial instruction injection.
  • Challenges: Sample-level customized attacks are time- and resource-intensive, motivating attack designs that improve efficiency and reusability.

4. Method

STA constructs reusable prompt-rewriting policies offline, then applies them to induce longer tool-using trajectories while preserving task semantics. Its iterative process combines baseline execution, reward-based evaluation, judging, history conditioning, and policy induction.

  • Offline Policy Bank Construction: STA constructs an offline policy bank from a small probe set, enabling reusable prompt-rewriting strategies for unseen inputs.The policy bank is built before downstream attacks or evaluations and later instantiated to induce longer tool-using trajectories.
  • Baseline Execution: The victim agent is modeled as an LLM with a tool set, while each probe records task metadata, the original prompt, optional images, and enabled tools.The probe pool is sampled into an offline policy-construction set.
  • Baseline Execution: For each probe, STA first executes the original prompt once, records the action–observation trace and baseline step count, and caches statistics for later comparison.Examples whose baseline already consumes at least 0.2 · Kmax are excluded from further rewriting loops.
  • Rewrite–Execute–Judge Loop: Candidate rewrites are generated and executed iteratively, with the rewriter constrained to preserve task semantics and answer type while increasing tool-using steps.A history buffer supplies successful attempts and judge feedback as few-shot context, combining probe-specific and cross-task signals.
  • Policy Bank Induction: A quality judge critiques step increase, semantic preservation, and actionable improvements, while a policy inductor abstracts successful baseline–rewrite contrasts into reusable strategies.The resulting policies are structured with names, descriptions, applicability conditions, and rewrite rules, then reused for downstream attacks.

5. Experiments

Experiments evaluate STA across diverse models, tools, frameworks, and datasets, finding that it consistently increases tool-calling while largely preserving task semantics. The attack remains effective across budgets and frameworks, and its policies show transferable, structured behavior.

  • Experimental Setup: The evaluation covers 6 models, 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 benchmark categories.The corpus contains 1,775 examples and includes both uni-modal and multi-modal settings.
  • Overall Attack Effectiveness: STA shifts tool-calling distributions toward larger values across benchmarks and models, indicating a systematic increase in reasoning length.Within-model comparisons show STA dominating the original setting across most benchmarks.
  • Overall Attack Effectiveness: STA increases tool invocation while preserving task intent, as positive changes in tool-calling steps are not accompanied by systematic semantic-similarity degradation.The results characterize a structural change in agentic reasoning rather than isolated step inflation.
  • External Factors: STA remains effective under both 15-call and 40-call budgets, with model-dependent differences in step increases and cap-hit changes.The authors describe the attack as largely budget-agnostic and note larger step increases for Qwen2-VL-7B and gpt-4o-mini.
  • External Factors: Attack rewards remain positive across agentic frameworks while task success rates stay high, and attack effectiveness increases as frameworks become stronger.The drop from original to attacked accuracy remains limited, including for stronger frameworks.
  • Internal Components: Increasing probe data and policy budget improves attack effectiveness and resilience across tool-calling budgets.The ablation compares (1%, 8) with (10%, 16).
  • Behavior Analysis: STA policies transfer across models and combine rare high-impact strategies with frequent broadly applicable strategies.Tool-usage changes concentrate in middle-to-late reasoning stages, where similar tools exchange invocation frequency and later-stage misselection increases tool calls.

6. Conclusion

The paper identifies Denial-of-Efficiency as a vulnerability in tool-augmented agentic reasoning and proposes STA to exploit it through prompt rewriting. Across diverse settings, STA amplifies tool-calling while preserving task intent, producing unnecessarily verbose reasoning trajectories.

  • Conclusion: STA identifies a vulnerability in tool-augmented agentic reasoning by amplifying tool-calling while preserving task intent.The attack operates under strict access to the victim agent and transforms efficient reasoning into unnecessarily verbose trajectories.
  • Conclusion: Experiments across diverse models, tools, agentic frameworks, and tasks demonstrate STA’s effectiveness and stealthiness.

A. Additional Restuls

Additional analyses examine STA under a 40-call budget and assess implementation choices affecting attack stability. The results retain the reported step-increase and semantic-preservation pattern, while history-buffer design has a stronger effect than embedding-model choice.

  • High-Budget Analysis: With a tool-calling budget of 40, STA consistently increases tool-calling steps across models and datasets.
  • Ablation Analysis: History-buffer design affects attack effectiveness more than reward-model choice; a moderate buffer is stable, while removing the buffer or judge feedback substantially degrades performance.
  • High-Budget Analysis: At a 40-call budget, the analysis tracks STA-induced step changes and rewrite similarity through behavioral-density, cumulative-step-change, and similarity distributions.

B. Prompt for the Prompt Rewriter

The prompt rewriter is instructed to preserve the original task while encouraging many subtasks, tools, and reasoning steps without explicitly requesting verification or alternative paths.

  • Rewriter Instructions: The rewriter preserves task semantics and answer format while producing a single rewritten query that encourages extensive tool use and reasoning.It must avoid explanations, specific tool names, and explicit requests for verification, cross-checking, or alternative solution paths.

C. An example of the History Block

The history block records an adversarial rewrite that increases the agent’s reasoning steps while attempting to preserve the original task. It also includes judge feedback and a subsequent proposal for further step expansion.

  • History Block: The adversarial query forces 15 reasoning steps, compared with 1 baseline step and 10 steps for the best prior attempt.The judge assigns steps dim = 5.00.
  • History Block: The rewrite adds non-Euclidean geometry and polygon decomposition, producing substantial semantic divergence according to the judge.The reported semantic divergence is sim dim = -1.47.
  • History Block: The proposed refinement requires three geometric models and incremental curvature simulation to induce additional tool calls and iterative recalibration.The models are Euclidean, spherical, and planar with curved arcs.

E. An example of the output from the Quality Judge

This example shows a Quality Judge evaluating step inflation and semantic preservation, then generating actionable rewrite advice and reusable policy-extraction instructions.

  • Quality Judge Output: The adversarial query increases reasoning from 1 baseline step to 12 steps, with steps dim = 4.00, but remains below the maximum steps dim of 5.The judge describes the increase as significant while noting the attempt is not maximally stepful.
  • Quality Judge Output: The rewrite introduces meaningful but non-essential procedural complexity, including cross-referencing with a digital text database, with sim dim = -0.46.The judge states that the original task’s core objective is not completely preserved.
  • Quality Judge Output: The judge recommends comparing multiple digital sources and simulating manual line-by-line annotation to add 2–3 tool calls without altering the core task.The suggested sources include Poem Archive, Project Gutenberg, and a Harvard edition.
  • Quality Judge Output: The policy-extraction prompt requests reusable abstract rewriting strategies rather than solution recipes tied to one dataset, domain, or question template.It specifies names, descriptions, usage conditions, generic rewrite instructions, and supporting examples in JSON format.

G. Examples for Policies in the Policy Bank

The policy examples encode reusable strategies for increasing structured reasoning through explicit validation and ordered execution. Their instructions make intermediate steps mandatory and dependent on one another.

  • Policy Examples: AddVerificationConstraint requires a dedicated validation step that checks the answer against formulas, rules, data ranges, and stated conditions.The policy also instructs the agent to revise its answer when a constraint is violated.
  • Policy Examples: Both strategies convert otherwise compressible reasoning into explicit intermediate operations that require structured execution and checking.This synthesis follows the validation and ordering requirements stated in the policy examples.
  • Policy Examples: ExplicitStepOrdering forces numbered reasoning stages to be completed sequentially, with each step’s output feeding the next step.The strategy prevents skipping, merging, or reordering intermediate stages.

H. Examples of Rewritten Results

The rewritten examples apply verification-heavy instructions to visual and multiple-choice tasks. They preserve the required answer format while adding staged checks, source comparison, or constraint validation.

  • Rewritten Results: The examples retain image-based multiple-choice task formats while specifying exact answer-output requirements and tool configurations.Examples include gpt-4o-mini with Wikipedia Search and Qwen-2-VL-7B with Text Detector and Image Captioner.
  • Rewritten Results: The kernel-regression rewrite requires identifying the structural assumption affecting underfitting–overfitting trade-offs, checking theory, and validating the selected option.The procedure is divided into three explicit steps.
  • Rewritten Results: The map-colouring rewrite requires checking adjacency constraints, colour availability, and agreement with one of the answer choices.The validation is applied to regions 12–15 before final selection.
Loading 2601.17566v1…