TRUSTDESC: Preventing tool poisoning in LLM applications by generating trusted tool descriptions

Researchers propose the TRUSTDESC framework, which defends against tool poisoning attacks (TPA) in LLM applications by automatically generating trustworthy descriptions from tool implementation code. Such attacks embed malicious instructions (explicit TPA) or misleading claims (implicit TPA) in tool descriptions to influence model behavior and tool selection, while existing defenses mainly detect anomalous instructions and are ineffective against implicit attacks. The framework has three stages: SliceMin extracts minimal tool-relevant code slices through reachability-aware static analysis and LLM-guided code slimming, DescGen synthesizes descriptions from these slices and eliminates misleading or adversarial code artifacts, and DynVer dynamically verifies by executing synthesized tasks to correct descriptions. Evaluation on 52 real tools across multiple tool ecosystems shows that descriptions generated by TRUSTDESC are accurate and improve task completion rates, while mitigating implicit tool poisoning at the root, with very low time and monetary overhead.