Look Before You Leap: Protecting LLM Agents from Tool Description Poisoning Attacks via Isolated Planning

The researchers propose Tool-Guard, a system-level defense based on the concept of isolated planning, to protect LLM agents from cross-tool description poisoning attacks. Such attacks guide the agent's execution trajectory by manipulating the tool metadata visible to the planner; even if the poisoned tool is never selected, the poisoned description persists across steps in the planning context and influences subsequent tool selection. The paper's evaluation finds that existing prompt injection defenses transfer poorly to such attacks. Tool-Guard places the tools involved in tool calls detected as misaligned or suspicious on an isolation list, cutting off the further influence of the poisoned description while preserving the tool's ability to continue supporting the task. Experiments on the AgentDojo and ASB benchmarks show that Tool-Guard substantially reduces attack success rates while maintaining high task utility. The code is open-sourced at https://github.com/shishishi123/Tool-Guard。