Correct Tools, Wrong Parameters: Defending Against Parameter Poisoning Attacks on LLM Agents

Researchers propose AuthorityFlow, a three-stage parameter-level defense against parameter poisoning attacks on LLM agents, and release the evaluation benchmark FactAuthBench. Parameter poisoning refers to an attacker keeping the originally intended tool-call action unchanged and tampering only with task-critical parameters such as the recipient; because no new action is introduced, it is difficult to detect. Its core idea is that whether a parameter change is legitimate should be determined by the trustworthiness of the information flow that produced the change under the user query. AuthorityFlow first builds a task-specific trust hierarchy for available information fields based on the user query, then traces the information flow of each tool parameter value and attributes it to supporting fields, accepting a change only when that field is trusted to determine the parameter. On FactAuthBench, the attack success rate without defense is 93.06%, and AuthorityFlow reduces it to 9.03%, with normal task utility of 82.64% versus 90.28% without defense.