- The paper introduces TokenWall, a runtime firewall that combines deterministic checks, local semantic auditing, constrained rewriting, and selective large-model arbitration to protect context, authority, capability, and disclosure boundaries.
- TokenWall reduces attack success on CIK-Bench to 12.5%, achieves a 97.4% benign pass rate with no human intervention, and adds only 0.69 seconds of latency per benign case.
- Ablations show that structured uncertainty reports, rewriting, and fallback arbitration are essential, while the evaluation remains limited to one OpenClaw-style benchmark and assumes the host and firewall are uncompromised.
Persistent AI agents such as OpenClaw differ from single-turn chat systems in that model outputs become persistent state transitions: content written to memory, skill files, identity or policy state, tool arguments, and outbound messages can shape behavior across sessions. The paper "Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents" (2607.08395) argues that this persistence enlarges the semantic attack surface and that most security-relevant interactions are carried by natural-language token sequences. It proposes TokenWall, a local runtime framework that mediates these "semantic token flows" before they cross protected boundaries, and reports that it reduces case-level attack success rate (ASR) on CIK-Bench to 12.5% while preserving a 97.4% benign pass rate with only 0.69 seconds of additional latency per benign case.
The threat model considers an OpenClaw-style agent with four interfaces — inputs, state, capabilities, and outputs. The adversary can influence any agent-observable content (web pages, emails, shared files, tool outputs) and may stage multi-step attacks in which malicious content injected in one session is activated later through persistent state. The adversary is assumed unable to compromise the host, tamper with the firewall, modify audit logs, or access private user data; the authors state this assumption explicitly, so TokenWall is not positioned as a defense against host-level compromise.
Attacks are modeled as attempts to induce unsafe state transitions across three surfaces: context manipulation (injecting persistent instructions into memory or reasoning context), authority manipulation (altering identity, permission, or recipient bindings), and capability exploitation (misusing tools or external channels). The corresponding enforcement objectives are boundary enforcement (inspect every transfer before it crosses a context, authority, execution, persistence, or disclosure boundary), semantic containment (remove or mask unsafe spans), and minimal disruption (preserve benign task content when unsafe portions can be separated).
The token-flow abstraction
The central design move is to treat each security-relevant transfer as a flow f=(x,s,t,c,b), where x is a payload segmented into audit-relevant spans (secrets, paths/endpoints, recipients, instruction clauses, tool arguments), s and t are source and sink, c is runtime metadata produced by an instrumented runtime (source trust, sink type, session scope, tool permissions, authorization signals), and b is the crossed boundary. Flows are instantiated at the last safe point before effect — after payload generation but before state mutation, tool invocation, authority change, or disclosure. This contrasts with approaches that inspect prompts, traces, or tool-call graphs post hoc.
The instrumentation distinguishes context flows (content entering reasoning context, memory, skills, or planning state), authority flows (recipient changes, identity updates, session rebinding, authorization updates), and capability flows (tool arguments, commands, file operations, API requests, outbound disclosure). Mixed-trust content such as retrieved documents is treated as evidence rather than intent; owner-intent summaries derive only from trusted runtime signals.
Hierarchical enforcement pipeline
TokenWall applies a three-stage pipeline. First, a deterministic precheck parses flow metadata and pattern evidence, applying hard invariants (e.g., destructive operations without authorization, private-endpoint bridging) and forwarding soft-rule matches (credential patterns, prompt-control language, encoded payloads, recipient ambiguity) as grounded evidence. Second, a lightweight local auditor — Qwen3-4B in the default configuration — consumes a compact source–sink record and emits a structured report containing a decision among allow, rewrite-and-continue, defer-to-human, and block, plus five rubric-based [0,1] scores (risk, uncertainty, exploitability, impact, rewrite completeness), residual-risk categories, and input-grounded evidence. Rewrites are constrained: they may redact secrets, remove unsafe imperative clauses, or add provenance markers, but must not invent facts, broaden permissions, or alter the user objective. Third, a surface-specific escalation predicate Φtype(f)​ decides whether the local decision terminates locally or requires fallback arbitration by a stronger remote-capable model (Qwen3.6-Plus). Fail-closed semantics apply throughout: malformed reports, missing fields, invalid rewrites, and timeouts all block.
The implication of this division of labor is that full pre-execution coverage becomes affordable: routine flows terminate at the small auditor, while only ambiguous or high-impact cases incur large-model cost. This directly addresses the two limitations the authors attribute to prior remote-audit defenses — partial inspection due to computational cost, and privacy exposure from shipping sensitive context to remote models.
Experimental results
Evaluation uses CIK-Bench's 88-case attack split and 38 matched benign cases, run through instrumented OpenClaw boundaries with Gemini 3.1 Pro as the task model and GPT-5.5 as LLM-judge. Baselines span rule-based guards (OpenGuardrails), plugin shields (OpenClaw Shield, ClawSec, SecureClaw, ClawBands), human-approval middleware (CIK-Defense assets), and watcher-style defenses (ClawKeeper).
| Method |
Overall ASR (%) |
HR (%) |
Latency |
| OpenGuardrails |
45.5 |
0.0 |
0.67 s/case |
| CIK-Defense |
35.2 |
0.0 |
53.8 s/case |
| OpenClaw Shield |
38.6 |
2.3 |
50.0 s/case |
| SecureClaw |
45.5 |
3.4 |
62.4 s/case |
| ClawSec |
46.6 |
52.3 |
41.5 s/case |
| ClawKeeper |
14.7 |
69.3 |
64.3 s/case |
| TokenWall |
12.5 |
33.0 |
16.9 s/case |
TokenWall achieves the lowest ASR on Context (11.1%) and Authority (15.4%) surfaces and ties the best baseline on Capability (11.5%). Notably, several baselines achieve low ASR largely through human deferral — ClawKeeper's 69.3% human rate versus TokenWall's 33.0% — so the comparison conflates containment with approval burden. On benign cases, TokenWall reaches 97.4% pass rate with 0.0% human intervention and 0.69 s/case latency, whereas ClawBands, CIK-Defense, and ClawSec preserve executability only by routing 100% of benign cases to humans. This is the paper's strongest practical claim: security gains do not come from over-blocking or from shifting decisions to users.
Ablations support the coordinated-pipeline design. Removing the local auditor pushes large-call rate from 15.9% to 94.3% and latency to 74.7 s/case without improving ASR; removing fallback arbitration raises ASR to 20.4%; removing rewriting increases both human rate and escalation. Reducing the auditor report to decision-only JSON raises ASR to 28.4%, indicating that uncertainty and residual-risk fields are load-bearing for selective escalation rather than decorative structure. Auditor-size scaling shows diminishing returns beyond 4B parameters: Qwen3-1.7B yields 23.1% ASR, Qwen3-4B 12.5%, and Qwen3-14B 9.7%, with the 4B configuration offering the best latency–security trade-off. An uncertainty-calibration analysis shows zero small-only ASR in the lowest uncertainty bucket but 68–76% small-only ASR in medium buckets, which the full system reduces substantially — supporting uncertainty as a genuine failure signal rather than a mechanical escalation trigger.
Limitations and open questions
The authors concede several constraints. Evaluation is confined to one benchmark for OpenClaw-style personal agents; generality across other agent environments and real-world task distributions remains unverified. Effectiveness depends on the quality of the local auditor and on the richness of runtime metadata (provenance, authorization signals); when those signals are insufficient, difficult cases still require fallback arbitration. The prototype addresses runtime containment only — compromised hosts, externally stolen credentials, denial-of-service, and owner-authorized harmful actions after accurate warnings are out of scope. Latency figures are implementation-dependent. An open question the results leave unresolved is whether specialized, fine-tuned local auditors could close the remaining gap between the 12.5% system ASR and the 9.7% achieved by a 14B auditor without the associated inference cost.
Conclusion
The paper reframes runtime defense for persistent agents around semantic token flows crossing protected boundaries, combining deterministic prechecks, a structured-report small-model auditor, recoverable rewriting, and selective large-model arbitration. Its empirical contribution is a demonstrated operating point — 12.5% ASR, 97.4% benign pass rate, 0% benign human intervention, sub-second benign overhead — that strictly improves on the strongest watcher-style baseline in both security and efficiency. The broader lesson the authors draw is that securing long-horizon agents may require mediation over information flow at transfer time rather than static interface filtering or post-hoc action review, though the evidence base remains limited to a single benchmark ecosystem.
