Semantic Firewalls: Protocol-Aware Security

• Semantic firewalls are mechanisms that enforce security by interpreting protocol semantics and state transitions instead of solely inspecting packet headers.
• They integrate runtime semantic enforcement, learned rule recommendation, and intent-preserving configurations to ensure contextual and dynamic policy application.
• Semantic firewalls extend across diverse domains—from network security and IoT supervision to LLM-agent communication and even black-hole physics—highlighting their versatile interpretive framework.

Semantic firewalls are firewall mechanisms, firewall-adjacent frameworks, or conceptual reframings that operate on structured meaning rather than only on packet syntax. In the cybersecurity literature, this usually means reasoning over protocol fields, transactions, dialogs, sessions, device-interaction patterns, or trusted task intent; in adjacent work it also includes semantics-preserving analysis, learned rule recommendation, and intent-preserving configuration interfaces (0907.3045, Diekmann et al., 2016, Taghiyev et al., 11 Dec 2025). In a distinct line of black-hole research, “firewall” becomes a question about what structures are physically invariant, observer-dependent, or only interpretive, so “semantic firewall” functions as a conceptual label rather than a standard technical term (Hooft, 2015).

1. Scope of the term

The cited literature does not treat semantic firewalls as a single standardized object. Instead, it uses the idea in several related senses. One sense is runtime semantic enforcement: a firewall parses application-native structure, tracks protocol state over time, and enforces rules over state transitions rather than isolated packets. A second sense is policy semantics: a firewall ruleset is treated as a formal object whose meaning can be simplified, verified, compiled, or translated while preserving behavior. A third sense is administrative or intent semantics: human policy intent is normalized into typed intermediate representations before deterministic compilation to device syntax. A fourth sense, in LLM-agent security, is meaning-aware trust-boundary mediation over tool calls, tool outputs, and multi-turn trajectories (0907.3045, Taghiyev et al., 11 Dec 2025, Abdelnabi et al., 3 Feb 2025).

This diversity matters because several papers explicitly distinguish their contribution from a classic runtime firewall. The natural-language firewall-configuration work is “not about a ‘semantic firewall’ in the classic sense of inspecting packet payload meaning at runtime,” but about preserving human policy intent across a translation boundary into enforceable configuration (Taghiyev et al., 11 Dec 2025). The agentic-network work likewise moves the firewall boundary from ports and packets to task-conditioned communication semantics, while the black-hole papers use “firewall” in a conceptual and interpretive register rather than a network-security one (Abdelnabi et al., 3 Feb 2025, Hooft, 2015).

2. Protocol-native and interaction-semantic enforcement

In operational network security, the clearest exemplars are application-aware, stateful systems that make protocol semantics first-class. SecSip is introduced as a “stateful SIP firewall” because SIP failures often arise from misuse of legitimate protocol messages rather than malformed packets alone; generic IP firewalls are said to have “two major drawbacks”: they do not address SIP protocol semantics, and they do not support per-device vulnerabilities (0907.3045). Its architecture comprises the Input/Output Layer, the SIP Packet Handler, the Rules Compiler and Optimizer, and the Stateful Inspection Layer. Intercepted SIP messages are parsed into a parse tree; rules are attached to SIP transaction state-machine types; and stateful objects are stored in containers keyed by the SIP dialog identifier $(\text{Call ID}, \text{To Tag}, \text{From Tag})$. The paper formalizes vulnerabilities and rules over protocol state, with Definition 2 writing a SIP vulnerability as $v=(f,P)$, where $f$ is a state transition function and $P\subseteq S$ is a set of SIP object states satisfying preconditions, and Definition 3 writing a SecSip rule as $i=(v,S',A)$ with $S'=f_v(P_v)$ (0907.3045).

This formalization is reflected in concrete rule behavior. SecSip distinguishes message-object, transaction-object, and session-object; it can, for example, record From values observed across a dialog and then drop a forged BYE whose FIELDS:sip.from is not in the learned set. Likewise, it can rate-limit INVITE flooding by attaching counters to SIP transactions rather than merely counting IP packets. The paper’s central semantic claim is that the firewall reasons about protocol-state evolution, not just string patterns or packet headers (0907.3045).

A closely related but broader design appears in smart-home supervision. The profile-based firewall for IoT argues that MUD is “not expressive enough to describe traffic patterns representing device interactions” because many legitimate smart-home actions are temporally and logically interdependent (Keersmaeker et al., 2023). Its YAML profile language organizes device-info and interactions, where an interaction is implemented as a finite-state machine whose states correspond to policies. The language supports ordered dependencies, bidirectional exchanges, maximum duration, maximum packet count, packet rate, and protocol-specific fields for DHCP, HTTP, SSDP, CoAP, IGMP, and DNS. The firewall therefore permits traffic not merely because it matches an address-port tuple, but because it appears in the right behavioral context, such as a cloud-to-plug command that is valid only after the expected hub-to-cloud event chain (Keersmaeker et al., 2023).

Taken together, these systems define the classic cybersecurity meaning of a semantic firewall: protocol-native parsing, bounded state over the protocol’s own lifetimes, and enforcement over state transitions or interaction patterns rather than only over individual packets.

3. Formal semantics, semantics-preserving transformation, and the limits of statefulness

A second literature treats the firewall itself as a semantic object. For stateless packet filters, “Boolean Expressions in Firewall Analysis” models policy as a Boolean predicate $P:\mathcal{X}\to\{0,1\}$ over packet space, where $P(p)=1$ iff the packet is accepted (Hamilton et al., 2022). The paper converts an ordered first-match ruleset into a decision tree with disjoint leaves, then into whitelist/DNF or blacklist/CNF forms. Under its assumptions—fixed number of fields $d$, interval predicates, and bounded $\log(B)$—it derives a polynomial size bound for both normal forms, namely $v=(f,P)$0, with at most $v=(f,P)$1 terminal nodes in the decision tree (Hamilton et al., 2022). The point is not just representation efficiency. It is that rule ordering, overlap, and default actions can be made semantically explicit and then queried by SAT-style reasoning.

For real-world iptables, “Semantics-Preserving Simplification of Real-World Firewall Rule Sets” formalizes packet filtering with a big-step relation $v=(f,P)$2, unfolds Call and Return, and uses ternary logic to abstract unsupported matches (Diekmann et al., 2016). The paper gives a machine-verified closure theorem,

$v=(f,P)$3

so unknown match conditions yield lower and upper closures of accepted traffic rather than unsound omission (Diekmann et al., 2016). This is a semantic firewall methodology in a strong sense: the transformations are justified against filtering behavior, not only syntax.

At the same time, statefulness by itself does not guarantee semantic isolation. “Subverting Stateful Firewalls with Protocol States” assumes a strong and realistic baseline—a stateful firewall that silently drops invalid packets and enforces SAV—yet still constructs covert channels by observing or modifying global protocol state through generated header fields and response behavior (Klein, 2021). The paper reports three attacks in that context: exfiltration via the firewall itself, exfiltration via a DMZ host, and exfiltration via co-resident containers. The channels use valid ICMP, UDP, or TCP traffic to open or allowed services; the leak comes from shared state such as Linux connection-less IPv4 ID generation, Windows PathSet purge behavior, macOS/OpenBSD IPID uniqueness windows, NetBSD TCP ISN high bits, and similar protocol-state mechanisms (Klein, 2021). A semantic firewall that reasons only about flow legitimacy therefore remains vulnerable if the endpoint exports shared protocol state across security domains.

4. Learned recommendation and intent-preserving configuration

Another branch of the literature shifts the semantic layer upward, from runtime enforcement to policy synthesis and administration. “Learning to Customize Network Security Rules” uses sampled NetFlow/IPFIX metadata from routers, labels derived from firewall configurations “deemed to be authored by experts,” and a supervised classifier to predict which remote IPs should be allowed by an endpoint firewall (Bargury et al., 2017). The method captures “network routines and dependencies between resources and firewall configuration,” computes features at cloud, organization, VM, and endpoint levels, and then groups predicted IPs into a manageable number of ranges. The reported result is ROC AUC of $v=(f,P)$4, compared to $v=(f,P)$5 for an unsupervised baseline (Bargury et al., 2017). This is a semantic layer in the limited but important sense that firewall rules are induced from communication behavior and contextual dependencies, not only hand-written ACLs.

The natural-language configuration work pushes this further toward intent preservation. “Natural Language Interface for Firewall Configuration” takes a natural-language request plus a network-context file, resolves references through a Resolver Agent, constructs a typed vendor-agnostic intermediate representation through an IR Builder Agent, then applies a general linter, a vendor-specific linter, a Safety Gate, a deterministic vendor compiler, and Batfish-based validation (Taghiyev et al., 11 Dec 2025). The paper emphasizes that LLMs are used only as assistive parsers that generate typed IR objects; compilation and enforcement remain deterministic. The Safety Gate blocks “any source to any destination” allow rules, missing source or destination zones, empty source or destination lists, and absence of a protocol specification. On synthetic triplets, the prototype achieves an approximately 85% pass rate (Taghiyev et al., 11 Dec 2025). The paper explicitly positions this as a semantic interface for administration rather than a classic runtime semantic firewall.

These systems suggest a broader interpretation of the term: firewall semantics can be learned from behavior, or preserved across intent-to-configuration translation, even when no payload-inspecting runtime firewall is involved.

5. Semantic firewalls for LLM agents

Recent agent-security work relocates the firewall boundary from networks to agent-tool and agent-agent communication. “Firewalls to Secure Dynamic LLM Agentic Networks” studies an assistant $v=(f,P)$6, a user environment $v=(f,P)$7, an external party $v=(f,P)$8, and a conditional goal structure

$v=(f,P)$9

The framework introduces three layers: an input firewall, a data firewall, and a trajectory firewall (Abdelnabi et al., 3 Feb 2025). The input firewall converts external natural language into a developer-controlled closed language or JSON-like representation; the data firewall performs “abstractive summarization” so that only the task-permitted semantic content of user data crosses the boundary; and the trajectory firewall audits the evolving action sequence against learned rules. The paper presents these operations as quarantined from external attackers and reports that privacy leakage falls from 70% to less than 2% at worst, while a delete-calendar integrity attack falls from 45% to 0%; it also reports reduced upselling without destroying benign adaptability (Abdelnabi et al., 3 Feb 2025).

“Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?” gives a related but more modular design at the agent-tool interface (Bhagwatkar et al., 6 Oct 2025). Its pipeline wraps each tool call with a Tool-Input Firewall $f$0 (“Minimizer”) and a Tool-Output Firewall $f$1 (“Sanitizer”): $f$2 The defense is described as simple, modular, and model-agnostic, and is reported to achieve “perfect security (0% or the lowest possible attack success rate) with high utility” across AgentDojo, Agent Security Bench, InjecAgent, and $f$3-Bench (Bhagwatkar et al., 6 Oct 2025). At the same time, the same paper demonstrates practical bypasses, including an obfuscated Braille attack that the sanitizer decodes into executable malicious content, and argues that current benchmarks are easily saturated by weak attacks and flawed success metrics (Bhagwatkar et al., 6 Oct 2025). In this literature, semantic firewalling means meaning-aware mediation of trusted task intent, tool arguments, and tool outputs, not packet inspection.

6. Conceptual and interpretive firewalls in black-hole physics

A separate body of work uses “firewall” in a physical and interpretive sense, not as a network-security mechanism. Here the closest analogue to a semantic firewall is a dispute over what counts as physically invariant at the horizon, in the interior, or across different observer descriptions. Gerard ’t Hooft’s “Singularities, horizons, firewalls, and local conformal symmetry” is explicit that the central move is not an AMPS-style microscopic mechanism but a reformulation of gravity with exact local conformal symmetry,

$f$4

together with

$f$5

In this framework, the central singularity “disappears,” the horizon becomes “fuzzy,” and a firewall can be outside-observer dependent and invisible to the infaller (Hooft, 2015). The abstract’s strongest phrasing is that the procedure “appears to turn a black hole into a regular, topologically trivial soliton without singularities, horizons or firewalls,” though the paper repeatedly notes that many questions remain (Hooft, 2015).

Several other firewall papers sharpen the interpretive point in different directions. Bousso’s “Firewalls From Double Purity” reframes the paradox as a contradiction between two purities rather than two entanglements: the infalling vacuum requires $f$6 with $f$7, while unitarity requires the full outgoing state to be pure, $f$8 (Bousso, 2013). Susskind’s “Singularities, Firewalls, and Complementarity” argues that the horizon itself can remain ordinary while the singularity becomes nonstandard and migrates outward to meet the horizon at about the Page time (Susskind, 2012). The abstract of “Complementarity, not Firewalls” argues that AMPS reach the opposite conclusion because they use low-energy physics to translate between the quantum mechanics of different observers rather than to describe the experiments of only a single observer (Harlow, 2012). Nomura and Salzetta argue that firewalls need not exist because semiclassical theory both under-resolves the true microstate degeneracy and overcounts an unphysical Fock space (Nomura et al., 2016). “An Apologia for Firewalls” defends the contrary conclusion that embedding the interior Hilbert space of an old black hole into the early radiation, or embedding the semi-classical interior of an AdS black hole into any dual CFT Hilbert space, is inconsistent; on that view, unitary non-local theories avoid firewalls only if the non-localities are “suitably dramatic” (Almheiri et al., 2013).

Late-time JT-gravity work makes the interpretive issue quantitative. “Firewalls at exponentially late times” studies a thermofield double with perturbations in a double-scaling limit $f$9, $P\subseteq S$0, $P\subseteq S$1 fixed, where one can resum the wormhole expansion (Blommaert et al., 2024). The paper defines a distribution over effective interior slices and shows that wormholes can convert time-ordered contours into effective out-of-time-ordered folds. With many perturbations separated by large times, the safe-interior probability becomes

$P\subseteq S$2

so the probability of a safe interior is exponentially small; even in the single-perturbation case, the safest state has 50–50 odds of a dangerous shock (Blommaert et al., 2024). A different Harlow–Hayden-oriented line studies whether the relevant information is operationally accessible at all: “Cold Black Holes in the Harlow-Hayden Approach to Firewalls” argues that charged AdS black holes are destroyed before Hawking radiation can be decoded, so the operational AMPS protocol is cut off by black-hole lifetime rather than by a literal horizon wall (Ong et al., 2014).

This use of the term is conceptual rather than standard cybersecurity terminology. It does, however, preserve the core semantic theme: firewall debates in quantum gravity repeatedly turn on whether horizons, interiors, or vacuum structure are invariant objects, observer-relative constructions, or only effective descriptions. That is why “semantic firewall” serves as a useful interpretive label across otherwise very different literatures.