Tool-Output Firewall (Sanitizer)

• Tool-output firewalls are systems that mediate, sanitize, and block external tool outputs, preventing indirect prompt injections and policy breaches.
• They employ multi-layered enforcement pipelines—including regex scanning, LLM-based classification, and behavioral monitoring—to achieve ultra-low attack success rates.
• These systems balance robust policy enforcement with minimal latency and high benign utility across diverse domains like code generation and bio-LLM research.

A Tool-Output Firewall (Sanitizer) mediates, sanitizes, or blocks outputs from external tools before they reach a downstream neural agent, LLM, or critical deployment component. Its purpose is to counteract indirect prompt injections, adversarial outputs, policy violations, or content-based exploits that could subvert the agent or propagate risk through tool–model loops. Tool-output firewalls have emerged in diverse application domains (general AI agents, structured workflow automation, code generation, biological LLMs, firewall configuration analysis, and retrieval-augmented LLMs), with substantially different threat models, enforcement mechanisms, and design trade-offs.

1. Architectural Variants and Design Principles

Tool-output firewalls appear in two chief guises: (i) as policy-enforcing middleware at the agent–tool interface, or (ii) as transform layers in retrieval-augmented generation and similar workflows. The common architectural characteristic is placement: they interpose before any tool- or retrieval-generated data is appended to the primary task prompt or action buffer.

AEGIS introduces a trusted middleware (agentguard SDK) that intercepts all "tool_use" calls, processes tool arguments through a gateway applying multi-layered scanning and policy validation, and either allows, blocks, or escalates for human review with comprehensive auditing (Yuan et al., 13 Mar 2026).

GAF (Generative Application Firewall) acts as a unifying perimeter, mediating input, intermediary tool outputs, and agent responses with layered network, access, syntactic, and semantic controls, supporting actions such as redaction, blocking, and alerting (Farreny et al., 22 Jan 2026). BioShield implements dual-stage defense (pre-generation prompt scanning and post-generation output verification) in LLM biological research pipelines, targeting domain-specific dual-use risk (Das et al., 23 Mar 2026).

CommandSans and the Tool-Output Firewall from (Bhagwatkar et al., 6 Oct 2025) embody context-agnostic, token- or sample-level sanitization: tool outputs are checked for instruction-like content via (a) fine-grained token classifiers or (b) LLM-rule–driven filtering before incorporation into the agent prompt (Das et al., 9 Oct 2025, Bhagwatkar et al., 6 Oct 2025). CodeSentinel extends the concept to code generation, extracting and selectively neutralizing high-risk CST nodes using multi-layer static and behavioral analysis (Cheng et al., 17 Jun 2026).

2. Enforcement Pipelines and Sanitization Algorithms

Several enforcement pipelines have emerged:

• Three-stage pipeline (AEGIS):

1. Deep String Extraction: Recursive traversal extracts all argument strings from tool call JSON, hard-capped to prevent nesting attacks.
2. Content-first Risk Scanning: 22 regexes in seven categories (SQLi, shell, path traversal, prompt injection, file, PII, exfiltration).
3. Composable Policy Validation: JSON Schema–expressed policies, post-scan, are checked for violations and enforced with strong audit trails (Yuan et al., 13 Mar 2026).

• GAF's policy stack: Deploys network, access, syntactic, semantic, and context layers. Token-level or semantic matches (e.g., jailbreaking), schema checks, and behavioral profiling yield block/redact/alert actions (Farreny et al., 22 Jan 2026).
• Sentence-relation (SONAR): Builds NLI-based relational graphs, identifies anomalous (contradictory or outlier) sentences, and prunes injection seeds plus neighbor sentences while leaving core task context intact (Datta et al., 1 May 2026).
• Token-level instruction sanitization (CommandSans): Trains a transformer classifier to predict, via $$p_i = P(\mathrm{instruction} \mid x_i, \mathrm{context})$$, which tokens are instruction-like, dropping those with $p_i$ above threshold $\tau$ (default 0.5), and retaining all others. This process is explicitly context-agnostic and calibrated for high precision/recall without per-deployment tuning (Das et al., 9 Oct 2025).
• Adaptive LLM-based output firewall (Bhagwatkar et al., 6 Oct 2025): Makes an LLM call to vet tool output for hidden instructions or malicious fragments, returning sanitized content. No hand-crafted rules are required; the approach leverages the reasoning abilities of purpose-prompted LLMs.
• Behavioral trajectory enforcement (Praetor): Defines allowable tool-call sequences and parameter bounds via a parameterized DFA (pDFA), constructed offline from benign profiles, enforcing O(1) enforcement at runtime (Dang, 29 Apr 2026).
• CodeSentinel's three-layer code sanitizer: Combines syntax-level prefiltering, dynamic token-likelihood anomaly detection (Min-K%), and perturbation-based node influence estimation to detect and sanitize adversarial nodes and code regions (Cheng et al., 17 Jun 2026).

3. Security and Utility Metrics, Empirical Results

Benchmarks standardly use Attack Success Rate (ASR)—the fraction of attacks in which an agent executes injected instructions—and utility metrics (Benign Utility, Utility under Attack). Performance is assessed with adversarial corpora (AgentDojo, ASB, InjecAgent, BIPIA, τ-Bench, Open-Prompt-Injection), sliced by attack category and deployment context.

Defense	ASR (%) (AgentDojo)	ASR (%) (InjecAgent)	Overhead (ms)	Benign Utility (%)
None	34–57	8.3–46	0	51–83
CommandSans*	3–6	4.6	5–15	68–69
Tool-Output Firewall†	0.02	0.3	O(N) LLM call	59–69
AEGIS	0	–	8.3	99
Praetor	2.2	–	2.2	98
SONAR	1–2 (AlpacaFarm)	<6 (Open-PI)	40–300	95–100

†Sample-level LLM sanitizer (Bhagwatkar et al., 6 Oct 2025); *Token-level classifier (Das et al., 9 Oct 2025).

• AEGIS blocked 100% of tested attacks (48/48) with a 1.2% false-positive rate and median latency below 15 ms (Yuan et al., 13 Mar 2026).
• CommandSans achieved ∼95.8% precision and ∼90.5% recall on token-level instruction removal, driving ASR by factors of 7–19× with <5% drop in benign utility (Das et al., 9 Oct 2025).
• Praetor achieved macro-averaged ASR 5.6% across Agent Security Bench, outperforming stateless firewalls, and reduced ASR to 0.8% when combined with AEGIS; per-call median latency was 2.2 ms (Dang, 29 Apr 2026).
• BioShield leveraged risk-weighted, category-specific scoring, achieving robust separation of policy-compliant and actionable dual-use content in bio-LLMs (Das et al., 23 Mar 2026).
• SONAR reduced ASR from ~80% to 1–2% across major LLM families and code/text retrieval scenarios, retaining benign task fidelity within 5% of the clean baseline (Datta et al., 1 May 2026).
• CodeSentinel produced sample-level ASR reduction (Claude-3.5: 27.1%→7.7%), with minimal impact on compile rates and code quality (Cheng et al., 17 Jun 2026).

4. Policy Representations and Extensibility

Policy expression for tool-output firewalls depends on the required robustness, transparency, and compliance posture:

• Declarative schemas: AEGIS and GAF rely on JSON Schema or similar machine-readable rule formats; these enable composable, LLM-assistible, and cacheable policies that can be updated and audited for compliance (Yuan et al., 13 Mar 2026, Farreny et al., 22 Jan 2026).
• Domain-adaptive risk models: BioShield computes weighted risk across multiple semantically defined threat categories, easily reparameterized for other domains (e.g., finance, medical, legal) by swapping threat-specific scorers and re-weighting (Das et al., 23 Mar 2026).
• Behavioral grammars: Praetor’s policies are encoded as pDFAs trained from trusted logs, enforcing both sequential and parameter-level constraints on action trajectories (Dang, 29 Apr 2026).
• Floating LLM reasoning: Black-box LLM-driven output firewalls (Bhagwatkar et al., 6 Oct 2025) express policy “at the prompt” rather than in code, which promotes flexibility but hinders explainability and formal guarantees.
• Data-model and classifier-based approaches: CommandSans, CodeSentinel, and SONAR combine learned statistical models and structural graph reasoning; these approaches are tailored through retraining or transfer to new attack modalities, language variants, or task settings.

A plausible implication is that policy modularity and domain-specific tunability are prerequisites for practical deployment in high-risk or regulated environments.

5. Limitations, Failures, and Evasion Vectors

Common pitfalls include:

• Obfuscation and encoding: LLM-based sanitizers can be subverted if obfuscated instructions (e.g., Braille Unicode, steganographic text) are decoded in the sanitization step and surfaced to the agent (Bhagwatkar et al., 6 Oct 2025).
• Synonym-substitution and drift: pDFA-based behavioral firewalls can be evaded by synonym replacement in string parameters or long-term distributional drift; the countermeasure is to enforce exact-match whitelists on sensitive fields (Dang, 29 Apr 2026).
• Adaptive attacks: Several pipelines are susceptible to adversarial adaptation, including copy-trigger or decoy poisoning in code (CodeSentinel), or threshold gaming in SONAR’s graph pruning (Cheng et al., 17 Jun 2026, Datta et al., 1 May 2026).
• Context-layer calibration: GAF’s context and multi-turn reasoning can degrade user experience due to false positives if thresholds are set too low or session memory is not adequately modeled (Farreny et al., 22 Jan 2026).
• Limited generalization: Training-derived statistical classifiers (e.g., CommandSans) may struggle to generalize to zero-day or distribution-shifted attack patterns unless retrained or augmented with in-the-wild data.

Nonetheless, multiple defenses (AEGIS, SONAR, tool-output firewall LLM prompt) have demonstrated near-zero ASR in head-to-head benchmark tests, suggesting high practical utility in current deployment regimes.

6. Best Practices, Integration, and Compliance

Integration patterns are converging toward:

• Inline enforcement between any untrusted tool output and the LLM context buffer, requiring either minimal SDK patching (AEGIS: two lines) or standalone wrappers (LLM sanitizer, CommandSans) (Yuan et al., 13 Mar 2026, Bhagwatkar et al., 6 Oct 2025).
• Continuous monitoring and auditing with tamper-evident records (e.g., Ed25519-signed, SHA-256 hash chains in AEGIS), enabling post-hoc compliance and breach forensics.
• Out-of-the-box deployment: Model-agnostic, black-box frameworks (LLM sanitizer, CommandSans) simplify adoption but necessitate vigilance in maintaining high true positive and low false positive rates as attacks evolve.
• Human-in-the-loop escalation: Critical for high-risk or regulatory-bound applications—agents pause pending human adjudication of high-risk actions, preserving operational agility (Yuan et al., 13 Mar 2026).
• Dynamic thresholding and anomaly monitoring: Essential for behavioral and learning-based approaches to prevent drift or silent failures under adversarial pressure (Dang, 29 Apr 2026, Das et al., 9 Oct 2025).

Auditability, modular policy definition, and adaptive scoring are emerging as cross-cutting requirements for the secure deployment of tool-output firewalls in production agentic systems.

7. Comparative Summary and Research Directions

Recent advances have established the practicality and low-latency profile of tool-output firewalls, both in stateless (AEGIS, CommandSans, LLM-firewall) and stateful/behavioral (Praetor, CodeSentinel, BioShield) forms. ASR reductions of >90% are routine on public benchmarks, and integration with legacy and agentic stacks (Python, JavaScript, Go, firewall rule analyzers) is lightweight, often requiring only wrapper calls or SDK inserts (Yuan et al., 13 Mar 2026, Bhagwatkar et al., 6 Oct 2025). However, the continual emergence of new threat modalities—code obfuscation, encoding, behavioral subversion—makes ongoing adaptation, red-teaming, and benchmark evolution indispensable.

Open challenges include standardized multi-turn red-teaming, privacy-aware context monitoring, automated policy synthesis, and multi-agent risk propagation analyses (Farreny et al., 22 Jan 2026, Datta et al., 1 May 2026, Das et al., 23 Mar 2026). Tool-output firewalls are now a foundational primitive for defense-in-depth security architectures at the interface of LLMs, tools, and enterprise applications.