Skip to content

Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents

🕒 Published (v1): 2026-07-09 12:18 UTC · Source: Arxiv · link

Why this paper was selected

Token-Flow Firewall: semantic runtime auditing for persistent agents — directly addresses agent safety/security in long-lived systems

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

TokenWall is a local runtime defense framework that treats security-critical interactions in persistent AI agents as typed token flows crossing system boundaries, intercepting them before they mutate persistent state or invoke tools. Using a three-tier pipeline (deterministic precheck → lightweight local auditor → optional fallback to a larger model), it achieves a 12.5% attack success rate on CIK-Bench while maintaining 97.4% benign pass rate and adding only 0.69 s overhead on benign cases.

Problem

Persistent AI agents (long-lived systems with cross-session memory, reusable skills, and tool access) expand the attack surface far beyond single-turn chat: malicious content injected into memory or tool arguments can propagate and compound across sessions. Existing defenses are either coarse rule-based filters that miss implicit semantic threats (e.g., memory poisoning, authority rebinding) or remote large-model auditors that incur prohibitive latency, expose sensitive context externally, and can only audit sparsely rather than providing full pre-execution coverage.

Method

TokenWall models every security-relevant interaction as a token flow \(f = (x, s, t, c, b)\), where \(x\) is a span-segmented payload, \(s\) is the source, \(t\) is the sink, \(c\) is runtime metadata, and \(b\) is the crossed boundary. Flows are classified into three surfaces — context (memory/reasoning state), authority (identity/session binding), capability (tool execution/external disclosure) — mirroring the threat model.

The enforcement pipeline is hierarchical: 1. Lightweight precheck: deterministic rules and pattern matchers block explicit violations and annotate flows with signals before any model inference. 2. Local small-model auditor (Qwen3-4B): receives a structured source–sink audit record and outputs a 10-field structured report \(r_s = (d, x', \rho, u, \xi, \iota, T, \kappa, q, e)\) covering decision, optional rewrite, and five rubric-based \([0,1]\) scores (risk, uncertainty, exploitability, impact, rewrite completeness). Enforcement action is one of {allow, rewrite_and_continue, defer_to_human, block}. 3. Fallback arbiter (Qwen3.6-Plus): invoked only when a surface-specific escalation predicate \(\Phi_{\text{type}(f)}\) detects high-impact, ambiguous, or unresolved risk in the small-auditor report; makes the final binding decision.

Rewrites are accepted only if they eliminate the risky span without introducing new facts, expanding permissions, or altering user objectives. Malformed reports and auditor timeouts are treated as blocking conditions (fail-closed).

Key Contributions

  • Token-flow abstraction: a formal, span-segmented source–sink model of security-relevant transfers in persistent agents, enabling pre-mutation interception rather than post-hoc observation.
  • Boundary-aware semantic auditing: a local small-model auditor that reasons over structured audit records across three security surfaces with structured self-assessment scores.
  • Three-tier pipeline: precheck → local auditor → fallback arbiter reduces routine large-model calls (large-call rate 15.9%) while preserving robustness.
  • Recoverable rewriting: inline span masking resolves ambiguous cases locally, reducing unnecessary human escalation and large-model invocations.
  • CIK-Bench evaluation: first published defense results on this persistent-state/cross-session benchmark, with quantified security–efficiency–utility Pareto analysis against six baselines.

Results

  • Attack Success Rate (ASR): TokenWall 12.5% vs. best baseline ClawKeeper 14.7%; 11.1% on Context, 15.4% on Authority, 11.5% on Capability surfaces.
  • Benign pass rate: 97.4%, matching the strongest non-trivial baseline; human intervention rate 0.0% on benign cases vs. 66.7%–100% for several baselines that achieve comparable PR by routing to human review.
  • Latency (attack cases): 16.9 s/case vs. 64.3 s (ClawKeeper) and 53.8 s (CIK-Defense).
  • Latency (benign cases): +0.69 s overhead, lowest among all defenses with non-trivial security.
  • Human intervention rate (attack): 33.0% vs. 69.3% for ClawKeeper.
  • Ablations: removing the small auditor raises large-call rate to 94.3% and latency to 74.7 s; removing fallback raises ASR to 20.4%; removing rewrite raises both HR and large-call rate; large-model-only achieves lowest ASR but at prohibitive cost.
  • Report design ablation: removing the uncertainty score \(u\) or the surface-specific escalation predicate \(\Phi_{\text{type}(f)}\) degrades both ASR and human-intervention behavior.

Limitations

  • Evaluation is confined to CIK-Bench (88 attack cases, 38 benign), which targets one agent framework (OpenClaw); generalization to other agent architectures is untested.
  • The fallback arbiter (Qwen3.6-Plus) is a remote/large model call; although used sparingly, it still introduces dependency on an external service and associated privacy trade-offs.
  • The threat model explicitly excludes adversaries who can tamper with the firewall or audit logs; supply-chain or insider attacks on the TokenWall runtime itself are out of scope.
  • Rubric-based scores (\(\rho, u, \xi, \iota, \kappa\)) are model judgments, not calibrated probabilities; reliability under novel attack phrasings is not formally characterized.
  • The task model is fixed to Gemini 3.1 Pro; sensitivity to different backbone LLMs is not evaluated.

Relevance to Agentic AI / LLM Agents

TokenWall directly addresses the security gap that opens when LLMs are embedded in persistent, tool-using agent systems — the dominant deployment paradigm tracked under this topic. By formalizing the information-flow view of agent security (rather than acting at the tool-call graph level), it offers a principled complement to existing prompt-injection and sandboxing work. The three-surface threat taxonomy (context / authority / capability) provides a reusable conceptual framework for reasoning about where persistent agents are vulnerable. The paper's practical finding — that a small local model auditing structured source–sink records can match or exceed a large remote auditor at a fraction of the latency — has direct implications for on-device or enterprise agent deployments where remote model access is restricted.