TokenWall audits agent token flows to stop abuse

Problem

The paper studies security risks introduced by persistent AI agents, which extend large language models into long-lived systems with memory, reusable skills and tool-mediated interactions. Unsafe content can propagate through persistent state, tool arguments and inter-component messages, producing a larger semantic attack surface than single-turn assistants. Traditional rule-based guards miss implicit semantic threats and remote large-model auditing either exposes sensitive context or is too costly for full pre-execution inspection. The paper reframes the problem as preventing unsafe semantic token flows before they cross protected runtime boundaries.

Approach

The authors propose TokenWall, a runtime semantic firewall that intercepts token flows at the last safe point before they affect protected sinks. Token flows are structured records containing payload spans and source, sink and boundary metadata. TokenWall applies a three-stage pipeline: a deterministic lightweight precheck for explicit violations, a local small-model auditor for boundary-aware semantic inspection and optional rewrite, and selective escalation to a stronger fallback arbiter for ambiguous or high-impact cases. Token flows are classified by surface type as context, authority or capability transfers. The local auditor reports structured scores for risk, uncertainty, exploitability, impact and rewrite completeness, and the runtime enforces one of four actions: allow, rewrite and continue, defer to humans, or block. The implementation used Qwen3-4B as the default local auditor, Qwen3.6-Plus as the fallback arbiter, and GPT-5.5 as an external judge in evaluation.

Key Findings

• TokenWall reduces overall attack success rate to 12.5% on the CIK-Bench suite, improving on the strongest runtime baseline which achieved 14.7%.
• Benign behaviour is preserved: TokenWall attains a 97.4% benign executable pass rate without human confirmation while adding only 0.69 seconds of additional latency on benign cases.
• TokenWall achieves a practical runtime cost for adversarial cases, with 16.9 seconds per attack case versus 64.3 seconds for a strong baseline that relied more on large-model arbitration.
• TokenWall lowers reliance on humans: human escalation rate falls to 33.0% from 69.3% for a large-model-heavy baseline, and some rule or watcher baselines use human review for all benign cases.
• Ablations show the coordinated pipeline matters: removing the local auditor, fallback arbiter or rewrite capability degrades security, utility or cost, while sending every case to the large arbiter reduces attack success but at prohibitive latency.
• Auditor scaling shows effectiveness even at 1.7B parameters and diminishing returns beyond 4B, motivating the chosen 4B default for a favourable trade off.

Limitations

Evaluation is limited to the CIK-Bench and simulated OpenClaw-style environments and may not capture the full diversity of real deployments, long-horizon interactions or data sources. TokenWall depends on the quality of local auditors and the runtime metadata provided. It does not address host compromise, stolen credentials outside the runtime, denial of service, or cases where a user knowingly authorises harmful actions. Latency and deployment cost depend on implementation specifics.

Implications

An attacker who can control agent-observable inputs can attempt multi-step campaigns that inject malicious instructions into memory or tool arguments to trigger later unsafe actions. TokenWall demonstrates that intercepting semantic token flows makes such attacks harder by intercepting transfers before they reach execution or persistent state. Offensively, attackers may focus on crafting payloads that blend with benign intent, exploit gaps in source metadata or induce low-uncertainty scores to avoid escalation, highlighting the value for defenders of precise provenance signals, local auditors and robust rewrite checks.