Firewalls to Secure Dynamic LLM Agentic Networks
Open accessAbstract
The emergence of agent-to-agent communication protocols mirrors the early internet: powerful connectivity with minimal security infrastructure. When AI agents communicate on behalf of users, every message crosses a trust boundary where the user's personal data and the external agent's unconstrained language each present distinct risks. We address both through a dual-firewall architecture grounded in a unifying principle: each task defines a context, and both sides of the communication carry information far exceeding what that context requires. Our firewalls act as projections onto the task context, allowing only contextually appropriate content to cross each boundary. The Language Converter Firewall projects incoming messages onto a closed, domain-specific, structured protocol; an external agent's message is converted to validated fields while persuasive framing, urgency tactics, and embedded instructions are structurally eliminated through deterministic verification. This replaces the asymmetric challenge of resisting every possible manipulation with the structural guarantee that manipulation has no channel through which to arrive. The Data Abstraction Firewall projects outgoing information onto the granularity appropriate for the task, rather than applying binary disclose-or-redact filtering, as previous airgapping solutions did. Both firewalls operate in a trusted environment isolated from external input, applying domain-specific rules learned automatically from demonstrations. Across 864 attacks spanning three domains on the ConVerse benchmark, our architecture reduces privacy attack success rates (e.g., from 84% to 10% for GPT-5) and security attacks (from 60% to 3%), while maintaining or even improving task completion quality.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Empirical results show that private data leakage was reduced from 70% to under 2%, deletion-of-calendar-entry attacks dropped from 45% to 0%, and even subtle upselling and coercive suggestions were nearly eradicated without impeding the assistant's ability to adapt and fulfill complex, interdependent goals.
“Empirical results show that private data leakage was reduced from 70% to under 2%, deletion-ofcalendar-entry attacks dropped from 45% to 0%, and even subtle upselling and coercive suggestions were nearly eradicated -all without impeding the assistant's ability to adapt and fulfill complex, interdependent goals.”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Abdelnabi et al., 2025
Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredIn their investigation of agentic LLM networks for travel planning, Abdelnabi et al. (2025) demonstrate that unconstrained conversational agents routinely leak sensitive user data and fall prey to subtle, multiturn attacks by external parties.
“In their investigation of agentic LLM networks for travel planning, (Abdelnabi et al., 2025) demonstrate that unconstrained conversational agents routinely leak sensitive user data and fall prey to subtle, multiturn attacks by external parties.”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Abdelnabi et al., 2025
Dynamic LLM firewalls aim to mediate agent interactions with data sources and other agents in real time.
“Emerging approaches such as dynamic LLM firewalls aim to mediate agent interactions with data sources and other agents in real time (Abdelnabi et al., 2025), with systems such as LlamaFirewall extending this paradigm (Meta, 2025).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Abdelnabi et al., 2025
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 16
- S. Abdelnabi, A. Gomaa, S. Sivaprasad, L. Schönherr, and M. Fritz. Cooperation, competition, and maliciousness: LLM-stakeholders interactive negotiation. In NeurIPS Datasets and Benchmarks Track, 2024.
- M. Balunovic, L. Beurer-Kellner, M. Fischer, and M. Vechev. AI Agents with Formal Security Guarantees. In ICML Next Generation of AI Safety Workshop, 2024.
- E. Debenedetti, J. Rando, D. Paleka, S. F. Florin, D. Albastroiu, N. Cohen, Y. Lemberg, R. Ghosh, R. Wen, A. Salem, et al. Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition. In NeurIPS Datasets and Benchmarks Track, 2024a.
- E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr. AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. In NeurIPS Datasets and Benchmarks Track, 2024b.
- E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr. Defeating prompt injections by design. arXiv, 2025.
- S. Ghalebikesabi, E. Bagdasaryan, R. Yi, I. Yona, I. Shumailov, A. Pappu, C. Shi, L. Weidinger, R. Stanforth, L. Berrada, et al. Operationalizing Contextual Integrity in Privacy-Conscious Assistants. arXiv, 2024.
- K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In AISec Workshop, 2023.
- P. Kairouz, S. Oh, and P. Viswanath. The composition theorem for differential privacy. In ICML, 2015.
- S. Marro, E. La Malfa, J. Wright, G. Li, N. Shadbolt, M. Wooldridge, and P. Torr. A scalable communication protocol for networks of large language models. arXiv, 2024.
- N. Mireshghallah, H. Kim, X. Zhou, Y. Tsvetkov, M. Sap, R. Shokri, and Y. Choi. Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory. In ICLR, 2024.
- F. Nestaas, E. Debenedetti, and F. Tramèr. Adversarial search engine optimization for large language models. In ICLR, 2025.
- Y. Ruan, H. Dong, A. Wang, S. Pitis, Y. Zhou, J. Ba, Y. Dubois, C. J. Maddison, and T. Hashimoto. Identifying the Risks of LM Agents with an LM-Emulated Sandbox. In ICLR, 2024.
- Y. Shao, T. Li, W. Shi, Y. Liu, and D. Yang. Privacylens: Evaluating privacy norm awareness of language models in action. In NeurIPS Datasets and Benchmarks Track, 2024.
- F. Wu, E. Cecchetti, and C. Xiao. System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective. arXiv, 2024.
- J. Xie, K. Zhang, J. Chen, T. Zhu, R. Lou, Y. Tian, Y. Xiao, and Y. Su. TravelPlanner: A Benchmark for Real-World Planning with Language Agents. In ICML, 2024.
- A. Zharmagambetov, C. Guo, I. Evtimov, M. Pavlova, R. Salakhutdinov, and K. Chaudhuri. AgentDAM: Privacy leakage evaluation for autonomous web agents. arXiv, 2025.
Cited by
Sorted by citations
Defeating Prompt Injections by Design
Debenedetti, E., Shumailov, I., Fan, T., Hayes, J., Carlini, N., Fabian, D., Kern, C., Shi, C., Terzis, A., & Tramèr, F. (2026) · 2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml68715.2026.00040 · Cited by 15 · see citing works
“Moreover, their labeling is coarser than ours and thus does not support policies that are as expressive as CaMeL ’s. Abdelnabi et al. [40] focus on agent-to-agent communications and use synthetic data to extract and define policies that agents can use to restrict data flow.”
Design Patterns for Securing LLM Agents against Prompt Injections
Beurer-Kellner, L., Buesser, B., Creţu, A.-M., Debenedetti, E., Dobos, D., Fabian, D., Fischer, M., Froelicher, D., Grosse, K., Naeff, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2506.08837 · Cited by 2 · see citing works
“…et al., 2024; Chen et al., 2024; Zverev et al., 2024; Willison, 2023a; Yi et al., 2023; Zou et al., 2024), to principled system-level isolation mechanisms (Bagdasarian et al., 2024; Balunovic et al., 2024; Abdelnabi et al., 2025b; Willison, 2023b; Wu et al., 2025; Debenedetti et al., 2025).”
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
“A recent effort introduces dynamic LLM firewalls in order to secure agent interactions with data sources and other agents (Abdelnabi et al., 2025).”
OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety
Vijayvargiya, S., Soni, A. B., Zhou, X., Wang, Z. Z., Dziri, N., Neubig, G., & Sap, M. (2025) · arXiv · doi:10.48550/arxiv.2507.06134
“Others advocate for active learning to prioritize rare risk cases [1], or explore how performance optimization can reduce safety margins [34].”
- Authors
- Abdelnabi, S., Gomaa, A., Bagdasarian, E., Kristensson, P. O., & Shokri, R.
- Affiliations
- University of Cambridge (GB)
- University of Massachusetts Amherst (US)
- National University of Singapore (SG)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2025
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2502.01822
- OpenAlex
- W4407184972
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Keywords
- LLM agents, agent communication, firewall architecture, privacy attacks, data abstraction, manipulation resistance, large language model security, user data protection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
