A Formal Framework of Architectural Intent Collapse for Tool-Level Attacks on LLM Agents
Tool-level attacks on Large Language Model (LLM) agents—poisoned tool descriptions, prompt injection, and capability misrepresentation—are universally effective, yet no existing defense provides comprehensive protection. We propose Architectural Intent Collapse (AIC), a formal framework capturing the systematic loss of communicative intent when text from heterogeneous sources is flattened into a single context window. Grounded as a novel instantiation of the Confused Deputy Problem, AIC reveals that the missing boundary is not permission but intent: the architecture cannot distinguish descriptive statements from prescriptive commands. We formalize AIC via an architectural collapse operator, introduce Intent Separation Degree (ISD) as a measurable metric, and develop a mechanism-based taxonomy of five intent-disguise attack types, including two previously undescribed (Conditional Latency and Inference Inducement). Experiments across 25 framework–model combinations (employing GPT-4o, Claude-4-Sonnet, Gemini-2.5-Pro, DeepSeek-V3, and Qwen3-32B as LLM backends) confirm that ISD degrades with description verbosity, strongly predicts defense effectiveness (r=−0.97), and is uniformly low across all current frameworks. Three root-cause defense principles are derived; one retains substantial protection against adaptive attackers. This research is useful for agent framework designers, security practitioners, and researchers seeking a principled understanding of why tool-level attacks succeed and how architectural defenses can address their root cause.