Who Guards the Guard? Evaluating Deterministic, LLM-Based, and Hybrid Firewalls for Tool-Using Agents

Abstract

Tool-using large language model (LLM) agents process untrusted files, URLs, and tables at a boundary where data may be mistaken for instructions. This paper compares four interface-level conditions: no firewall, deterministic policy enforcement, an LLM-based Tool-Input Minimizer/Tool-Output Sanitizer, and a gated hybrid. The evaluation has two stages. The development microbenchmark contains 19 adversarial and 4 benign cases, 6 Groq-hosted guard backbones, 2 repetitions, and 1,104 executions. A second frozen-policy held-out study contains 42 unseen adversarial variants and 20 benign hard negatives. Its primary analysis uses four complete guard backbones, three repetitions for LLM-dependent conditions, and case-level aggregation. In the development set, the hybrid condition exhibited no successful attacks among 228 adversarial executions. This result did not generalize: on the held-out set, both the deterministic and hybrid conditions achieved a case-mean attack success rate (ASR) of 54.76%, because the hybrid router invoked the semantic guard in 0/744 executions. The LLMonly condition reached 50.60% case-mean ASR, 92.08% benign utility, and 33/744 structured-output failures under a fail-open policy. The results show that deterministic checks are suitable for explicit structural constraints, but composition alone is insufficient; hybrid security depends on routing coverage, guard availability, and evaluation against attacks not used in constructing the defense.