Tool-Use Injection.

Attacks that manipulate an LLM agent's tool-calling layer — forging tool arguments, smuggling instructions through tool outputs, or coaxing the model into calling unsanctioned tools. 它属于网络安全的 AI 与机器学习安全 分类。

Attacks that manipulate an LLM agent's tool-calling layer — forging tool arguments, smuggling instructions through tool outputs, or coaxing the model into calling unsanctioned tools.

Tool-use injection is the umbrella term for prompt-injection-style attacks that target function calling rather than the model's user-facing reply. Three concrete flavors recur. First, argument injection: untrusted input in the prompt steers the model into emitting tool arguments — file paths, SQL strings, recipient addresses — that perform a different action than the user intended. Second, return-value injection: the output of one tool (e.g. a web fetch) contains hidden instructions that influence the next tool call, a form of indirect prompt injection. Third, tool-choice manipulation: an attacker coerces the agent into selecting a high-privilege tool ('delete_user') when a lower-privilege one was appropriate, or invokes a tool the operator did not advertise to that user. Defenses include strict JSON-schema validation of tool arguments, structured separation between developer prompts, user input, and tool outputs (provenance tags), explicit allow-lists per session, human approval for high-impact tools, and treating any tool whose output enters the context window as an untrusted message source.

针对 Tool-Use Injection 的防御通常结合技术控制与运营实践,详见上方完整定义。

常见的别称包括: Function-call injection, Tool poisoning。