What happened
A paper submitted 3 Nov 2026 defines 'parameter poisoning' as an indirect prompt injection variant that preserves the intended tool action but manipulates one or more task-critical tool arguments (recipient, path, amount), so no new action is triggered and action-focussed prompt-injection defenses miss it. Without defense the attack success rate reaches 93.06%. The paper introduces FactAuthBench for evaluation and proposes AuthorityFlow, a three-stage defense that builds a task-specific trust hierarchy over information fields, traces the information flow behind each tool argument, and accepts a value only when its source field is trusted for that parameter under the current task — reducing success to 9.03% while retaining 82.64% benign utility.
Why it matters
Action-level guards are structurally insufficient because the legitimate action is preserved; only the argument is corrupted. For a deployed agent, poisoning a tool argument (recipient, amount, path, destination) can redirect data exfiltration or cause a wrong-target side effect while evading existing indirect-prompt-injection detection. Defenders need argument-level trust reasoning, not just action monitoring.
Attack vector
Indirect prompt injection that keeps the intended tool call but substitutes attacker-chosen values into one or more task-critical arguments, so the agent performs the legitimate action with attacker-controlled parameters, evading action-level injection detection.
Affected systems
LLM agents using tool-calling; proposed defense AuthorityFlow; benchmark FactAuthBench.
Mitigation
Trace the information flow producing each tool argument and accept a value only when its source field is trusted for that parameter under the current task; deploy parameter-level (not just action-level) trust checks and human-in-the-loop approval for high-impact parameters.