Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering

Hussein Jawad, Nicolas J-B Brunel

Abstract

Large Language Model (LLM) agents increasingly use external tools for complex tasks and rely on embedding-based retrieval to select a small top-k subset for reasoning. As these systems scale, the robustness of this retrieval stage is underexplored, even though prior work has examined attacks on tool selection. This paper introduces ToolFlood, a retrieval-layer attack on tool-augmented LLM agents. Rather than altering which tool is chosen after retrieval, ToolFlood overwhelms retrieval itself by injecting a few attacker-controlled tools whose metadata is carefully placed by exploiting the geometry of embedding space. These tools semantically span many user queries, dominate the top-k results, and push all benign tools out of the agent's context. ToolFlood uses a two-phase adversarial tool generation strategy. It first samples subsets of target queries and uses an LLM to iteratively generate diverse tool names and descriptions. It then runs an iterative greedy selection that chooses tools maximizing coverage of remaining queries in embedding space under a cosine-distance threshold, stopping when all queries are covered or a budget is reached. We provide theoretical analysis of retrieval saturation and show on standard benchmarks that ToolFlood achieves up to a 95% attack success rate with a low injection rate (1% in ToolBench). The code will be made publicly available at the following link: https://github.com/as1-prog/ToolFlood

ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering

Abstract

Large Language Model (LLM) agents increasingly use external tools for complex tasks and rely on embedding-based retrieval to select a small top-k subset for reasoning. As these systems scale, the robustness of this retrieval stage is underexplored, even though prior work has examined attacks on tool selection. This paper introduces ToolFlood, a retrieval-layer attack on tool-augmented LLM agents. Rather than altering which tool is chosen after retrieval, ToolFlood overwhelms retrieval itself by injecting a few attacker-controlled tools whose metadata is carefully placed by exploiting the geometry of embedding space. These tools semantically span many user queries, dominate the top-k results, and push all benign tools out of the agent's context. ToolFlood uses a two-phase adversarial tool generation strategy. It first samples subsets of target queries and uses an LLM to iteratively generate diverse tool names and descriptions. It then runs an iterative greedy selection that chooses tools maximizing coverage of remaining queries in embedding space under a cosine-distance threshold, stopping when all queries are covered or a budget is reached. We provide theoretical analysis of retrieval saturation and show on standard benchmarks that ToolFlood achieves up to a 95% attack success rate with a low injection rate (1% in ToolBench). The code will be made publicly available at the following link: https://github.com/as1-prog/ToolFlood
Paper Structure (67 sections, 2 theorems, 22 equations, 1 figure, 6 tables, 3 algorithms)

This paper contains 67 sections, 2 theorems, 22 equations, 1 figure, 6 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Scaling Agentic Systems Through Tool Retrieval
  3. Top-k Domination as a Retrieval-Layer Security Boundary
  4. ToolFlood: Saturating Top-$k$ Retrieval with Sybil Swarms
  5. Contributions
  6. Related Work
  7. Agent Design Patterns and Tool Ecosystems
  8. Tool-Specific Attacks
  9. Corpus Poisoning and Retrieval Security
  10. Sybil Attacks.
  11. Formalization
  12. Agent pipeline
  13. Tool catalog.
  14. Retrieval.
  15. Tool selection and arguments.
  16. ...and 52 more sections

Key Result

Theorem 4.1

Let $\mathcal{P}_I$ be the Phase 1 candidate pool after $I$ iterations, and define $N(q,\mathcal{P}_I) \;=\; \sum_{m \in \mathcal{P}_{I}} \operatorname{Cover}^{\delta}(q,m).$ Then:

Figures (1)

  • Figure 1: ASR vs. injection budget (B level) per task on ToolBench (test split). Higher B increases top-k domination opportunities, yielding higher ASR (retrieval: text-embedding-3-small, selector LLM: GPT-4o-mini).

Theorems & Definitions (3)

  • Theorem 4.1: Phase 1 Multi-Cover Convergence
  • Theorem 3.1: Phase 1 Multi-Cover Convergence
  • proof