@inproceedings{mou-etal-2026-toolsafe,
    title = "{T}ool{S}afe: Enhancing Tool Invocation Safety of {LLM}-based agents via Proactive Step-level Guardrail and Feedback",
    author = "Mou, Yutao  and
      Xue, Zhangchi  and
      Li, Lijun  and
      Liu, Peiyang  and
      Zhang, Shikun  and
      Ye, Wei  and
      Shao, Jing",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.findings-acl.1850/",
    pages = "37125--37153",
    ISBN = "979-8-89176-395-1",
    abstract = "While LLM-based agents can interact with environments via invoking external tools, their expanded capabilities also amplify security risks. Monitoring step-level tool invocation behaviors in real time and proactively intervening before unsafe execution is critical for agent deployment, yet remains underexplored. In this work, we first construct \textbf{TS-Bench}, a novel benchmark for step-level tool invocation safety detection in LLM agents. We then develop a guardrail model, \textbf{TS-Guard}, using multi-task reinforcement learning. The model proactively detects unsafe tool invocation actions before execution by reasoning over the interaction history. It assesses request harmfulness and action{--}attack correlations, producing interpretable and generalizable safety judgments and feedback. Furthermore, We introduce \textbf{TS-Flow}, a guardrail-feedback-driven reasoning framework for LLM agents, which reduces harmful tool invocations of ReAct-style agents by 65{\%} on average and improves benign task completion by approximately 10{\%} under prompt injection attacks."
}