Aug 2026· Al-Noor Journal of Engineering Management and Computer Science· 0 citations· 6 references
Abstract
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Large Language Models (LLMs) are increasingly integrated into Security Operations Center (SOC) workflows, where they support analysts in tasks such as the interpretation of system logs. However, the ability of LLMs to directly process untrusted textual input also introduces new attack surfaces. In particular, attackers can inject contextual information or explicit instructions into log entries in order to influence how malicious activity is interpreted by the model. Despite the growing adoption of LLMs for log analytics, the robustness of such systems against adversarial log injection remains largely unexplored. To address this gap, this paper presents a framework for evaluating prompt injection attacks against LLM-based log interpretation. Using log traces generated during real cyber attacks, our approach creates adversarial examples through generic injection generation, refinement, and attack-specific optimization. Our evaluation across multiple state-of-the-art LLMs shows that these injections can cause malicious log traces to be classified as benign despite containing clear indicators of compromise. As a potential remedy, we show that the explanations generated by the LLMs alongside their classifications frequently contain indicators of adversarial manipulation that can be leveraged to detect such attacks.
Max Landauer, Florian Skopik, Markus Wurzenberger et al.· 0 citations
Current language model deployments face growing security challenges from prompt-based attacks, including jailbreaks, direct and indirect prompt injection, and instruction hijacking, which often evade traditional rule-based safeguards. As these models are increasingly integrated into agent-based systems, retrieval pipelines, and tool-driven workflows, such attacks exploit their natural language interfaces to bypass safety constraints and manipulate system behavior, in some cases leading to data leakage or unauthorized actions. Recent research has proposed a wide range of defense mechanisms ranging from prompt-level filtering and model-level detection to pipeline wrappers and multi-agent protection frameworks. Many of these methods report strong results in controlled experiments, yet their effectiveness depends heavily on the assumed threat model, the datasets used, and the evaluation protocol. This paper presents a systematic review and structured descriptive synthesis of research on defenses against prompt-based attacks in language model and agent systems. By integrating and comparing findings across multiple studies, we identify major attack categories, commonly adopted defense strategies, deployment stages, and evaluation trends, while also highlighting limitations related to generalization, robustness, and real-world applicability. The analysis reveals trade-offs between security effectiveness, performance, and system complexity as well as major gaps in benchmarks, indirect attack coverage, and multi-agent evaluation. The systematic review concludes by outlining future research priorities, including pipeline-aware defense design, adaptive and layered protection mechanisms, and more realistic evaluation practices to support the development of robust and deployable prompt security solutions.
Sana Mourad, E. Abdallah, Mohammad Ababneh· Electronics· 0 citations
BERM is introduced, a lightweight framework that performs in-situ detection by modeling a host LLM’s internal representations extracted during prefill, adding negligible overhead and reducing incremental inference overhead to near-zero.
Large language models (LLMs) are now embedded in many digital systems, which has exposed a new and distinctive attack surface. The most pressing threat is the prompt injection attack, in which adversarial text causes a model to ignore its developer-defined instructions, leak its hidden system prompt, or perform unintended actions. This paper proposes a layered hybrid defense gateway that combines three complementary detectors: a fast prefilter based on lexical rules, a semantic classifier that uses word-level TF-IDF features together with a multilayer perceptron, and a character-level classifier that is robust to obfuscation. Their outputs are merged by a lightweight meta-decision block based on logistic regression. In a fully reproducible experiment, the detectors are trained on clean and standard obfuscated attacks and evaluated on held-out data that additionally contains unseen, newly phrased attacks and an unseen adaptive obfuscation style. On this controlled benchmark the proposed hybrid system reaches an F1 score of 0.989 and the lowest false-positive rate among all compared systems, clearly outperforming a brittle rule-based baseline (F1 = 0.504) and every single classifier across all attack categories. An ablation study confirms that each layer covers a distinct class of attacks, empirically supporting the defense-in-depth principle.
O. Esanov, Ch. Erkinova· 2022-yil 3-son (133/1) ANIQ...· 0 citations
Large Language and Vision-Language Models are increasingly deployed through inference pipelines that include prompt wrappers (e.g., templates and post-processing scripts) and configuration metadata (e.g., JSON/YAML files) that together shape model outputs. While model weights and binaries are routinely verified, these textual deployment artifacts remain weakly protected despite directly influencing runtime behavior. We show that a malicious developer can pair a benign-looking wrapper with crafted metadata to deterministically alter post-generation behavior without modifying model weights, training data, or inference backend. We study this behavior through a controlled conjunctive-gate implementation, where activation depends on both an embedded wrapper marker and cryptographically bound metadata. We evaluate the attack across fifteen open- and closed-source LLM/VLM deployments, and assess prompt and system level defenses including static metadata inspection, wrapper scanners, PromptShield, and SigStore-based artifact signing. To mitigate this risk, we introduce TIF-BAH, a lightweight middleware defense that verifies wrapper integrity and records behavioral attestations during inference. Our results reveal that wrapper-metadata interactions form an under-protected execution layer in modern AI deployments, exposing a deployment-time behavioral risk that is not captured by model-weight or prompt-level defenses. Code is available at https://github.com/N-H-Arif/llm_temp.
Nokimul Hasan Arif, Qian Lou, Meng Zheng· 0 citations
Large Language Models (LLMs) are increasingly deployed in security-critical applications but remain vulnerable to indirect prompt injection attacks that cannot be fully addressed by conventional prompt detection techniques. This paper proposes DT-GenShield, a Digital Twin-driven runtime security architecture that integrates semantic threat detection, operational state representation, policy-guided mediation, and runtime logging to protect LLM-based systems before model inference. The proposed architecture was evaluated using the LLMail-Inject, BIPIA, and LLM-PIEval benchmarks under matched baseline and DT-mediated execution. Experimental results across the LLMail-Inject, BIPIA, and LLM-PIEval benchmarks demonstrate consistent improvements in runtime protection under the evaluated experimental settings. On the LLMail-Inject benchmark, DT-GenShield reduced the Attack Success Rate (ASR) from 9.50% to 5.50%, corresponding to a relative reduction of 42.11%, while additional validation on the BIPIA benchmark confirmed effective suppression of malicious prompt propagation with minimal impact on legitimate requests. These findings demonstrate that Digital Twin-driven runtime mediation extends prompt injection defense beyond standalone detection and provides an effective architecture for securing LLM-based systems against emerging semantic attacks.
Alaa Alnemari, Mashael M. Alsulami· Electronics· 0 citations