DEFENSE-IN-DEPTH FOR LARGE LANGUAGE MODELS: A MULTI-LAYER HYBRID ARCHITECTURE FOR PROMPT INJECTION DETECTION

Abstract

Large language models (LLMs) are now embedded in many digital systems, which has exposed a new and distinctive attack surface. The most pressing threat is the prompt injection attack, in which adversarial text causes a model to ignore its developer-defined instructions, leak its hidden system prompt, or perform unintended actions. This paper proposes a layered hybrid defense gateway that combines three complementary detectors: a fast prefilter based on lexical rules, a semantic classifier that uses word-level TF-IDF features together with a multilayer perceptron, and a character-level classifier that is robust to obfuscation. Their outputs are merged by a lightweight meta-decision block based on logistic regression. In a fully reproducible experiment, the detectors are trained on clean and standard obfuscated attacks and evaluated on held-out data that additionally contains unseen, newly phrased attacks and an unseen adaptive obfuscation style. On this controlled benchmark the proposed hybrid system reaches an F1 score of 0.989 and the lowest false-positive rate among all compared systems, clearly outperforming a brittle rule-based baseline (F1 = 0.504) and every single classifier across all attack categories. An ablation study confirms that each layer covers a distinct class of attacks, empirically supporting the defense-in-depth principle.