A Privacy-Preserving Middleware Architecture for Detecting Prompt Injection and Sensitive Data Exposure in Large-Language-Model Interactions

Abstract

The deployment of large language models (LLMs) in real-world applications introduces a compounding security problem: detecting adversarial inputs such as prompt injection and jailbreak-driven data leakage while simultaneously preventing the detection mechanism itself from becoming a source of data exposure. Existing approaches address either detection effectiveness or privacy preservation, but rarely both in a unified, deployable architecture. This paper proposes and evaluates a privacy-preserving hybrid middleware architecture that enforces a local trust boundary as its primary design constraint. The architecture combines deterministic rule-based screening, a fine-tuned small language model (SLM) operating entirely within the local processing environment, and a sensitivity-aware routing mechanism that invokes external LLM reasoning only for prompts all local components have assessed as non-sensitive. Evaluation on a 120-prompt benchmark spanning benign, jailbreak, and sensitive categories (including 20 hard negatives constructed to be lexically adjacent to genuine secrets) shows that the routed architecture attains 95.83% accuracy with complete recall, retaining 95% of sensitive prompts within the local boundary, at the cost of a 12.5% false-positive rate. Comparison against two published detectors reveals a systematic asymmetry: an injection-specific classifier reaches 82.5% recall on jailbreak prompts but 25% on sensitive ones, while a content-safety model inverts that profile, confirming empirically that the two risks are addressed separately by current tooling. The framework is model-agnostic, requires no retraining of the underlying LLM, and is compatible with black-box API deployments. The evaluation dataset and fine-tuned model are released publicly.