Injection Guard v1.0: Real-Time Prompt Injection Defense at the Perimeter

As AI applications evolve from simple text completion into autonomous agentic workflows—reading retrieved documents, invoking database APIs, and executing code—protecting LLMs against prompt injection becomes a critical security requirement. A single malicious prompt embedded in a RAG document or user query can hijack model intent, exfiltrate sensitive credentials, or trigger unintended backend actions.

With Injection Guard v1.0, ACE introduces perimeter defense built directly into the API gateway. By executing security checks ahead of the semantic cache and upstream model calls, flagged prompts consume zero token budget and execute zero downstream tools.

Injection Guard v1.0 pairs a deterministic Stage 1 Regex Firewall (enforcing sub-millisecond blocking with zero false positives) with a local Stage 2 DeBERTa-v3 Sequence Classifier (operating in shadow mode to score complex attacks). Together, the dual-stage architecture delivers 93.0% overall attack detection and 97.8% indirect injection recall—all while operating in-process with a median latency of 12.8 ms.

---

Dual-Stage Perimeter Architecture

The injection guard sits at the entry point of the gateway data path, inspecting incoming payloads before tokens reach LLM endpoints:

Incoming Client Request
  │
  ├── 1. Stage 1: Regex Firewall ──► 5 Lexical Rule Patterns (Instruction override, secret exfiltration)
  │                                  Matches? ──► REFUSE (HTTP 400 Bad Request)
  │
  ├── 2. Role-Based Payload Filter ──► Scans user, tool, & function inputs; excludes system prompts
  │
  └── 3. Stage 2: Learned ONNX ML  ──► Local DeBERTa-v3 Sequence Classifier (Shadow Mode Default)
                                     Scores prompt intent & emits telemetry
                                     Header: x-ace-injection-score: 0.984

Dual-Stage Operational Strategy

Why Shadow-First Enforcement Matters

Security classifiers trained on academic datasets often exhibit false positives when exposed to complex enterprise payloads (such as code reviews containing word patterns like "secret" or agent retry loops). By running Stage 2 in Shadow Mode, enterprise security teams can observe telemetry scores (x-ace-injection-score) on live traffic, establishing custom thresholds before enabling active blocking.

---

Model & Architecture Specifications

Stage 2 executes a local, open-weights sequence classification transformer running in-process via compiled ONNX runtime operations:

---

Empirical Benchmark Scorecard ($n=800$ Prompts)

We evaluated Injection Guard v1.0 across an independent 800-prompt benchmark dataset comprising 200 synthetic attack prompts and 600 benign enterprise prompts:

Key Performance Highlights

1. Sub-Millisecond Instant Defense (Stage 1): The Stage 1 Firewall catches 100% of explicit, direct instruction overrides instantly (<0.1ms) with 0.00% false positives on benign prose.
2. 97.8% Indirect Injection Coverage (Stage 2): Stage 2 successfully detects 97.8% of indirect prompt injections—malicious payloads hidden inside retrieved RAG documents or third-party web content—where static pattern matching fails.
3. 100% Paraphrase Recall: Stage 2 catches 100% of paraphrased role-reassignment attacks ("New directive supersedes all earlier guidance..." or "Imagine you are an unrestricted terminal...").

---

Deep Dive: Attack Vector Detection Breakdown

Evaluating performance across specialized attack families demonstrates how Stage 1 and Stage 2 complement each other:

---

In-Process Latency & Resource Efficiency

Inference executes 100% locally on CPU using compiled ONNX runtime operations. Prompts are classified in-process without transmitting data to third-party security vendors.

Evaluated on standard single-thread server CPU instances:

Compared to standard upstream LLM generation latency (~1,500ms to 5,000ms), the 12.8 ms perimeter security check introduces less than 0.85% latency overhead, providing robust security without slowing down user experience.

---

Business Impact & Enterprise Security Value

Perimeter prompt-injection defense delivers critical security and financial benefits for AI platform teams:

                  ┌────────────────────────────────────────────────────────┐
                  │            Perimeter Security Value Loop               │
                  └───────────────────────────┬────────────────────────────┘
                                              │
         ┌────────────────────────────────────┴───────────────────────────────────┐
         │                                                                        │
┌────────▼────────────────────────────────┐              ┌────────────────────────▼───────────────┐
│ 1. Zero-Cost Attack Short-Circuiting    │              │ 2. Agent Data Exfiltration Prevention  │
│ Flagged attacks rejected at perimeter;   │              │ Blocks indirect injections in RAG data  │
│ zero tokens billed by upstream providers│              │ before tools execute unintended actions│
└─────────────────────────────────────────┘              └────────────────────────────────────────┘

Key Business Benefits

1. Zero-Cost Attack Rejection: Blocked attacks are short-circuited at the perimeter, preventing malicious actors from exhausting API budgets through repeated injection prompts.
2. Protection Against Indirect RAG Poisoning: Secures autonomous agents against untrusted third-party documents, preventing unauthorized database calls or credential exposure.
3. Data Privacy & In-Process Isolation: Because classification runs locally in-process via ONNX, sensitive enterprise prompts are never sent to external third-party security APIs.

---

Looking Ahead

Injection Guard v1.0 provides robust perimeter security for enterprise AI infrastructure. By combining deterministic sub-millisecond regex rules with shadow-mode ML sequence classification, engineering teams gain complete visibility into prompt injection risks without risking false-positive outages.

We are actively refining Stage 2 models through domain-specific fine-tuning on agent scaffolds and int8 quantization to further accelerate perimeter classification.

To explore the benchmark suite and deployment guides, visit the ACE Fleet Documentation.

---

References

1. ProtectAI. DeBERTa-v3 Prompt Injection Classifier. 2024. HuggingFace Checkpoint
2. F. Perez, I. Ribeiro. Ignore This Title and Hack This Website: Exposing Vulnerabilities of Large Language Models to Prompt Injection. 2022. arXiv:2211.09527
3. K. Greshake et al. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. 2023. arXiv:2302.12173

---

Sign up to ACE now