Zero Trust LLM Prompt Injection Guardrail

Low-latency security proxy blocking prompt injections, jailbreaks, and sensitive PII leaks in live AI conversational endpoints.

Intelligence Gap / The Problem

Exposing an LLM endpoint directly to user input means exposing it to prompt injection, jailbreak attempts, and requests that try to override the system prompt or trigger unauthorized tool calls. Filtering these with keyword blocklists is trivial to bypass and produces both false positives and false negatives.

Solution Architecture / Internal Flow

The Guardrail Enclave sits inline between the client and the foundation model. Every inbound prompt is scored against a bank of adversarial jailbreak heuristics before it’s allowed to reach the model, and outbound tool-call requests are checked against an allowlist of permitted actions for that session. Because the check has to run on every request without adding noticeable latency, the heuristics are designed to run as a single fast pass rather than a second LLM call.

Inbound prompt → heuristic scoring (14 adversarial patterns) → threat score
  → score below threshold: forward to LLM
  → score above threshold: block + log, return safe-refusal response
  → outbound tool calls checked against session allowlist before execution

Performance Matrix / Evaluation

Metric	Falconic Protocol	Baseline
Jailbreak Detection	99.9%	81.4%
Latency Overhead	8ms	45ms

Entropy Audit / Failure Analysis

Our first heuristic set flagged a meaningful number of legitimate prompts that merely discussed security topics (e.g. “how do I prevent prompt injection in my own app”) as attacks themselves. We separated “discussing an attack pattern” from “attempting an attack pattern” by weighting structural signals — instructions trying to override prior context — more heavily than keyword matches, which cut false positives substantially without loosening real jailbreak detection.

Communication Layer / Discussion

Peer Protocol Interface / Discus Integration Pending