Work

LLM Firewall Using Validator Agent for Prevention Against Prompt Injection Attacks

Year: 2025

Type: article

Abstract: Large Language Models with Retrieval-Augmented Generation are considered to be modern, chat-native interfaces to enterprise knowledge. However, deploying such systems safely requires precautions more advanced than input filtering. Numerous LLM-related security threats (including the top one: prompt injection attacks) demand robust defense mechanisms beyond input filtering. This paper extends our dual-agent RAG architecture as an LLM firewall with output-level security validation. Similar to network firewalls, which monitor semantic boundaries, we position the Validator Agent as a response firewall performing multi-feature security checks: prompt injection detection, policy compliance verification, sensitive information redaction, and toxic content filtering. While existing defense approaches focus mainly on input-level screening, our architecture proposes to analyze the output, where a successful attack becomes more obvious. The proposed architecture was verified to be viable using the Polish Bielik 2.3 LLM in an on-premise RAG system designed for energy auditing.

Source: Applied Sciences

DOI: 10.3390/app16010085

Authors: Michal Podpora, Marek Baranowski, Maciej Chopcian, Lukasz Kwasniewicz, Wojciech Radziewicz

Institutions: University of Opole, Opole University of Technology, Maria Curie-Skłodowska University

Language: English

Topic: Adversarial Robustness in Machine Learning

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,896

Funders: European Commission, European Regional Development Fund