Generative AI Security · Zero-Trust

Multi-Modal Prompt Injection Defense Gateway

A zero-trust inline security proxy that sits between untrusted input and foundation models — isolating instructions from data, tracking conversational drift over time, and sanitising hostile signals hidden in images and audio, all with no model retraining.

<4.1%

Direct injection ASR

~42 ms

Text preprocessing

4-layer

Defense pipeline

<2.3%

False positive rate

Python 3.10+ / FastAPI · Sentence-Transformers + FAISS · OpenCV / Tesseract / Librosa · Redis · LiteLLM

01Overview & Executive Summary
02Why This Project
03Zero-Trust Proxy Architecture
04IFS-R Module
05SWCSA Module
06Multimodal Preprocessing
07Active Overwriting Engine
08Key Features
09Data Pipeline & Schema
10API Endpoints
11Attack Taxonomy
12Testing Strategy
13Design Decisions & Trade-offs
14Performance & Evaluation

Overview & Executive Summary

MPI-DG is an inline, multi-stage, zero-trust security proxy that intercepts requests before they reach a foundation model and validates responses before egress. It defends against direct, indirect, multi-turn, and multimodal prompt injection without retraining the underlying LLM or MLLM.

Primary focus	Zero-trust inline security proxy against direct, indirect, multi-turn, and multimodal prompt injection
Target models	LLMs & MLLMs — GPT-4o, Gemini, Mistral, LLaVA, SpeechGPT
Core innovations	IFS-R structured-query isolation · SWCSA temporal risk & agent-drift tracking · multimodal frequency-domain / OCR sanitization · Active Overwriting via dynamic suffix optimisation
Theoretical grounding	StruQ (USENIX Security '25), Temporal Context Awareness ('25), Agent Drift ('26), SecAlign (Meta / UC Berkeley '25), Mind-Mapping Visual Injection (MDPI '25), Audio Jailbreaks (IEEE '25)

Why This Project

The generative-AI security paradox — LLMs are trained to follow natural-language instructions flexibly, so they cannot intrinsically distinguish legitimate developer system instructions from untrusted user-supplied data payloads.
Traditional boundary defenses fail — keyword blocklists, naive prompt wrapping, and regex all break against semantic paraphrasing, multilingual jailbreaks, adversarial suffix optimisation (GCG), and multi-turn manipulation.
The threat horizon is multimodal — malicious commands now hide inside mind-maps, flowcharts, and steganographic noise that trigger during image parsing, and inside token-level adversarial audio perturbations that hijack speech-to-token encoders without alerting a human listener.
Enterprise imperatives — safe agent deployment requires preventing unauthorised tool calling, prompt leakage, and data exfiltration without touching foundation-model weights.

Zero-Trust Proxy Architecture

The gateway functions as an inline, multi-stage, zero-trust security proxy. Input of any modality is normalised, isolated into a structured envelope, scored for temporal risk, optionally overwritten with a defensive suffix, dispatched to the model, and finally checked for leakage before egress.

Figure 1 — Four-layer inline pipeline. Accent boxes are the two core defense engines (IFS-R, SWCSA) and the Active Overwrite branch. Every request is validated on the way in and every response on the way out.

IFS-R Module — Instruction-Feedback-Structure Sanitization

Theoretical foundation: StruQ: Defending Against Prompt Injection with Structured Queries (USENIX Security 2025).

Mechanism

Transforms unstructured prompt payloads into strict schema envelopes using cryptographically random nonce delimiters: <data_slot id="uuid_nonce">…</data_slot>.
Employs Structured Instruction Tuning (SIT) syntax to mathematically isolate user data from executable control logic.
Neutralises prompt-escape sequences (</system>, \n\nAssistant:) by escaping delimiter collisions at the boundary.

Why dynamic nonces

Static delimiters like """ or ### are trivially guessed and escaped by an adversarial prompt. A fresh per-turn nonce tag makes tag collision mathematically infeasible for the attacker.

SWCSA Module — Sliding Window Context Semantic Analysis

Theoretical foundation: Temporal Context Awareness (2025) and Agent Drift: Quantifying Behavioral Degradation (arXiv:2601.04170).

SWCSA maintains an in-memory sliding window of the last K conversation turns per session and halts multi-turn "crescendo" attacks that split malicious intent into individually benign prompts.

Agent Stability Index (ASI)

ASI_t = cos ( E⃗_{system_intent}, E⃗_{turn_context} ) cosine similarity between the system-intent embedding and the current turn's context embedding — a falling ASI signals semantic degradation

Exponentially decaying cumulative risk

Rₜ = α · R_t−1 + (1 − α) · ThreatScore(Turn_t) accumulates threat across turns so a slow "salami-slicing" jailbreak still crosses the cutoff

Multimodal Preprocessing & Frequency Filter Layer

Theoretical foundation: Mind Mapping Prompt Injection (MDPI Electronics 2025) and Audio Jailbreak Attacks in SpeechGPT (IEEE 2025).

Vision defense

Bilateral spatial filtering and normalisation to eliminate high-frequency adversarial perturbations.
OCR node parsing to detect and strip covert prompt injections inside diagrams, flowcharts, and mind-maps.
Adaptive thresholding, morphological noise removal, and hierarchical node-graph parsing against faint-colour and branch-node evasion.

Acoustic defense

Frequency-domain bandpass filtering (Butterworth) to strip ultrasonic / sub-audible adversarial trigger signals.
Speech-to-token boundary checks targeting speech-to-token encoders such as SpeechGPT.

Active Overwriting & Dynamic Policy Enforcement

Theoretical foundation: SecAlign (Meta / UC Berkeley 2025) and Automatic System Prompt Engineering (2025).

K-Means clustering on the prompt representation space classifies attack-intent type.
When borderline risk is identified, an optimised defensive suffix is injected dynamically into the system context — forcing the model to adhere to safety alignments without rejecting benign queries.

Key Features

Tri-modal shielding

Unified defense covering text, images / diagrams, and audio input.

Zero retraining overhead

Portable proxy layer securing closed-source (GPT-4o, Claude, Gemini) and open-source (Llama 3, Mistral, LLaVA) models alike.

Temporal multi-turn defense

Active prevention of multi-step jailbreaks and conversational drift.

Resilient data isolation

IFS-R eliminates prompt confusion via dynamic cryptographic delimiter envelopes.

Bidirectional egress monitoring

Blocks system-prompt leakage, canary-token exfiltration, and SSRF via markdown rendering.

Sub-50 ms text latency

Optimised vector similarity, caching, and async pipelining.

Data Pipeline & Schema

Data-flow pipeline

[client request: text / image / audio]
        │
        ▼  Layer 1  input extraction
        ▼  Layer 2  modality normalization  → image denoise & OCR + audio filter
        ▼  Layer 3  IFS-R serialization     → structured delimiter wrapping
        ▼  Layer 4  SWCSA context scoring   → Redis sliding window + ASI calculation
        ▼  Layer 5  model proxy             → secured query dispatched to target LLM
        ▼  Layer 6  egress guard            → canary-token check & regex scrubbing
        ▼
[client response]

Gateway JSON schema — `GatewayInferencePayload`

{
  "session_id":  { "type": "string", "format": "uuid" },
  "turn_index":  { "type": "integer", "minimum": 1 },
  "input_payload": {
    "text":         { "type": "string" },
    "image_base64": { "type": ["string", "null"] },
    "audio_base64": { "type": ["string", "null"] }
  },
  "security_metadata": {
    "asi_stability_score":   { "type": "number", "minimum": 0.0, "maximum": 1.0 },
    "cumulative_risk_score": { "type": "number", "minimum": 0.0, "maximum": 100.0 },
    "detected_attack_vectors": { "type": "array", "items": { "type": "string" } }
  }
}

API Endpoints

Method	Endpoint	Description
`POST`	`/api/v1/secure/chat`	Main secure proxy for chat / completions → cleaned response + security telemetry
`POST`	`/api/v1/sanitize/multimodal`	Standalone preprocessing for image / audio → normalised transcript & cleaned image
`GET`	`/api/v1/session/{id}/drift`	Query the session's Agent Stability Index → rolling risk history, ASI score, turn logs
`POST`	`/api/v1/admin/rules/override`	Dynamically update defense thresholds and suffixes
`GET`	`/healthz`	Health check for gateway, Redis, and upstream models

Attack Taxonomy & Threat Vectors Covered

Figure 2 — Threat taxonomy. The gateway maps each branch to a defense: IFS-R for direct and indirect injection, SWCSA for multi-turn drift, and the preprocessing layer for multimodal vectors, with the egress guard covering leakage and exfiltration.

Direct injection (jailbreaking) — explicit adversarial commands attempting to bypass system safety constraints.
Indirect instruction injection — third-party data carrying stealth instructions that hijack downstream processing.
Multi-turn semantic drift — progressive conversational manipulation designed to bypass single-turn filters.
Visual diagram injection — instructions concealed inside diagram nodes and mind maps.
Acoustic token injection — subtle audio perturbations manipulating speech-to-token embeddings.
Egress leakage / exfiltration — attacks rendering images or markdown links to transmit system secrets externally.

Testing Strategy

Unit — tests/unit/

Delimiter-collision tests (malicious tag-closing neutralised by IFS-R); signal-processing tests (Butterworth cutoffs, bilateral filter noise reduction).

Integration — tests/integration/

Multi-turn state tests — session lifecycle, Redis TTL expiration, cumulative risk-score computation across consecutive turns.

Adversarial — direct

DAN, oppositional roleplay, cipher attacks, Base64 / Rot13 obfuscation.

Adversarial — multimodal & optimisation

Mind-map diagrams with embedded system overrides; token-level adversarial audio; Greedy Coordinate Gradient (GCG) suffix benchmarks.

Key Design Decisions & Trade-offs

Inline proxy vs fine-tuning

An inline gateway gives instant zero-downtime deployment, supports proprietary closed-source models, and allows immediate rule updates without GPU retraining cycles.

Cryptographic random delimiters

Per-turn nonce tags instead of static markers — static delimiters are guessed and escaped; dynamic nonces make collision mathematically impossible.

Rolling window vs full graph

Fixed-size sliding window (K = 5) with exponential risk decay keeps Redis memory and vector-calculation latency O(1) while staying sensitive to gradual drift.

Dual-threshold scoring

Low-to-medium risk queries are encapsulated in IFS-R rather than rejected, so technical queries (coding, security research) are not falsely blocked.

Challenges faced & engineering solutions

Challenge	Impact	Solution
Over-defense & false positives	Technical queries blocked falsely	Dual-threshold scoring — low/medium risk wrapped in IFS-R without rejection
Multimodal processing latency	OCR + acoustic filtering added > 350 ms	FAISS in-memory indexing, lightweight async OCR threads, PyMuPDF hardware-accelerated decode
Multi-turn "salami" attacks	Payloads split over many innocent messages	SWCSA module with Temporal Context Awareness and cumulative risk decay
OCR evasion via complex visuals	Adversarial text in faint colours / branch nodes	Adaptive thresholding, morphological noise removal, hierarchical node-graph parsing

Performance & Evaluation Metrics

ASR = Attack Success Rate. Lower is better for every row except throughput.
Metric / attack category	Baseline (no gateway)	With MPI-DG
Direct prompt injection ASR	84.2%	< 4.1%
Multi-turn temporal jailbreak ASR	76.5%	< 6.8%
Visual / mind-map indirect injection ASR	89.0%	< 7.5%
Audio token-level jailbreak ASR	89.0%	< 5.2%
Average preprocessing overhead	0 ms	~42 ms text / ~180 ms multimodal
False positive rate (benign benchmarks)	0%	< 2.3%

Tech stack

Gateway & API

Python 3.10+, FastAPI, Uvicorn, Pydantic v2, AsyncIO

Vectors & embeddings

Sentence-Transformers (all-MiniLM-L6-v2, bge-large-en-v1.5), FAISS index

Multimodal

OpenCV, Pillow, PyMuPDF, Tesseract / EasyOCR, Librosa, Torchaudio

Session state

Redis — stateful sliding-window contexts, TTL eviction

LLM proxy

LiteLLM, LangChain / LlamaIndex core interfaces

Testing

PyTest, Locust, GCG attack generator, PyRIT

Run it

docker run -d -p 6379:6379 --name redis-gateway redis:alpine
uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload

MPI-DG · Multi-Modal Prompt Injection Defense Gateway · Technical Report · 2026

Multi-Modal Prompt Injection Defense Gateway

Contents

Overview & Executive Summary

Why This Project

Zero-Trust Proxy Architecture

IFS-R Module — Instruction-Feedback-Structure Sanitization

Mechanism

SWCSA Module — Sliding Window Context Semantic Analysis

Agent Stability Index (ASI)

Exponentially decaying cumulative risk

Multimodal Preprocessing & Frequency Filter Layer

Active Overwriting & Dynamic Policy Enforcement

Key Features

Data Pipeline & Schema

Data-flow pipeline

Gateway JSON schema — GatewayInferencePayload

API Endpoints

Attack Taxonomy & Threat Vectors Covered

Testing Strategy

Key Design Decisions & Trade-offs

Challenges faced & engineering solutions

Performance & Evaluation Metrics

Tech stack

Run it

Gateway JSON schema — `GatewayInferencePayload`