DT-GenShield: A Digital Twin-Driven Runtime Security Architecture for Protecting Large Language Models Against Indirect Prompt Injection

IDE-Sanitizer: A Prompt-Injection Cryptographic Context Guard for IDE Copilots

The integration of Large Language Models (LLMs) into Integrated Development Environments (IDEs) introduces a critical vulnerability to indirect Prompt Injection Attacks (PIAs). State-of-the-art coding models, such as Qwen-2.5-Coder, often embed malicious payloads within project configuration rules, resulting in alarmingly high Attack Success Rates (ASR) that compromise local developer environments. To mitigate this threat, this paper proposes IDE-Sanitizer, a preventive, dualmodel defense framework that establishes a zero-trust execution boundary. By combining an HMAC-SHA256 cryptographic state verifier with an air-gapped semantic gate (Llama-3-8B), IDESanitizer decouples intent classification from code generation, preventing attackers from overriding system guardrails. Extensive evaluations across diverse programming frameworks demonstrate that our approach achieves strong robustness, which reduces the ASR to near 0.0% against severe sabotage and exfiltration vectors, while maintaining a near 0.0% False Positive Rate (FPR) on benign workflows. Furthermore, by preemptively blocking malicious payloads before they reach the core generator, IDE-Sanitizer avoids computationally expensive inference loops, reducing average generation latency on adversarial inputs by 89.6%. Ultimately, this architecture offers a secure, efficient, and scalable solution for safeguarding LLM-assisted development cycles.

Large Language Model Vulnerabilities

Real-Time Detection and Mitigation of Prompt Injection Attacks in LLM-Integrated Enterprise Systems

Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.

Balancing Security and Performance in LLM Agents: Spotlight-Guard, a Layered Defense Against Indirect Prompt Injection

Large Language Model (LLM)-based agents automate complex tasks by integrating external tools such as web browsers, e-mail clients, file readers, and APIs, but this same integration exposes them to indirect prompt injection (IPI) attacks, in which malicious instructions hidden in tool content hijack the agent. A central but often overlooked question is how defending against such attacks affects the LLM and its own task performance and computational efficiency. In this study, we design a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code (HMAC) into a single framework, and we evaluate it jointly along two axes: security and LLM performance. Experiments on locally hosted 7B-class open-weight models (Qwen-2.5-7B, Mistral-7B, and DeepSeek-Coder) use Attack Success Rate (ASR) for security and benign-task success rate together with confusion-matrix-based metrics (precision, recall, and F1) for task performance, all with bootstrap 95% confidence intervals. Across a stratified, fixed-seed benchmark of 250 adversarial and 250 benign cases per configuration, the full system reduces the ASR from 36.0% to 17.2% while preserving a 97.2% benign-task success rate and raising the detection F1 from 0.749 to 0.892, demonstrating that strong protection need not degrade the model’s task performance. A component ablation isolates each layer’s contribution, an adaptive-attack evaluation confirms a low ASR (6.7%) under attacks crafted to target the pipeline, and an analysis of computational cost (model invocations per request) quantifies the efficiency overhead, characterizing the security–performance trade-off of layered defenses on open-weight LLMs.

Automated Generation of Microservice Authorization Tests Using Large Language Models

Microservice architectures are inherently plagued by "authorization blindspots"–divergent security policies across independent services that create undetectable downstream security drifts. As systems evolve, these invisible vulnerabilities leave applications highly susceptible to privilege escalation and catastrophic data breaches. To eliminate these blindspots, we introduce a novel, fully automated framework that bridges the precision of formal static analysis with the adaptiveness of Generative AI. By extracting a policy-enriched Intermediate Representation of the microservice system, our approach deterministically guides GPT-5 to synthesize executable, downstream-aware policy test suites targeting specific policy inconsistencies. Evaluation on the Train-Ticket benchmark denotes that our method outperforms state-of-the-art tools such as EvoMaster and EvoSuite by generating 100% semantically valid authorization policy tests. Further, this research provides vital empirical validation for formal methods. By producing 97.4% error-free drift validation tests, our approach systematically neutralizes static analysis noise. Ultimately, these results establish a rigorous, highly effective pathway for hybridizing formal structures with Large Language Models to definitively verify complex, distributed authorization policies.

SecureMCP: Policy-Enforced Defense Against Prompt Injection in LLM-Generated SQL for AIoT Databases

The deployment of Large Language Model (LLM)-generated SQL in Artificial Intelligence of Things (AIoT) systems introduces critical security risks, as prompt injection attacks can manipulate LLMs into producing unauthorized queries that expose sensitive data or execute destructive operations. Existing Natural Language to SQL (NL2SQL) research targets query accuracy, while current Model Context Protocol (MCP) servers offer only SQL-level protection without fine-grained, role-based access control. This paper proposes SecureMCP, a policy-enforced framework that integrates Role-Based Access Control (RBAC) with an MCP server to establish multi-layer defense for LLM-generated SQL execution. Grounded in an explicit threat model, the framework chains five defense modules in a sequential fail-closed pipeline addressing six prompt injection types spanning four adversary goals. We evaluate SecureMCP on the IoT-SQL dataset using Qwen3-8B, reporting filter performance—false positive rate (FPR) and false negative rate (FNR)—separately from LLM generation quality. On benign queries, the framework maintains a low false positive rate (0.3–2.2%) across four RBAC roles while keeping execution accuracy among allowed queries within 65.1–76.4%, matching the unprotected baseline of 63.8% and confirming that the defenses act as a transparent pre-execution filter. On 2400 adversarial queries, SecureMCP limits the effective false negative rate—computed over realized threats in which the injection payload was actually incorporated—to 3.98%, and an ablation confirms that RBAC and MCP-level defenses are complementary, as neither blocks the full range of injection vectors alone. The 72.5% injection incorporation rate confirms high LLM susceptibility, establishing the necessity of external policy enforcement.