Skip to content
Log in
Review Open access

Security Risk Assessment and Layered Protection Strategies for Large Language Model Banking Chatbots with Privacy Considerations

G. el-Tayeb Abdalilah Alhalangy
Jul 2026 · The Scholar Journal for Sciences & Technology · 0 citations

TL;DR

A prototype framework for an effective LLM API designed to mimic digital banking assistant responses and evaluate against synthesized and real-world banking dialogues is introduced and how the results dovetail with the growing regulatory landscape for AI in financial services is explored.

Abstract

Abstract But now, given the AI revolution and increased interest in bringing virtual agents and assistants to life banks too are testing LLM-powered AI agents that may assist customers, explain and customize products as well as simplify operational work done by bank employees in the background. But similar systems are susceptible to prompt injection, insecure output handling, and other LLM-specific threats that had only become more prevalent since these publications. Existing surveys and frameworks survey the generic security space of LLMs but do not propose reach an end-to-end, banking-specific threat model nor deployable defense architecture for assistants in line with systems from core into the edge. We also present a data-privacy-aware threat model and a learnable multi-layer defense framework for LLM-based banking assistants. We showcase a reference architecture for an omnichannel banking chatbots built using an instruction-tuned, medium-scale commercial LLM and also access to tools for accessing customer data, payments and knowledge bases. Assets, trust boundaries, adversary capabilities, and a banking-related threat taxonomy based on OWASP LLM guidance in combination with the NIST AI Risk Management Framework and recent sector-wide reports are defined. We then present a defense-in-depth framework with which we employ: governing inputs, prompt level controls, policy enforcement in the orchestration layer, safety guards at the tool-layer, structured output filtering along with response-risk scoring and constant monitoring and governance. We introduce a prototype framework for an effective LLM API designed to mimic digital banking assistant responses and evaluate against synthesized and real-world banking dialogues. This analysis will comprise 48 attack models based on the use of SMS injection techniques, leaking data or other misuses or abuses of authenticated tools. The framework decreases the overall success rates of attacks from 68–79% to between 14–24% across three common styles of attack, while introducing an average response time overhead of less than 11.8%, a modest increase in token consumption and maintaining false alarm rates below 7%. We, too, explore how the results dovetail with the growing regulatory landscape for AI in financial services and how banks can choose to tailor the framework according to their risk appetite and legacy infrastructure constraints Keywords:Artificial intelligence, machine learning, deep learning, natural language processing systems, data privacy, network security

DOI Semantic Scholar
Read PDF

Similar papers

Review Open access Aug 2026

Defensive Reverse Engineering of LLM Applications: A Black-Box Framework for Security Risk Scoring and Mitigation

D-RELLM is presented, a defensive reverse-engineering framework for black-box security assessment of deployed LLM applications that treats the deployed application as a socio-technical system whose risk depends on instruction hierarchy, retrieval trust, authorization, tool agency, output handling, monitoring, and operational controls.

Bhavesh B. Prajapati, Bhavya Shah · 0 citations
Conference Jul 2026

SecureContext EDU: An Open Source University Assistant using Dual - LLM Architecture

Chatbots powered by LLMs have become popular due to their scalability and instant reply feature. There can be many security issues associated with LLM-based chatbots, which emerge in the interaction between the LLM-based model and other software components. One major problem is that chatbots can be attacked using prompt injection, jailbreaks, and harmful queries. These attacks can change the chatbot behavior and may lead to wrong answers or leakage of sensitive information. This makes security very important in such systems. Existing methods improve the chatbot performance using techniques like modular design, Retrieval-Augmented Generation (RAG) and input filtering for security. However, most of these methods use a single model and do not have strong real-time protection, making them weak against advanced attacks. Hence, this work proposes a Dual-LLM architecture where security is handled as a separate component for protection against real time threats. A classification model is designed to check the user input queries using threat categories and a confidence score is evaluated to block the harmful inputs. Only safe queries are sent to the response model, which uses a controlled RAG system to generate accurate answers. The system is built as a step-by-step pipeline combining classification and response generation. The results show an accuracy of 90% in detecting threats which leads to reduction of unsafe responses.

G.Kavitha, Hishaam Ahamed M, Premnath R · 0 citations
Preprint Aug 2026

LMSM: LLM Security Framework Inspired by Linux Security Modules

This work presents Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving and gives advances in interpretability and model-internal analysis a common path to runtime enforcement.

Xiucheng Zhang, Bonan Ruan, Junfeng Fang et al. · 0 citations
Book Open access Aug 2026

The 2nd SeT-LLM Workshop on Secure and Trustworthy Large Language Models

The 2nd SeT-LLM Workshop on Secure and Trustworthy Large Language Models brings together researchers and practitioners from data mining, machine learning, security, and responsible AI to address issues from a data-centric, system-level perspective.

Lu Lin, Jinghui Chen, Ting Wang et al. · 0 citations

Layered security and trust mechanisms for GenAI applications in critical domains

This thesis proposes a unified two-layer approach to enhancing the trustworthiness and security of LLM-enabled systems and introduces the Adaptive LLM Threat Response (ALTR) framework, which integrates behavioral anomaly detection, context-aware prompt classification, and temporal threat memory to identify and mitigate adversarial interactions in real time.

Vani Seth · 0 citations
Conference Jul 2026

A Privacy-Respecting, Modular, Vendor-Neutral Natural-Language Interface for Operating Systems

This paper presents OS-NLI, a privacy-respecting and modular natural-language interface for operating-system tasks. Unlike vendor-bound assistants, OS-NLI separates intent interpretation from command execution through an architecture comprising a web interface, a retrieval-augmented generation (RAG) layer, an API, an encrypted datastore, and a local execution worker. The LLM is treated as an untrusted suggestion engine: only pre-approved command templates with validated parameters may be queued, and execution requires explicit user confirmation. Sensitive data are protected with TLS in transit and AES-GCM at rest, while the threat model explicitly excludes hosts that are fully compromised at runtime. A prototype was implemented across Windows 11 and Fedora Linux. Evaluation on 60 natural-language queries shows strong task performance for application and utility identification, median answer latency of 1.4 s, and median post-confirmation command-execution latency of 285 ms. Preliminary malicious-input checks indicate that non-allowlisted outputs are rejected before execution. The current prototype still relies on vendor-hosted components for the UI host and LLM, so it is not yet end-to-end auditable; however, the architecture isolates these dependencies and provides a practical migration path to self-hosted deployment. These results support the feasibility of a safer, auditable design for naturallanguage OS interaction.

David Lawrence, Xiaoli Huan · 0 citations