SecureMCP: Policy-Enforced Defense Against Prompt Injection in LLM-Generated SQL for AIoT Databases

DAC-SQL: A Controlled DSL as an Allowlist-Validatable Security Control Point for Deterministic Vertical-Domain NL2SQL

Balancing Security and Performance in LLM Agents: Spotlight-Guard, a Layered Defense Against Indirect Prompt Injection

Large Language Model (LLM)-based agents automate complex tasks by integrating external tools such as web browsers, e-mail clients, file readers, and APIs, but this same integration exposes them to indirect prompt injection (IPI) attacks, in which malicious instructions hidden in tool content hijack the agent. A central but often overlooked question is how defending against such attacks affects the LLM and its own task performance and computational efficiency. In this study, we design a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code (HMAC) into a single framework, and we evaluate it jointly along two axes: security and LLM performance. Experiments on locally hosted 7B-class open-weight models (Qwen-2.5-7B, Mistral-7B, and DeepSeek-Coder) use Attack Success Rate (ASR) for security and benign-task success rate together with confusion-matrix-based metrics (precision, recall, and F1) for task performance, all with bootstrap 95% confidence intervals. Across a stratified, fixed-seed benchmark of 250 adversarial and 250 benign cases per configuration, the full system reduces the ASR from 36.0% to 17.2% while preserving a 97.2% benign-task success rate and raising the detection F1 from 0.749 to 0.892, demonstrating that strong protection need not degrade the model’s task performance. A component ablation isolates each layer’s contribution, an adaptive-attack evaluation confirms a low ASR (6.7%) under attacks crafted to target the pipeline, and an analysis of computational cost (model invocations per request) quantifies the efficiency overhead, characterizing the security–performance trade-off of layered defenses on open-weight LLMs.

A comparative evaluation of large language models for detecting SQL injection vulnerabilities in web applications

Structured Query Language (SQL) injection is considered to be one of the most intractable and harmful threats to the security of web applications, as SQL injection is a technique that allows hackers to manipulate queries and steal confidential information. Even though traditional methods of defense have been used, emerging attack techniques continue to circumvent them, and it requires stronger mechanisms of detection. As the concept of Large Language Models (LLMs) has become prominent in the field of cybersecurity, the idea of assessing their capability to detect and address such threats in practical contexts is gaining more and more popularity. This article provides a comparative evaluation of five pre-trained LLMs on the capability of detecting SQL injection attacks. To induce more realistic conditions, a Flask-based web application that linked to an SQLite database was created, which was able to support both benign queries and SQL injection payloads using Boolean-based, Union-based, and Error-based methods. These models were put to the test in the zero-shot settings, and their performance was evaluated by accuracy, precision, recall, and F1-score. Findings indicate that Mixtral-8x7B-Instruct achieved the best results, with an average F1-score of 87.52% and an accuracy of 86.67%. The second-best performance was achieved by LLaMA-3-70B-Instruct, which demonstrated consistently high recall across all attack categories. Deep Seek and CodeLLaMA both performed well in some form of attacks, but not overall. In contrast, Qwen2.5-Coder-7B-Instruct produced the lowest average detection metrics among all evaluated models. These findings indicate that advanced LLMs are potentially promising to enhance the detection of SQL injection and complementary web application security.

CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?

Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, existing solutions typically suffer from an inherent trilemma, i.e., a constant trade-off among runtime efficiency, contextual precision, and adaptability. To bridge this gap, we propose Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware. CAITLYN integrates two systems. System I focuses on immediate defense against existing attacks using a two-tiered library: Tier-0 for rule-based detection scripts and Tier-1 for optimized LLM-based accurate inference. System II, in contrast, is deployed to monitor potential abnormal signals and attempt to synthesize new defenses. On standard benchmarks, CAITLYN matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines. On Emerging, our new delivery-aware benchmark featuring novel injection techniques, static baselines and the standalone System I configuration remain vulnerable. In contrast, System II autonomously synthesizes verified defense capabilities, substantially lowering the attack success rate across three diverse agent environments.

Development of the SecurePromptTrace Algorithm for Detecting Prompt Injection, Data Exfiltration, and Tool Misuse in Generative Artificial Intelligence Systems with Comparative Evaluation Against Keyword Filters, Classifier-Based Defenses, and Static Access Controls

Generative artificial intelligence systems increasingly operate as autonomous agents capable of retrieving external information, accessing confidential resources, invoking application programming interfaces, and executing consequential actions. These capabilities introduce substantial security risks because malicious instructions embedded in user prompts, retrieved documents, webpages, emails, tool outputs, or persistent memory may alter an agent’s intended behaviour. Conventional keyword filters, standalone prompt classifiers, and static access-control mechanisms provide limited protection against semantically obfuscated attacks, multi-stage data exfiltration, manipulated tool arguments, and attacks that remain within formally permitted privileges. This paper develops SecurePromptTrace, a novel runtime security algorithm for detecting and controlling prompt injection, sensitive-data exfiltration, and tool misuse in generative artificial intelligence systems. SecurePromptTrace constructs a Dynamic Prompt Provenance Graph that represents trusted instructions, untrusted content, model-generated plans, retrieved data, confidential variables, tool calls, tool arguments, and execution outcomes as provenance-labelled nodes and causal edges. A relation-aware graph attention network analyses instruction dependencies and identifies conflicts between the authenticated user objective and instructions originating from untrusted sources. The graph model is integrated with a DeBERTa-v3 semantic injection classifier, confidential-data taint propagation, cross-layer intent alignment, tool-capability compatibility analysis, and adaptive policy enforcement. A composite threat score combines semantic injection probability, provenance conflict, sensitive-data flow, tool-privilege mismatch, execution-sequence deviation, and predictive uncertainty. According to the calculated risk, the algorithm permits, sanitises, replans, isolates, requests approval for, or blocks an operation. The evaluation framework covers direct and indirect prompt injection, encoded and multilingual attacks, contextwindow attacks, memory poisoning, cross-tool exfiltration, parameter substitution, privilege chaining, and unauthorised tool execution. SecurePromptTrace is compared with Aho–Corasick keyword filtering, regular-expression filtering, a standalone DeBERTa-v3 classifier, PromptShield-style detection, role-based access control, attribute-based access control, and combined static guardrails. Performance is assessed using macro-F1 score, precision, recall, AUROC, AUPRC, attack success rate, data-exfiltration prevention rate, tool-misuse prevention rate, false-positive rate, task-utility retention, computational latency, and memory overhead. Comparative bar charts, ROC and precision–recall curves, confusion matrices, risk-score distributions, ablation graphs, and security–latency Pareto plots are used to demonstrate performance differences. The central hypothesis is that provenance-aware semantic and behavioural tracing will produce significantly lower attack-success and exfiltration rates than content-only or permission-only defenses while preserving legitimate task completion. Statistical superiority will be established through confidence intervals, McNemar tests, bootstrap comparisons, and effect-size analysis.

LMSM: LLM Security Framework Inspired by Linux Security Modules

This work presents Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving and gives advances in interpretability and model-internal analysis a common path to runtime enforcement.