Evaluating Prompt Injection Risk and Guardrails in LLM-Enabled Home IoT Assistants

Abstract

Smart home virtual assistants are increasingly powered by large language models to enable information retrieval and home device actuation. As a result, intelligent home environments are becoming more exposed to untrusted inputs, increasing their susceptibility to prompt injection, role confusion, and indirect prompt injection through retrieved context. In this paper, we propose a layered architecture that separates LLM-driven intent interpretation from the authorization and safety enforcement mechanisms governing the managed environment. The architecture is developed and evaluated using an incremental hardening approach, in which a naive baseline system is progressively enhanced with authentication and role tagging, pre-LLM policy enforcement, context sanitization and prompt rewriting, and post-LLM action gating mechanisms. Early findings of a small scenario setting indicate that progressive layered enforcement largely diminishes potential risks whereas post-LLM gating inhibits more complex prompt-based threats even when the language model itself produces unsafe commands. The results are preliminary and are limited to four attack scenarios and one local LLM backend but the model can be generalized to more extensive policies of smart-homes and more complex jailbreak and multimodal attack cases.