Development of the SecurePromptTrace Algorithm for Detecting Prompt Injection, Data Exfiltration, and Tool Misuse in Generative Artificial Intelligence Systems with Comparative Evaluation Against Keyword Filters, Classifier-Based Defenses, and Static Access Controls

Abstract

Generative artificial intelligence systems increasingly operate as autonomous agents capable of retrieving external information, accessing confidential resources, invoking application programming interfaces, and executing consequential actions. These capabilities introduce substantial security risks because malicious instructions embedded in user prompts, retrieved documents, webpages, emails, tool outputs, or persistent memory may alter an agent’s intended behaviour. Conventional keyword filters, standalone prompt classifiers, and static access-control mechanisms provide limited protection against semantically obfuscated attacks, multi-stage data exfiltration, manipulated tool arguments, and attacks that remain within formally permitted privileges. This paper develops SecurePromptTrace, a novel runtime security algorithm for detecting and controlling prompt injection, sensitive-data exfiltration, and tool misuse in generative artificial intelligence systems. SecurePromptTrace constructs a Dynamic Prompt Provenance Graph that represents trusted instructions, untrusted content, model-generated plans, retrieved data, confidential variables, tool calls, tool arguments, and execution outcomes as provenance-labelled nodes and causal edges. A relation-aware graph attention network analyses instruction dependencies and identifies conflicts between the authenticated user objective and instructions originating from untrusted sources. The graph model is integrated with a DeBERTa-v3 semantic injection classifier, confidential-data taint propagation, cross-layer intent alignment, tool-capability compatibility analysis, and adaptive policy enforcement. A composite threat score combines semantic injection probability, provenance conflict, sensitive-data flow, tool-privilege mismatch, execution-sequence deviation, and predictive uncertainty. According to the calculated risk, the algorithm permits, sanitises, replans, isolates, requests approval for, or blocks an operation. The evaluation framework covers direct and indirect prompt injection, encoded and multilingual attacks, contextwindow attacks, memory poisoning, cross-tool exfiltration, parameter substitution, privilege chaining, and unauthorised tool execution. SecurePromptTrace is compared with Aho–Corasick keyword filtering, regular-expression filtering, a standalone DeBERTa-v3 classifier, PromptShield-style detection, role-based access control, attribute-based access control, and combined static guardrails. Performance is assessed using macro-F1 score, precision, recall, AUROC, AUPRC, attack success rate, data-exfiltration prevention rate, tool-misuse prevention rate, false-positive rate, task-utility retention, computational latency, and memory overhead. Comparative bar charts, ROC and precision–recall curves, confusion matrices, risk-score distributions, ablation graphs, and security–latency Pareto plots are used to demonstrate performance differences. The central hypothesis is that provenance-aware semantic and behavioural tracing will produce significantly lower attack-success and exfiltration rates than content-only or permission-only defenses while preserving legitimate task completion. Statistical superiority will be established through confidence intervals, McNemar tests, bootstrap comparisons, and effect-size analysis.