Overview
This protocol outlines a defense-in-depth strategy for agentic AI architectures, shifting focus from network security to ‘Semantic Security’ to prevent indirect prompt injection. It introduces the Dual-LLM ‘Filter Funnel,’ randomized data delimiters, and ‘Spycraft’ handoff protocols to maintain epistemic integrity and prevent cognitive manipulation.
Hypothesis
In agentic architectures where LLMs execute code and process untrusted data, traditional cybersecurity (network/access control) is insufficient. The threat model has shifted to indirect prompt injection and cognitive offloading. Defending against these threats requires treating logic as a secured asset and enforcing a “Zero-Trust” policy for intelligence itself.
Approach
Dual-LLM Architecture (Filter Funnel): Decouples data ingestion from reasoning:
- Tier 1 — The Sanitizer: Small local model (~7B on M4 Pro) with zero privileges (no API access, no file write). Ingests raw, potentially poisoned text and transforms it into structured neutral JSON, stripping intent-carrying instructions.
- Tier 2 — The Processor: Primary reasoning engine that never sees raw external tokens. Consumes only sanitized JSON, neutralizing semantic breakout risk.
Randomized Delimiters: For every request, generate a unique 16-character token (e.g., TOKEN_x9z7q2 wrapped in double-bracket delimiters). Untrusted data wrapped in dynamic tokens with system prompt instructions to treat enclosed content as informational only. Attackers cannot break out because they cannot guess the closing token.
Semantic Handshakes (Spycraft Layer): Agent Parole system — when handing off between agents, the system issues context-specific challenges requiring pre-arranged responses derived from reading the active state file. Failure blocks execution immediately. Honeytoken logging provides passive intrusion detection via sign/countersign in service logs.
Epistemic Integrity (Feynman Audit): The Stubborn Student adversarial auditor refuses jargon and forces simple analogies. The Composite Deviation Score (CDS) auto-degrades confidence when AI predictions violate expected outcome envelopes.
Key Findings
- The Dual-LLM pattern is the most effective architectural defense against indirect prompt injection because it structurally separates ingestion from reasoning.
- Randomized delimiters solve the predictability vulnerability of static XML/JSON wrappers.
- Semantic handshakes address a gap traditional authentication cannot cover: verifying that an agent has actually read and understood its operational context.
- Honeytoken logging provides passive intrusion detection independent of active monitoring.
Next Steps
- Implement Dual-LLM sanitization pipeline on the M4 Pro.
- Deploy randomized delimiter wrapping for all external data ingestion.
- Define Agent Parole protocol for inter-agent handoffs.
Related
- mcp-security — the broader MCP security architecture this defense layer protects
- jp-loop-recursive-intelligence — shares the Stubborn Student persona and Feynman auditing
- iron-cloud-architecture — the Iron Cloud infrastructure where these defenses deploy
- organizational-dynamic-programming — ODP knowledge capture applied to security learnings