TY  - JOUR
AU  - Saleem, Gulshan
AU  - Ahmed, Nisar
AU  - Zaman, Muhammad Imran
AU  - Hassan, Ali
AU  - Mujahid, Umar
PY  - 2026
DA  - 2026/09/25
TI  - A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
JO  - ICCK Transactions on Information Security and Cryptography
T2  - ICCK Transactions on Information Security and Cryptography
JF  - ICCK Transactions on Information Security and Cryptography
VL  - 2
IS  - 3
SP  - 192
EP  - 215
DO  - 10.62762/TISC.2026.712476
UR  - https://www.icck.org/article/abs/TISC.2026.712476
KW  - prompt injection detection
KW  - retrieval-augmented
KW  - generation
KW  - large language models
KW  - chatbot security
KW  - large language model guardrails
AB  - Prompt injection is ranked as the most critical vulnerability in large language model (LLM) deployments by the OWASP Top 10 for LLM Applications, yet existing defenses operate at isolated pipeline stages and remain incomplete. Input filters cannot inspect retrieved documents, while output monitors cannot prevent malicious payloads from reaching the model. Consequently, retrieval-augmented generation (RAG) chatbots remain vulnerable to indirect injection, where a poisoned knowledge-base document compromises every user whose query retrieves it. We present a three-layer framework that intercepts both direct and indirect prompt injection throughout the inference pipeline. Layer 1 screens user input using a rule-based pattern library and a fine-tuned semantic anomaly classifier. Layer 2 enforces a provenance-based instruction hierarchy during context assembly, preventing retrieved content from overriding operator policy. Layer 3 audits model output using a policy rule engine and semantic drift detector before delivery. A continuous audit loop aggregates structured logs and supports retraining to adapt the classifier to emerging attack patterns. The framework is target-model agnostic: it treats the protected LLM as a black box and deploys as middleware without modifying it, while relying on lightweight auxiliary models (a MiniLM sentence encoder and Llama Guard~2) for detection. Evaluation on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B - restricted to single-turn and non-adaptive attacks - shows that the framework reduces Attack Success Rate (ASR) from 71.4% to 11.3%, outperforming the best single-layer baseline by 27.3 percentage points and the evaluated NeMo Guardrails configuration by 23.8 percentage points, while maintaining a 4.8% false positive rate and a median latency overhead of 61.2 ms. Ablation studies show that all three layers contribute and that the full framework achieves a lower attack success rate than would be expected if the layers acted independently.
SN  - 3070-2429
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Saleem2026A,
  author = {Gulshan Saleem and Nisar Ahmed and Muhammad Imran Zaman and Ali Hassan and Umar Mujahid},
  title = {A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots},
  journal = {ICCK Transactions on Information Security and Cryptography},
  year = {2026},
  volume = {2},
  number = {3},
  pages = {192-215},
  doi = {10.62762/TISC.2026.712476},
  url = {https://www.icck.org/article/abs/TISC.2026.712476},
  abstract = {Prompt injection is ranked as the most critical vulnerability in large language model (LLM) deployments by the OWASP Top 10 for LLM Applications, yet existing defenses operate at isolated pipeline stages and remain incomplete. Input filters cannot inspect retrieved documents, while output monitors cannot prevent malicious payloads from reaching the model. Consequently, retrieval-augmented generation (RAG) chatbots remain vulnerable to indirect injection, where a poisoned knowledge-base document compromises every user whose query retrieves it. We present a three-layer framework that intercepts both direct and indirect prompt injection throughout the inference pipeline. Layer 1 screens user input using a rule-based pattern library and a fine-tuned semantic anomaly classifier. Layer 2 enforces a provenance-based instruction hierarchy during context assembly, preventing retrieved content from overriding operator policy. Layer 3 audits model output using a policy rule engine and semantic drift detector before delivery. A continuous audit loop aggregates structured logs and supports retraining to adapt the classifier to emerging attack patterns. The framework is target-model agnostic: it treats the protected LLM as a black box and deploys as middleware without modifying it, while relying on lightweight auxiliary models (a MiniLM sentence encoder and Llama Guard~2) for detection. Evaluation on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B - restricted to single-turn and non-adaptive attacks - shows that the framework reduces Attack Success Rate (ASR) from 71.4\% to 11.3\%, outperforming the best single-layer baseline by 27.3 percentage points and the evaluated NeMo Guardrails configuration by 23.8 percentage points, while maintaining a 4.8\% false positive rate and a median latency overhead of 61.2 ms. Ablation studies show that all three layers contribute and that the full framework achieves a lower attack success rate than would be expected if the layers acted independently.},
  keywords = {prompt injection detection, retrieval-augmented, generation, large language models, chatbot security, large language model guardrails},
  issn = {3070-2429},
  publisher = {Institute of Central Computation and Knowledge}
}