Graduate research in progress
Prompt injection in cloud-deployed LLM applications
I am studying how layered safeguards can protect cloud-deployed LLM applications while keeping them responsive. The project asks how to measure defensive effectiveness and latency together, so a safeguard can be judged against the constraints of a real application.
Research question
How vulnerable are cloud-deployed LLM applications to prompt injection, and which defense-in-depth strategies reduce attack success with minimal performance overhead?
Motivation
LLM features are moving from demos into production services that read email, documents, and web pages. Any of that text can carry instructions the application never intended to follow.
Most defenses are evaluated on whether they stop an attack. In a deployed service, a defense that adds noticeable latency or blocks legitimate requests also has a cost. I want both sides of that tradeoff on the same chart.
Defense in depth
Candidate layers I plan to compare, alone and stacked:
- Layer 1Input screeningDetect or neutralize suspicious instructions before they reach the model.
- Layer 2Prompt structureSeparate trusted instructions from untrusted content.
- Layer 3Output checksValidate what the model returns before the application acts on it.
- Layer 4Least privilegeLimit which tools and data a model-driven step can reach.
Planned evaluation
Defensive effectiveness
How often an injection attempt still succeeds with each layer, alone and combined.
Latency overhead
Added response time per layer, measured under a cloud deployment.
Effect on legitimate use
How often normal requests are blocked or degraded.
Status
Findings will appear here once they are reviewed. Until then, this page describes the question and the planned evaluation.