🛡️ Arquitectura de Defensa para Agentes de IA: Cómo asegurar tus LLMs contra Prompt Injection, Tool-Poisoning y Fugitividad.

Defending Autonomous Agents and LLMs Against Prompt Injection, Tool Poisoning, and Evasion: A Four-Layered Security Framework

In today's autonomous agent and server market, security is a significant challenge. We are building systems that run code, access databases, and make critical decisions based on text outputs that are inherently manipulable. Deploying agents in production without proper safeguards leaves them completely unprotected.

The author has developed a deep defense framework with four critical layers to address these vulnerabilities. The framework is not just theoretical; it consists of deterministic and dynamic sensors ready for production use.

**Layer 1: Input Sanitization and Stimulus Control (Ingress)**

The attack begins before the model processes a token. Intercepting malicious vectors in text and visual media is necessary. The components are:

- hermes-shield: An anti-prompt injection input sanitizer operating in five sequential layers to neutralize hostile instructions.

- vision-injection-guard: A deterministic sensor designed for vision-language models to detect visually injected malicious text before the language model interprets it.

- corpus-scrub: A data leak prevention tool that automatically detects and redacts Personally Identifiable Information (PII) and secrets from training or fine-tuning datasets.

**Layer 2: Physical Control and Validation Gateway (Gateway & Sandbox)**

Once the agent is active, it cannot communicate directly with the outside world without a proxy that validates its intentions. The components are:

- ai-guard-gateway: A professional security gateway for exposed endpoints implementing rate limiting, real-time PII redaction, injection detection, and OPA (Open Policy Agent) policies.

- seblight: A sovereign execution broker using cryptographically sovereign certificates to authorize the execution of critical commands issued by autonomous agents.

- Misdirection Proxy: A strategic diversion that reduces the success rate of ASR (Audio Speech Recognition) attacks from 20% to a range of 0-2%, returning simulated responses that confuse attackers.

**Layer 3: Runtime Monitoring (Runtime Sensors)**

Multi-step agents require continuous evaluation between each tool call. The components are:

- agent-shield-runtime: A deployment hook intercepting each agent's tool calls, dynamically evaluating them against five key sensors:

- scope-lib: Evaluates task scope against three strict criteria.

- adi-shield: Detects injection in five dynamic vectors.

- wallet-guard: Financial guardrails and budget loops.

- goal-anchor: Verifies the integrity of the original user goal.

- trajectory-sentinel: Correlates defense signals throughout the session.

- cross-session-memory-guard: A read-only sensor monitoring memory exfiltration between sessions in multi-tenant environments.

**Layer 4: Tool and Data Ecosystem Defense (MCP & Supply Chain)**

Agents are only as secure as the tools they are allowed to use. Supply chain poisoning is the new attack vector. The components are:

- mcp-schema-sentinel: A sentinel that mitigates tool-poisoning or rug-pulls in server MCPs, alerting with deterministic hashing if a trusted tool's description or schema changes silently at runtime.

- skill-auditor: An audit tool for agent skill collections, classifying each skill in natural language and searching for broken references or hardcoded secrets.

Scientific Validation and Post-Hoc Approach

No security architecture is complete without calibrated trust metrics. This framework includes advanced validation layers such as dock-confidence and flood-confidence, applying Conformal Prediction and post-hoc estimations to ensure models operate within mathematically rigorous uncertainty ranges, avoiding statistical illusions.

Join the Resilience Open Source Community

All components of this ecosystem are built under open-source licenses with a CPU-only focus, optimized for local execution without relying on expensive GPU infrastructures. If you are deploying autonomous agents, the era of naivety has ended. Protect your stack.