I built a 50-year-old security model for LLM agents. It caught things I didn't expect.

Security researcher Kelvra has developed a system to safeguard large language model (LLM) agents against prompt injection attacks. The model reads data, which includes instructions that can redirect its behavior, but it cannot distinguish between normal tokens and hidden instructions. Traditional information flow control, a concept developed 50 years ago, is the solution.

Kelvra allows developers to write a policy file that designates sources, sinks, and the few permitted crossings between them. This summary can now be seen by the support team, a human has reviewed it, and it carries a vouch for its authenticity. In Python, values carry these labels. Kelvra checks the flow before data leaves, ensuring that no under-labeling occurs, which could lead to data leaks.

The system analyzes the policy before any execution, identifying potential injection attacks before they happen, without actually running the model or transmitting any traffic. Every run produces an audit record, documenting what was read, what crossed, who consented, and what was refused. This system is not foolproof; it cannot see inside the model itself and relies on developers to ensure accurate labeling.

However, it provides a portable label vocabulary, a policy file that a non-programmer can understand, and an audit artifact for regulators. Kelvra's core is finished, with over 1200 tests and no dependencies, but it requires a framework adapter to be deployable. The researcher invites contributions, critiques, and collaborations to enhance the model.