- Security
- Agent platform
The LLM firewall: practical defenses against prompt injection and RAG poisoning
By Apolla delivery team3 min read
Key takeaway
The three main attack surfaces for enterprise Agents are prompt injection, RAG knowledge base poisoning and system prompt leakage. Effective defense needs three layers: an LLM firewall on the input side that detects and blocks in real time, allowlists and parameter validation for tool calls, and content moderation on the output side, plus source verification on every write to the RAG knowledge base. A four-component data protection architecture (PII redaction, synthetic data substitution, external intent processing and response reassembly) lets a cloud model handle sensitive business without ever touching real data.
Typical attack surfaces
- Direct prompt attacks: injecting hallucinations or reverse prompting to make the model ignore its system instructions
- Third-party poisoning: writing documents with malicious instructions into the RAG knowledge base, or tampering with tool results
- System prompt leakage: coaxing the model into printing its system prompt, exposing business rules and tool definitions
- External data exchange: requests carrying sensitive customer information to a cloud model
- Knowledge base compromise: unauthorized access, theft and tampering
Layer one: the input-side firewall
Detect before user input reaches the model: rules and classifier models identify injection patterns (role-play coaxing, instruction override, encoding tricks), and a hit is blocked and logged. Run the same detection on passages retrieved by RAG, because instructions in a poisoned document enter the context through retrieval results.
Layer two: tool call guardrails
Tool calls are the channel through which an injection attack does real damage. Each tool declares its allowed parameter ranges and calling conditions, and parameters are validated before every call. High-risk operations (modifying data, sending messages, transferring funds) require a second confirmation or human approval. Tool results are treated as untrusted input and pass through detection again.
Layer three: output-side moderation
Scan model output for sensitive information (national ID numbers, bank card numbers, internal reference numbers), for fragments matching the system prompt, and for compliance. On a hit, redact or block the output and record the event in the risk metrics.
RAG poisoning is defended on the write side
Every write to the knowledge base needs source verification and content scanning. Letting anyone upload documents to a shared knowledge base leaves attackers a direct channel into the model's context.
The four-component data protection architecture
When the business needs a cloud model but data cannot leave the environment, four components form a chain. 01 PII redaction strips names, account numbers, amounts and other sensitive fields before anything leaves the firewall. 02 Synthetic data substitution replaces real values with fake ones for external processing while preserving data structure and meaning. 03 External intent processing means the cloud model only recognizes intent and selects the workflow; it never touches real data. 04 Response reassembly inserts the real values back into the response inside the internal network, so the user sees a complete result.
- 3layers
- input / tool calls / output
- 4components
- in the data protection architecture
- 180days
- default audit log retention, configurable up to 3 years
Apolla security and on-premises deployment offering
Compliance mapping
China's MLPS Level 3 (Multi-Level Protection Scheme) is met through on-premises deployment and security hardening. ISO 27001 aligns the information security management system. GDPR is covered through data subject rights, DPA clauses and EU-region deployment. PIPL requires in-country data storage, the principle of minimum necessity and separate consent. Security is not a gate bolted on at the end; it is a design constraint that runs through every layer.