Overview
An email-processing dashboard feeds untrusted, third-party email content into an LLM for extraction — which makes the model itself the attack target: a hostile sender can write instructions INTO the email and hope the model follows them. The engagement built a deterministic security layer that runs BEFORE anything reaches a prompt, on the raw incoming text, so the system never relies on the model to catch an attack against itself. The principle generalizes to any system feeding untrusted input to an LLM: the security decision must be made by code that cannot be talked out of it.
SK+EN Detection Patterns
The harness is fully deterministic and offline — pattern rules only, no model call involved — so its verdicts are reproducible and un-promptable. It covers both Slovak and English, insensitive to diacritics and zero-width-character obfuscation, and targets OWASP LLM Top 10 categories: prompt injection (LLM01), sensitive-information disclosure (LLM02), and system-prompt leakage (LLM07), plus jailbreak framings and classic web-injection markers (XSS, SQL injection) — the latter treated as a hostile-sender signal even when the LLM itself isn't their target. The same harness was later ported to guard this site's own chat assistant, which makes it independently verifiable in production.
Metadata-Only Logging & Human Review
Policy design, not just detection: a high-severity finding flags the item for mandatory human review — never an automatic action, never auto-approve — with an optional hard block of the LLM run entirely. Logging is metadata-only: category codes and counts, never the flagged text itself, so the audit trail can't become a second copy of hostile or sensitive content. Defense-in-depth around the harness: no tools exposed to the model while untrusted content is processed, schema-constrained output with strict re-validation, and output escaping on render. The result: every inbound email is screened deterministically before any LLM processing, and anything suspicious lands in front of a human instead of triggering a silent automated action — the failure mode changes from "attacker steers the system" to "attacker wastes a reviewer's minute".