Architecture and Security

Architecture and Security Attack Models

AgentGuard is structured as an in-process interceptor to minimize serialization overhead and avoid external network hops.

---

High-Level Sequence Diagram

[ User Query ]
       │
       ▼
[ AgentGuardSuite ] ──────> 1. Token Budget Check (Local Estimator)
       │            ──────> 2. Injection Rule Matching (Regex Heuristic)
       │            ──────> 3. PII Redaction & Tokenization
       ▼
[ Sanitized Prompt ]
       │
       ▼ (Outgoing to Cloud)
[ Third-Party LLM ] (OpenAI / Claude / Gemini / Ollama)
       │
       ▼ (Incoming Response)
[ Raw LLM Output ]
       │
       ▼
[ AgentGuardSuite ] ──────> 4. Token Inversion (Restore surrogate tokens)
       │
       ▼
[ Unmasked Response to User ]

---

Supported Threat Models

1. Direct Instruction Injection: Prompts attempting to clear conversational memory, reset initial instructions, or ignore developer rules.
2. Persona Hijacking (DAN Attacks): Prompts forcing models into unrestricted developer modes or simulated evil personas.
3. Delimiter Forgery: Injected text containing ChatML delimiters (<|im_start|>system) designed to fool the model into believing the user prompt is a system message.
4. Data Exfiltration: Prompts tricking the model into outputting the system prompt or developer secrets.
5. PII Cross-Border Leakage: Sending customer credit card details, government IDs, or credentials to third-party model hosts violating GDPR or PCI-DSS.