v0.2 - Prompt Injection Hardening

[aaronphifer]

v0.2 ships the prompt injection hardening that was the v0.2 ship gate.

What's new since v0.2-alpha

Two-phase prompt injection defense. Triagewall now resists in-content attacks where an attacker embeds instructions in alert fields (URL paths, user agents, payloads) trying to manipulate the LLM's verdict.

• Phase 1: Per-process canary token detection + strict response schema validation. Catches attacks that try to leak system prompts or break output structure.
• Phase 2: 16 attacker-controlled alert fields are wrapped in base64 with explicit boundary markers before being shown to the LLM. Trusted Suricata metadata (signature ID, IPs, severity) stays plain. This closes the URL injection vulnerability that defeated Phase 1.

Test results (full table in docs/experiments/):

The URL injection that flipped Phase 1 to false_positive 0.99 exactly as the attacker requested now produces uncertain 0.6. The attacker can no longer force their chosen verdict.

Real SQL injection attacks still classify as real. Benign GitHub API traffic still classifies as false_positive. The defense doesn't break legitimate detection.

Operational improvements:

• SQLite WAL mode + busy_timeout=10000 on all 6 connection sites (prevents dashboard lock contention during ingest backlog catch-up)
• Prefilter mounted as docker volume (edit prefilter.json → docker compose restart ingest, no rebuild needed)

Documentation:

• README refreshed for Foundation-Sec-8B as the production model, with the Q4/Q5/Q6 benchmark results, hardware tiering guidance, and an honest "Network visibility" section explaining what Suricata at the home perimeter sees and doesn't see
• Two experiment docs for the injection hardening work: Phase 1 (canary mechanism, discovery of URL injection vulnerability) and Phase 2 (field isolation design, validation tests, results)

Known limitations

• Model reasoning on base64-wrapped fields is more generic than on plain fields (tradeoff for the security gain)
• URL injection now produces uncertain rather than the ideal real + flagged as injection attempt. Security outcome is met but the prompt-rule fidelity is iterable.
• Architecture diagram refresh deferred to v0.2.1

Upgrade path from v0.2-alpha

If you're already on v0.2-alpha:

git pull
docker compose build ingest
docker compose up -d ingest

No config changes required. The new field isolation activates automatically on alerts that contain HTTP, DNS, TLS, file, SSH, or payload data.

What's next

v0.3 begins Wazuh integration — multi-sensor LLM triage. See ROADMAP.md for the full plan.

---

This discussion was created from the release v0.2 - Prompt Injection Hardening.