Self-Hardening Firewall for Large Language Models
Aegis is an open-source firewall designed specifically for large language models (LLMs) to mitigate adversarial threats. Developed by Automorphic AI, it focuses on detecting and preventing prompt injections, prompt and personally identifiable information (PII) leakage, and toxic language generation. The tool operates as a self-hardening system, continuously improving its detection capabilities by learning from new attack patterns encountered during operation.
The project was initiated in 2023 under the MIT License, making it freely accessible for integration into existing LLM pipelines. Its primary use cases include testing and red teaming, where security researchers and developers can simulate adversarial scenarios to identify vulnerabilities in their models.
Aegis is implemented in Python and requires an API key for full functionality, which can be obtained by registering for a free account on the Automorphic AI platform. The tool is structured to work seamlessly within existing LLM architectures, offering both ingress and egress protection.
How It Works
This model evaluates incoming user inputs and model outputs to determine whether an attack is underway. Unlike traditional firewalls, which rely on predefined rules, Aegis dynamically updates its detection parameters based on real-world attack data, creating a self-hardening feedback loop.
During the ingress phase, Aegis analyzes user-provided prompts to identify potential attack vectors before they reach the LLM. If an attack is detected, the system flags the input, preventing it from being processed. In the egress phase, Aegis examines the model’s output for signs of compromise, such as unintended disclosures or manipulated responses. This dual-layer approach ensures comprehensive protection against both input-based and output-based adversarial strategies.
One of the standout features of Aegis is its ability to learn from new attack signatures. Each detected attack contributes to an expanding dataset, which is used to retrain the classification model periodically. This continuous learning process enhances the firewall’s accuracy over time, making it increasingly effective against novel or evolving threats. The integration of heuristic methods from traditional firewalls further refines detection, ensuring that edge cases and ambiguous inputs are handled with precision.
Use Cases
Aegis is primarily targeted toward security researchers, developers, and organizations deploying LLMs in high-stakes environments. Its most immediate application lies in red teaming exercises, where teams simulate real-world adversarial attacks to test the resilience of their models. By deploying Aegis during these tests, organizations can identify vulnerabilities before they are exploited, allowing for targeted improvements in model security protocols.
The tool’s ability to detect toxic language and PII leakage is particularly valuable in scenarios where compliance with data protection regulations (such as GDPR) is critical. By filtering out malicious or sensitive inputs, Aegis helps maintain both security and regulatory adherence.
Additionally, Aegis serves as an educational tool for understanding adversarial attack patterns. The open-source nature of the project encourages collaboration, allowing researchers to contribute new attack datasets or detection algorithms to the broader community.
Key Features & Capabilities
- Prompt Injection Detection: Aegis is designed to identify and block prompt injection attacks, where adversaries manipulate input prompts to bypass intended model behaviors.
- PII and Prompt Leakage Prevention: The firewall monitors both inputs and outputs for signs of unintended data disclosure. For instance, if a user prompt contains a request to reveal internal model training data or secrets, Aegis will flag it as an attack. Similarly, it scans model outputs for accidental leaks of sensitive information, such as passwords or proprietary details.
- Toxic Language Detection: Aegis includes mechanisms to detect and mitigate toxic or harmful language generation.
- Self-Hardening Learning: The adaptive nature of Aegis sets it apart from static security solutions. Each detected attack is logged and analyzed, with the findings used to improve the model’s detection capabilities.
- Ingress and Egress Protection: Aegis provides dual-layer security by inspecting both incoming user inputs (ingress) and model-generated outputs (egress). This comprehensive approach ensures that attacks are intercepted at multiple stages of the interaction cycle, reducing the likelihood of successful exploitation.
- Integration with Existing LLMs: The tool is designed to work with any Python-based LLM, making it highly versatile for different use cases. Developers can integrate Aegis into their existing pipelines with minimal overhead, thanks to its API-driven architecture and straightforward Python interface.
The project’s roadmap highlights ongoing and planned developments, including the addition of honey prompt generation—a technique where decoy prompts are used to lure attackers into revealing their methods.