{"id":"https://openalex.org/W7165368329","doi":"https://doi.org/10.48550/arxiv.2606.19660","title":"A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots","display_name":"A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots","publication_year":2026,"publication_date":"2026-06-17","ids":{"openalex":"https://openalex.org/W7165368329","doi":"https://doi.org/10.48550/arxiv.2606.19660"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.19660","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19660","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.19660","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029858915","display_name":"Gulshan Saleem","orcid":"https://orcid.org/0000-0003-2761-8399"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Saleem, Gulshan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123645106","display_name":"Nisar Ahmed","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ahmed, Nisar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111012402","display_name":"Muhammad Imran Zaman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zaman, Muhammad Imran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139017883","display_name":"Ali Hassan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hassan, Ali","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.11479999870061874,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.11479999870061874,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.10490000247955322,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.09309999644756317,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.47380000352859497},{"id":"https://openalex.org/keywords/buffer-overflow","display_name":"Buffer overflow","score":0.41499999165534973},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3806000053882599},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.36329999566078186},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.3499999940395355},{"id":"https://openalex.org/keywords/application-layer","display_name":"Application layer","score":0.3465999960899353},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.3393000066280365},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.3296999931335449},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.3179999887943268}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7111999988555908},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.47380000352859497},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.41499999165534973},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39890000224113464},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.39399999380111694},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3806000053882599},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.36329999566078186},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.3499999940395355},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.3465999960899353},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3393000066280365},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.3296999931335449},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.3093999922275543},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30730000138282776},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.30410000681877136},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.30079999566078186},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.2865000069141388},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2856000065803528},{"id":"https://openalex.org/C53833338","wikidata":"https://www.wikidata.org/wiki/Q1061424","display_name":"Context switch","level":2,"score":0.2784000039100647},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.27709999680519104},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2712000012397766},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C2775928411","wikidata":"https://www.wikidata.org/wiki/Q2041312","display_name":"Fault injection","level":3,"score":0.2680000066757202},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.2678000032901764},{"id":"https://openalex.org/C96865113","wikidata":"https://www.wikidata.org/wiki/Q2946816","display_name":"Certificate","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.2590999901294708},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.2574000060558319},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.25110000371932983}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.19660","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19660","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.19660","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.19660","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6617684960365295,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Prompt":[0],"injection":[1,85],"is":[2,159],"ranked":[3],"as":[4,163],"the":[5,16,49,87,151,167,183,195,243],"most":[6],"critical":[7],"vulnerability":[8],"in":[9],"large":[10],"language":[11],"model":[12,126],"(LLM)":[13],"deployments":[14],"by":[15,199,208],"OWASP":[17],"Top":[18],"10":[19],"for":[20],"LLM":[21],"Applications,":[22],"yet":[23],"existing":[24],"defenses":[25],"operate":[26],"at":[27],"isolated":[28],"pipeline":[29],"stages":[30],"and":[31,82,100,133,146,161,178,203,219,237],"remain":[32,56],"incomplete.":[33],"Input":[34],"filters":[35],"cannot":[36,43],"inspect":[37],"retrieved":[38,117],"documents,":[39],"while":[40,212],"output":[41,127],"monitors":[42],"prevent":[44],"malicious":[45],"payloads":[46],"from":[47,119,190],"reaching":[48],"model.":[50],"Consequently,":[51],"retrieval-augmented":[52],"generation":[53],"(RAG)":[54],"chatbots":[55],"vulnerable":[57],"to":[58,149,153,192],"indirect":[59,83],"injection,":[60],"where":[61],"a":[62,75,96,101,109,129,204,214,220],"poisoned":[63],"knowledge-base":[64],"document":[65],"compromises":[66],"every":[67],"user":[68,93],"whose":[69],"query":[70],"retrieves":[71],"it.":[72],"We":[73],"present":[74],"three-layer":[76],"framework":[77,158,184],"that":[78,182,230,238],"intercepts":[79],"both":[80],"direct":[81],"prompt":[84],"throughout":[86],"inference":[88],"pipeline.":[89],"Layer":[90,106,123],"1":[91],"screens":[92],"input":[94],"using":[95,128],"rule-based":[97],"pattern":[98],"library":[99],"fine-tuned":[102],"semantic":[103,134],"anomaly":[104],"classifier.":[105],"2":[107],"enforces":[108],"provenance-based":[110],"instruction":[111],"hierarchy":[112],"during":[113],"context":[114],"assembly,":[115],"preventing":[116],"content":[118],"overriding":[120],"operator":[121],"policy.":[122],"3":[124],"audits":[125],"policy":[130],"rule":[131],"engine":[132],"drift":[135],"detector":[136],"before":[137],"delivery.":[138],"A":[139],"continuous":[140],"audit":[141],"loop":[142],"aggregates":[143],"structured":[144],"logs":[145],"supports":[147],"retraining":[148],"adapt":[150],"classifier":[152],"emerging":[154],"attack":[155],"patterns.":[156],"The":[157],"model-agnostic":[160],"deploys":[162],"middleware":[164],"without":[165],"modifying":[166],"underlying":[168],"LLM.":[169],"Evaluation":[170],"on":[171],"5,080":[172],"samples":[173],"across":[174],"GPT-4o,":[175],"Llama":[176],"3,":[177],"Mistral":[179],"7B":[180],"shows":[181],"reduces":[185],"Attack":[186],"Success":[187],"Rate":[188],"(ASR)":[189],"71.4\\%":[191],"11.3\\%,":[193],"outperforming":[194],"best":[196],"single-layer":[197],"baseline":[198],"27.3":[200],"percentage":[201,210],"points":[202],"published":[205],"guardrail":[206],"system":[207],"23.8":[209],"points,":[211],"maintaining":[213],"4.8\\%":[215],"false":[216],"positive":[217],"rate":[218],"median":[221],"latency":[222],"overhead":[223],"of":[224,245],"61.2":[225],"ms.":[226],"Ablation":[227],"studies":[228],"confirm":[229],"all":[231],"three":[232],"layers":[233],"provide":[234],"complementary":[235],"protection":[236],"their":[239],"combined":[240],"effect":[241],"exceeds":[242],"sum":[244],"individual":[246],"contributions.":[247]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-20T00:00:00"}