Layered guardrails blunt LLM SOC log-poisoning attacks

Problem

This paper studies indirect prompt injection risks that arise when Large Language Models are integrated into Security Operations Centres. Attackers can poison logs or external threat feeds to embed malicious instructions that, when ingested by a SIEM and presented to an LLM, form multistep "promptware" kill chains capable of jailbreaking models, triggering unauthorised actions, exfiltrating data, or causing denial of service through context exhaustion. The difficulty is that purely deterministic filters are fast but semantically blind, while purely neural defences are probabilistic, slow, and vulnerable to volumetric attacks. Ensuring end-to-end pipeline integrity for AI-augmented SOCs is therefore critical.

Approach

The authors propose a neurosymbolic defence-in-depth architecture combining a deterministic pre-filter at the SIEM ingestion layer with neural semantic guardrails at the LLM interface, plus a closed-loop telemetry system for Human-in-the-Loop visibility. The deterministic layer uses customised SIEM decoders and atomic rules (implemented in Wazuh) to extract suspicious strings, enforce length bounds, normalise structure, detect known encodings and signatures, and apply active response sanitisation (truncation or masking) while preserving forensic metadata. The neural layer wraps the cognitive engine with NeMo Guardrails operating as input and output self-check rails that ask the LLM to validate incoming alerts and its own responses against allowed actions and policy constraints. A Python orchestrator connects the layers, records blocked events to an injection-alerts log, and issues fallback JSON responses so analysts retain visibility. The prototype runs Wazuh decoders feeding sanitized JSON to NeMo Guardrails and a locally hosted LLM for evaluation. The threat mapping follows the MITRE ATLAS taxonomy.

Key Findings

• The deterministic SIEM pre-filter neutralised volumetric and signature-based injections at ingestion and prevented context-exhaustion vectors, intercepting 3 of 20 simulated prompt injections in the test set.
• The NeMo Guardrails semantic layer identified and neutralised 18 of 20 adversarial payloads, successfully defending against many instruction-overrides, role-playing attempts, unauthorised tool-invocation attempts, and data-exfiltration prompts.
• Two sophisticated semantic evasions bypassed the guardrails: one instance of unauthorised tool abuse leading to lateral movement and one complex instruction-override that achieved a model jailbreak, demonstrating residual probabilistic failure modes in the neural layer.

Limitations

The evaluation treated SIEM alerts as isolated instances, leaving the pipeline vulnerable to multi-turn semantic attacks and retrieval-independent persistence if the cognitive engine retains cross-session state. The Layer 1 PCRE2 text decoders are blind to multimodal promptware steganographically embedded in images or audio. The neural guardrails remain probabilistic and can be bypassed by sufficiently subtle or novel semantic obfuscations.

Implications

Offensively, an attacker can poison in-scope log fields or compromise CTI feeds or APIs to deliver dormant instructions that are retrieved and executed later, enabling Initial Access, Privilege Escalation, Lateral Movement, data exfiltration or denial-of-service on the AI pipeline. Volumetric padding can induce Denial of ML Service by exhausting context windows. The proposed architecture raises the bar by denying many of these vectors at ingestion and by imposing semantic checks before actions, but remaining attack pathways include zero-day semantic jailbreaks, sophisticated role-playing prompts and multimodal payloads. An attacker aiming to evade such defences would focus on crafting semantic payloads tuned to bypass intent thresholds or on delivering multimodal and multi-turn manipulations to exploit session state. The paper suggests hardening measures such as enriching intent specifications, improving embeddings and thresholds, few-shot adversarial tuning, stateful session-aware intent classification and lightweight CV modules to address these offensive options.