Building an AI Firewall: Defending LLM Apps at the Edge
"Just add a prompt filter" doesn't survive contact with a determined attacker. A real AI firewall is a layered architecture sitting between the user, the model and every tool it can call — not a single regex.
Inline input inspection
Classify intent before the prompt reaches the model: jailbreak patterns, encoded payloads, known injection templates. Fast, cheap models can pre-screen for a larger model.
Context-aware output filtering
Check the model's output against policy before it reaches the user or a tool call — PII leakage, secrets, disallowed content, or an unexpected tool invocation the user never asked for.
- Structured-output validation before tool execution
- PII/secret regex + classifier pass on every response
- Anomaly scoring on tool-call sequences, not just single calls
Segment trust zones
Retrieved documents, user input and system instructions should never share an undifferentiated context. Tag provenance and enforce that only system-tagged content can issue instructions.
Treat it like a WAF: log, tune, iterate
Ship with logging on by default, review false positives weekly, and version your policy like code. An AI firewall that never gets tuned drifts into either uselessness or user-hostile blocking.
Tools mentioned
Treat the model like an untrusted service behind a WAF, not a trusted teammate. Inspect inputs, inspect outputs, segment trust — the same layered thinking that secured APIs now has to secure prompts.