Mitigating LLM Prompt Injections via Multi-Vector Representation and Voting-Based Routing

1. Introduction

The use of Large Language Models (LLMs) in modern software environments, such as RAG models and autonomous agents, has greatly enhanced data analysis and generation [1]. Nonetheless, this rapid adoption has increased the vulnerability of these models to prompt injection attacks, in which a user sends a malicious instruction to the model to carry out a task other than the intended one. There is a unique susceptibility of RAG models to indirect prompt injection since they pull information from untrusted data sources, such as documents or websites, which contain malicious prompts to the model [2,3]. Attackers have become more sophisticated in their attacks; they now create effective prompts using automated and optimized tools. In addition, there is a transferability challenge in which an attacker creates prompts for local use with open-source models and then uses them on black-box models online [4].

Currently, there is an issue of achieving a secure yet functional equilibrium for these defenses. The current defenses, which include easy instruction-based separation of data, are too weak and do not generalize against the threat of attackers that try to exploit queries disguised as legitimate ones. Fine-tuning methods cannot provide the information necessary for the model not to do certain things during an attack customized for that exact model [5,6]. As a result, many detection methods face the problem of base rate fallacy and generate an abundance of false positives, causing problems for legitimate users trying to submit queries and thus creating an unpleasant user experience [7,8]. The compromise of LLMs that have access to sensitive tools or operating systems can have dangerous consequences, including exfiltration of data, financial operations, and system command executions [9,10].

This research presents an innovative, multi-layered defense strategy to combat prompt injection attacks within practical deployments of LLMs. This research goes further than mere input validation, acknowledging the computational cost of fine-tuned models and their inherent risks related to manipulative guardrails [11]. While [12] showed that one embedding classifier is sufficient for detecting prompt injections, our work goes a step further with (i) a redundant multiple-embeddings classifier based on Triple Modular Redundancy concepts, (ii) an adaptive routing system to fall back on LLMs using confidence thresholds, and (iii) an input-output verification layer. The main contributions of this paper are:

• Open-Source Architecture: Proving that effective defense does not necessitate closed-source APIs. Open-source embeddings and Llama Guard 3 can enable privacy-centric architectures that do not require data to leave secure infrastructure.
• Multi-vector defense mechanism: Applying an ensemble of three different types of embeddings. This redundancy is essential for fault tolerance, as failure of any one of the embeddings to produce the proper vectors will be mitigated by the remaining two embeddings [13].
• Voting-Based Routing Mechanism: In order to achieve maximum efficiency and accuracy, the system uses a voting-based routing mechanism. Classifications that have high confidence are processed using the fast route, whereas low-confidence input is sent to an additional expert classifier named Llama Guard 3.
• Bidirectional Verification: Going beyond checking only inputs and verifying both inputs and outputs. This multi-step process will detect more advanced attacks by ensuring that attempts to tamper with the LLM will not succeed in generating harmful outputs for users.

This research attempts to answer the following research questions:

• RQ1: How will the integration of a multi-vector representation approach with a voting-based routing method influence the efficiency of prompt injection detection?
• RQ2: Will a two-way verification approach (input and output filtering) be able to deal with "silent failures," should the input guardrails be circumvented?
• RQ3: Is it possible to design an effective prompt injection protection mechanism using only open-source models?

2. Literature Review

Prompt injections are a new set of potential dangers brought about by the incorporation of Large Language Models (LLMs) into production environments, such as autonomous agents and retrieval-augmented generation (RAG) systems. These types of attacks take advantage of the architectural challenge LLMs face in differentiating between user-provided data and system commands. This review concentrates on recent studies in three areas: universal detection frameworks for rapid injection, defensive mechanisms in LLM agents, and security in RAG systems.

2.1. Security in RAG Systems

Current protections are still vulnerable to attacks, according to research. They either lack the specificity to reject malicious inputs or prompts, or they are primarily ineffective against optimization-based assaults. In order to achieve this, SecAlign turns security into a preference optimization problem. By using Direct Preference Optimization to train models to favor secure replies over unsafe ones, SecAlign significantly lowers attack success rates [4]. In the same direction, the BIPIA assessment highlights how most LLMs are unable to differentiate between active directives and informational context. In order to effectively contain these attacks, the authors then propose a white-box defense mechanism that uses adversarial fine-tuning with specific tokens to clearly demarcate data boundaries [14].

Among the elements in the RAG, some components require hardening to enhance their security. CodeGuarder helps in providing extra protection for the Retrieval-Augmented Code Generation, which involves Security Knowledge and the Function Code Snippet Types in a way that even if a particular model gets poisoned information from an online repository, it can learn from its mistakes [15]. The chatbot architecture that utilizes reverse RAG becomes more secure since the chatbot uses only the retrieved data to respond to any requests raised through the chatbot and cannot be used to substitute other already verified data [16]. The chatbot is integrated with the primary pipeline using an Archias expert model to classify the user inputs and mitigate particular domain-specific risks, such as manipulation of prices or questions regarding the price [17].

A concept called InstructDetector uses the internal behavioral states of the LLM, namely hidden states and gradients, to locate hidden instructions inside returned text in order to achieve high detection accuracy with minimal data [3]. Another AI firewall system is CONTROLNET, which filters malicious requests by detecting changes in a model’s activation state or shifting patterns brought on by the presence of malicious information [6].

Regarding privacy security, LeakSealer offers a semi-supervised system that uses static forensic analysis and dynamic active defense to identify PII leaks in RAG responses [18]. An innovation called Jatmo suggests task-specific fine-tuning, which effectively eliminates a model’s general instruction-following capability, limiting its application to a single task and rendering prompt injections ineffective, in contrast to some other approaches that operate at the levels of model specialization or ecosystem-level threats [19]. Another technique, the RAGworm, shows how a viral threat can propagate self-replicating adversarial prompts across a networked ecosystem of GenAI apps. By comparing input retrieval to created output, the proposed defense, which makes use of the DonkeyRail solution, offers a mechanism for their detection [20]. In order to safeguard RAG agents, a thorough benchmark of 847 test cases confirms the necessity of multi-layered defenses that combine content filtering, hierarchical guardrails, and response verification [2].

2.2. Defense Mechanism for LLM Agents and ChatBots

LLM agents, who can perform actions and invoke tools, are more vulnerable than passive chatbots. Ensuring that every agent action precisely complies with user intent is the primary purpose of security in this domain.

By tracking system calls to detect and prevent harmful "side effects" like illegal file access that conventional text-based logs can miss, AgentSentinel offers a kernel-level defense for computer-use agents [9]. Task Shield is an alternative strategy. Task Shield enforces "Task Alignment," which filters out irrelevant and potentially dangerous instructions, by continuously confirming that each tool call or sub-task generated by the agent clearly relates to the user’s aim [21]. In order to particularly prevent indirect injections, IntentGuard employs a "instruction-following intent analyzer" to interpret the internal planning process of the model and notify the user if an intended instruction comes from an untrusted data segment [22].

A multi-layered security architecture that uses Keyword Identification along with a Cryptographic Signature scheme for security in high-risk financial domains is currently under development. Here, the idea is that the set of specific "commands" used has already been encoded using an unknown "signed" key. Thus, it is ensured that these "valid" commands cannot be reissued or modified by any attacker in order to include some additional command [10]. An Event-driven Architecture (EDA), in which security services collaborate through events for authentication and real-time defense adaptation, is another approach that can be adopted [5]. In PPA, the predictability associated with static defenses is overcome by making random changes in the prompt structure of the system for every new request. This prevents the attacker from overfitting his attacks on a particular configuration [7]. Finally, DataSentinel formulates detection as a game-theoretic problem, thereby enhancing robustness against adaptive adversaries by fine-tuning a detector on attacks optimized to evade it [23].

2.2.1. General Prompt Injection Detection and Guardrails

The "base-rate" problem of detectors misidentifying harmless conversational queries as assaults is the focus of PromptShield; the authors developed a detector to maintain a very low false-positive rate appropriate for deployment in industry-strength applications [24]. Linguistic and semantic analysis are used in a number of methods. By using language profiling, "Prompter Says" enables a classifier to distinguish between the "more straightforward" approach of a legal query and the "more complex command-driven" approach of a jailbreak assault [25]. A multi-agent system called JailGuard combines several analytical agents—linguistic, psychology-based, or semantic—to fend against complex attacks that make use of multiple interaction channels [26]. To effectively train the supervised classifiers, MalPID provides a complete dataset of malicious prompts [27].

Other approaches use the model’s internal generation stream or logic. Before reacting, Careful Thought Defender forces the model to perform a kind of "self-check" using a unique, dedicated CoT method to identify potential hazards [28]. Because StreamGuard monitors the generating stream in real time, it may instantly truncate a response when it senses a jailbreak attempt, revealing less sensitive data [29]. In order to prevent attackers from extracting or overriding system prompts via a standard text-based injection, SysVec recommends encoding them as internal vectors rather than text tokens [30].

There are also heuristic and hybrid defenses. The Hybrid Constitutional Classifier, which balances speed and security, is presented in one work. It consists of a quick, rule-based keyword filter and a slower, but more accurate, model-based evaluator [31]. An alternative method uses heuristic feature engineering and a pre-trained model to identify injections by examining unique characteristics in the prompt [32]. By employing the model itself to identify and eliminate quick injection vulnerabilities, an LLM-driven defense strengthens system security [33]. Lastly, to add an extra layer of security, a machine learning-based security layer was created especially for ChatGPT to detect dangerous cybersecurity prompts [12].

To provide context for the technical environment and highlight the need for the new framework, it is essential to analyze the strengths, verification ranges, and drawbacks of current state-of-the-art cybersecurity approaches. Modern defenses certainly bring improvements in comparison with the previous generation, but often face some limitations either related to their architecture or implementation. Approaches focused on defending input, like Preference Optimization or calibration of detectors, expose systems to all kinds of manipulation or "silent failures" after bypassing the first layer. In addition, purely generative or streaming approaches are known to create latency bottlenecks for inference. In many cases, robust solutions demand intrusive white-box modification of model weights which makes them useless in enterprise settings. As can be seen in Table 1, the Multi-Vector Ensemble combines the low-latency operation of a free classifier ensemble and bidirectional verification.

3. Methodology

3.1. Architectural Overview

This designed methodology takes into account a robust and multilayered defense against prompt injection attacks. This defense mechanism leverages the architecture and semantic analysis of open-source language models, using a two-way validation technique to detect any loopholes in both the input and output stages. This defense mechanism works through a five-stage pipeline that can be seen in Figure 1 and consists of:

1.

Input Ingestion: Textual queries are collected from user environments or external data streams such as Retrieval-Augmented Generation (RAG) pipelines.

2.

Multi-Vector Space Mapping: Input text is simultaneously transformed into three independent vector spaces using different open-source embedding encoders.

3.

Ensemble Classification Inference: The generated vectors are analyzed by parallel gradient-boosting classifiers, yielding six simultaneous predictions.

4.

Confidence-Based Consensus Routing: An adaptive voting mechanism filters incoming requests. High-confidence benign inputs are directly forwarded to the LLM, confirmed malicious prompts are rejected immediately, and uncertain cases are passed to an expert fallback model, Llama Guard 3.

5.

Output Interception Filter: Responses generated by the target LLM are evaluated by a secondary output guardrail before being delivered to the client.

3.2. Dataset and Feature Engineering

The proposed framework was evaluated based on the use of a large-scale non-duplicate prompt injection dataset [34]. Initially, there were 553,185 prompts in the dataset, which were then deduplicated to improve the model’s generalization and prevent overfitting. The final dataset consists of 467,057 unique prompts obtained from various Hugging Face repositories such as:

• imoxto (Prompt Injection cleaned dataset)
• reshabhs (SPML Chatbot Prompt Injection)
• Harelix (Prompt Injection Mixed Techniques)
• JasperLS (Prompt Injections)
• fka (Awesome Chatgpt Prompts)
• rubend18 (ChatGPT Jailbreak Prompts)

Here is the distribution of the dataset:

• Malicious Prompts (Class 1): 109,934 (23.54%) - jailbreak attacks and token manipulations.
• Benign Prompts (Class 0): 357,123 (76.46%) - normal prompts by users.

The datasets consist of four columns as follows:

• ID: Unique identifier for the prompt.
• Source: Repository where the data came from.
• Text: The raw text prompt.
• Label: Safety label (0 for benign and 1 for malicious).

To ensure the model is evaluated correctly and minimize the initial impact of class imbalance, the dataset was split using a stratified 80/20 train/test split. Stratified splitting is a widely recognized fundamental practice aimed at ensuring the proportional representation of classes within both training and test datasets, preventing distribution distortions that would bias the classifier’s predictions toward the majority class [35,36,37]. With this, stratification provides additional stability during model training and allows to avoid distorting final performance due to random partitioning. Although, according to recent research, stratification doesn’t entirely solve the problem of prediction bias and is significantly outweighed by the choice of classifier and subsequent data manipulations, it still remains an important prerequisite for representative baselines [38]. For this reason, it is used here not as a solution to imbalance per se, but as a fundamental structural step. In this way, it reduces initial bias toward the majority class and ensures the statistical correctness of the test dataset, thus creating a solid foundation on which advanced model selection, such as hyperparameter tuning of XGBoost and LightGBM, can be performed effectively [39,40].

3.3. Multi-Vector Semantic Diversity Layer

Relying solely on a single embedding space leads to a critical weakness, as any adversarial prompt that semantically resembles legitimate prompts in the latent space of the encoder becomes undetectable by the classifiers used subsequently.

In order to strengthen resilience against faults and intrusions, the system represents every prompt in three semantic spaces via embedding models that are open-sourced and contain fewer than one billion parameters:

• Snowflake Arctic-Embed (33M): An embedding model that creates sentence embeddings based on the last hidden state from the [CLS] token. The model was trained with InfoNCE loss, hard-negative sampling, and source stratification [41].
• IBM Granite-Embedding (30M): An enterprise-scale bi-encoder fine-tuned with Retro-MAE masking autoencoder and further fine-tuned with multi-head knowledge distillation [42].
• Sentence-Transformers MiniLMv2 (33M): A lightweight version of the student model trained using deep self-attention relation distillation for general semantic understanding with ultra-low latency [43].

The architectural decision for using three embedding models aims at achieving a balance between operational fault tolerance and computational efficiency, borrowing the principles of Triple Modular Redundancy (TMR) [44]. Despite the similarity in terms of constraints on the model parameters ( 30–33M) and architecture (bi-encoders outputting 384-dimensional embeddings), these three models were purposely chosen due to non-overlapping semantic blind spots resulting from completely different approaches to pre-training. Snowflake makes use of [CLS] token pooling and InfoNCE loss based on strict source stratification; IBM Granite uses Retro-MAE masking and multi-step contrastive fine-tuning; while MiniLMv2 leverages deep self-attention relation distillation (query, key, value relations transfer) [41,42,43].

Hence, this three-pronged approach serves as a fail-safe operationally. In spite of the impossibility of perfect statistical independence of semantic errors within transformer-based bi-encoders, the structural independence is sufficient to avoid catastrophic failure on the system level. This has been experimentally confirmed during the dataset preprocessing stage, as even though there were heavy individual cases of dropouts due to non-standardized Unicode (which is explained in Results section), no concurrent dropouts have ever happened in all three encoders [45]. Increasing the system from three to five, or even seven, models would yield very little semantic variety in exchange for a linear increase in VRAM usage and inference time [46,47].

3.4. Ensemble Machine Learning Classifiers

Though deep learning algorithms are quite efficient for homogeneous data, the tree-based ensemble classifier tends to be more efficient at classifying high-dimensional static tabular vectors [48]. The proposed system utilizes two leading gradient boosting techniques, which include:

• XGBoost – (Extreme Gradient Boosting): Minimization of a regularized empirical risk function based on second-order Taylor approximation in additive regression trees to control complexity and minimize overfitting [49].
• LightGBM – (Light Gradient Boosting Machine): Efficiency improvement through: Gradient-Based One-Side Sampling (GOSS), Exclusive Feature Bundling (EFB), Leaf-wise histogram optimization [50].

Each of these two classifiers is trained independently on the embeddings of each semantic model. Thus, a total number of:

$$N_{\mathrm{embeddings}}\times N_{\mathrm{classifiers}}=3\times 2=6$$

(1)

The choice of six machine learning classifiers is a combinatorial approach intended to maximize diversity of decision boundaries through mathematical creation of algorithmic ambiguity [51,52]. Using precisely two tree-based algorithms with complementary properties in XGBoost and LightGBM to create a classifier with high specificity and sensitivity, respectively, across three embedding spaces leads to the creation of a $3\times 2=6$ classifier ensemble. The use of just three classifiers (one per embedding space) would force the system to have the specific bias of one algorithm, greatly reducing its representational and robust nature. On the other hand, using an odd number of classifiers (such as nine) would greatly tilt the voting distribution towards achieving a majority in the decision, virtually making a perfect tie vote impossible [53,54]. In intentionally creating an even number of six classifiers, the system creates statistical ambiguity (e.g., a $3-3$ vote tie or a $4-2$ vote margin with $\Delta \le 2$) when faced with highly ambiguous or obscure prompts. This statistical ambiguity created in the system perfectly fits into the CBR (Case-Based Reasoning) logic, helping the system clearly determine whether the primary ensemble lacks confidence and needs to activate the Llama Guard 3 "Slow Route," which is explained below [55,56].

3.5. Adaptive Confidence Routing and Voting Logic

In real-time inference, low latency is achieved through an adaptive routing mechanism based on the level of consensus among the ensemble classifiers. Let $V_{\mathrm{safe}}$ denote the number of classifiers predicting a prompt as safe, and $V_{\mathrm{malicious}}$ denote the number of classifiers predicting it as malicious. Since the ensemble consists of six classifiers, the total number of votes satisfies:

$$V_{\mathrm{safe}}+V_{\mathrm{malicious}}=6$$

(2)

The confidence of the ensemble decision is quantified through the consensus margin $\Delta$, defined as:

$$\Delta =\left|V_{\mathrm{safe}}-V_{\mathrm{malicious}}\right|$$

(3)

A larger value of $\Delta$ indicates stronger agreement among the classifiers, whereas a smaller value suggests uncertainty or disagreement. Based on the value of $\Delta$, the framework applies one of two routing policies:

Fast Route ($\Delta >2$)

A consensus margin greater than two indicates a high-confidence prediction, corresponding to vote distributions such as $6:0$ or $5:1$. In these cases, the ensemble decision is considered sufficiently reliable to bypass further analysis. If the majority vote classifies the prompt as safe, the request is forwarded directly to the target LLM. Conversely, if the majority vote classifies the prompt as malicious, the prompt is immediately rejected, thereby preventing unnecessary computational overhead and reducing inference latency.

Slow Route ($\Delta \le 2$)

A consensus margin of 2 or less indicates an ambiguous classification, corresponding to vote distributions such as $4:2$ or $3:3$. Such cases often arise from sophisticated jailbreak attempts, prompt injection attacks, or linguistically obfuscated malicious prompts that produce conflicting classifier predictions. To improve detection reliability, these uncertain cases are routed to the expert model, Llama Guard 3, which performs a more comprehensive semantic and safety analysis before a final decision is made.

This adaptive routing strategy balances security and computational efficiency by reserving the more expensive expert-model evaluation only for prompts that exhibit low ensemble confidence.

As the ensemble has six classifiers, the consensus margin $\Delta$ will be limited to discrete, even integers: 0 (3:3 tie), 2 (4:2 weak majority), 4 (5:1 strong majority), and 6 (6:0 unanimous agreement). The choice of $\Delta >2$ as the threshold value enforces a strict superiority requirement (5 out of 6 models agree) to trigger the Fast Route. A stricter $\Delta >4$ threshold would result in the need for complete unanimity. This would unnecessarily reroute thousands of high-confidence (5:1) predictions to the computationally expensive expert model, thus increasing system latency [57,58]. In addition, a count-based rather than soft-based (probabilistic) voting scheme is explicitly used here. Tree-based classifiers tend to be poorly calibrated probabilistically when predicting adversarial text. That is, such models might produce high-confidence (close to 1 or 0) predictions for the classes that are incorrect. The use of the count-based threshold protects the architecture from such a scenario where the model gives a confident prediction (0.99), while other models disagree with it [59].

3.6. Bidirectional Intercept

To counter more complex attacks where the malicious code remains inactive until response creation, there is an added step of output validation [60,61]. This takes place after the target LLM creates a response but prior to delivering that information to the end-user. The generated response undergoes scrutiny using the specialist safety model, known as Llama Guard 3.

It looks for any of the following criteria in the response:

• Attempts at data leakage
• Commands for unauthorized code execution
• Manipulation of system prompts

If the output complies with the checks as being safe, then the information is delivered to the end-user; otherwise, the response is filtered, and only a generic security rejection message is displayed.

3.7. Use of Generative AI

In the process of writing this paper, Google Gemini has been employed to aid in three different tasks: (i) help with the development and debugging of the code that was executed experimentally, including the ensemble pipeline, the voting system, and the evaluation code, the latest version of which is publicly available at https://github.com/adolfojara10/blue-team-ai; (ii) enhance the language used in some parts of the manuscript without being limited to superficial grammar corrections; and (iii) aid with interpreting the numerical results provided by the classification, the confidence-based routing, and the bidirectional guardrails. Generative AI was not used in designing the defensive architecture, generating the dataset, assigning safety classifications, or measuring experimental results. The authors are solely responsible for all AI-assisted outputs and conclusions made in this manuscript.

4. Experimental Setup

In order to make our findings reproducible and not affected by the performance limitations due to the hardware, all experiments were performed using the same local workstation. Our computational setup was designed to provide fast multicore calculations with additional GPU acceleration. The hardware used included the Intel Core i7 processor (16 logical cores), an NVIDIA GeForce RTX 4070 with 8 GB of GDDR6 VRAM, and 48 GB of DDR RAM.

The software stack was implemented on top of Ubuntu 22.04 LTS using Python 3.10 and CUDA 12.8 for hardware acceleration. Libraries specific to the infrastructure needs of the pipeline included:

• Machine Learning: XGBoost and LightGBM for classification, along with Scikit-learn and Scikit-optimize (BayesSearchCV) for evaluation and tuning of the model hyperparameters.
• Data Processing: Pandas and NumPy for working with high-dimensional vectors.
• Concurrency: asyncio, threading and joblib for handling asynchronous tasks and parallel extraction of the embeddings.
• Inference: Ollama for communicating with the Large Language Model locally.

4.1. Target LLM Selection

The specific LLM that has been chosen for this experiment is Gemma 3:1B, since it represents the industry’s strategic move towards using Small Language Models (SLMs) on the edge. SLMs are preferred in enterprises, as performing a 1 billion parameter model on the local machine eliminates the threat related to the data security issues of using third-party cloud API services. In terms of security, Gemma 3:1B represents the ideal choice for conducting this experiment.

Smaller models have weaker semantic buffers, making them more susceptible to adversarial prompt injection, jailbreaking, and proportional data poisoning [62,63,64]. Thus, testing this model presents the most severe “worst-case” scenario for proving the effectiveness of the developed guardrails [65]. From the technical point of view, Gemma 3:1B’s architecture is small enough to ensure extremely low latency and to work within 8 GB of VRAM limit of the testing environment.

4.2. Model Optimization and HyperparameterTuning

For the machine learning models LightGBM and XGBoost to perform at their optimal level, Bayesian Optimization was used to fine-tune the algorithms through the BayesSearchCV method. Instead of the conventional grid search method, Bayesian Optimization uses Gaussian process modeling for the search space, thereby enabling the algorithm to learn from previous runs and concentrate only on areas of the search space that can give the most efficient outcome [66].

In the case of both LightGBM and XGBoost, the objective function is set to macro f1-score (f1_macro). The use of this particular function ensures that the algorithm achieves satisfactory performance in both classes, thus giving equal priority to the majority and minority classes to guarantee the highest recall.

4.3. LightGBM Configuration

Table 2. Hyperparameter search space and rationale.

Parameter	Range / Value	Rationale
num_leaves	[20, 100]	Controls the complexity of the leaf-wise tree growth.
max_depth	[3, 15]	Limits tree depth to prevent overfitting on specific noise.
learning_rate	[0.01, 0.3]	Log-uniform distribution to find the optimal step size.
n_estimators	[100, 500]	Number of boosting rounds to allow for sufficient learning.
is_unbalance	True	Automatically weighs the minority class to handle dataset skew.
boosting	[gbdt, rf]	Evaluates Gradient Boosting Decision Trees versus Random Forest.

Table 2. Hyperparameter search space and rationale.

Parameter	Range / Value	Rationale
num_leaves	[20, 100]	Controls the complexity of the leaf-wise tree growth.
max_depth	[3, 15]	Limits tree depth to prevent overfitting on specific noise.
learning_rate	[0.01, 0.3]	Log-uniform distribution to find the optimal step size.
n_estimators	[100, 500]	Number of boosting rounds to allow for sufficient learning.
is_unbalance	True	Automatically weighs the minority class to handle dataset skew.
boosting	[gbdt, rf]	Evaluates Gradient Boosting Decision Trees versus Random Forest.

4.4. XGBoost Configuration

In order to make sure that validation is rigorous and avoid overfitting, the Bayesian Optimization was carried out for 25 iterations using the approach of 3-fold stratified cross-validation. In order to achieve reproducibility of experiments, a global random seed value of 42 was used throughout the entire process of sampling, splitting, and optimization. The result of this optimization process was the final configuration of algorithms presented in Table 4.

Table 3. XGBoost hyperparameter search space and rationale.

Parameter	Range / Value	Rationale
max_depth	[3, 10]	Slightly shallower than LightGBM to focus on core features.
gamma	[0, 5]	Minimum loss reduction required to make a further partition.
min_child_weight	[1, 10]	Prevents the model from creating leaves with very few samples.
subsample	[0.5, 1.0]	Fraction of data sampled per tree to introduce randomness.
scale_pos_weight	Ratio (0/1)	Custom weight applied to the positive class to combat imbalance.

Table 3. XGBoost hyperparameter search space and rationale.

Parameter	Range / Value	Rationale
max_depth	[3, 10]	Slightly shallower than LightGBM to focus on core features.
gamma	[0, 5]	Minimum loss reduction required to make a further partition.
min_child_weight	[1, 10]	Prevents the model from creating leaves with very few samples.
subsample	[0.5, 1.0]	Fraction of data sampled per tree to introduce randomness.
scale_pos_weight	Ratio (0/1)	Custom weight applied to the positive class to combat imbalance.

Table 4. Hyperparameter configurations of the machine learning models across different embeddings.

Model	Embedding	LR	Depth	N	Colsample	Subsample	Alpha ($\mathit{\alpha }$)	Lambda ($\mathit{\lambda }$)
LightGBM	MiniLM	0.30	13	500	0.50	0.50	10.0	10.0
LightGBM	Snowflake	0.30	15	500	1.00	1.00	10.0	10.0
LightGBM	Granite	0.30	13	500	1.00	0.50	10.0	10.0
XGBoost	MiniLM	0.30	10	300	0.50	1.00	10.0	10.0
XGBoost	Snowflake	0.21	10	293	0.92	0.87	1.45	0.28
XGBoost	Granite	0.17	10	300	1.00	1.00	$1\times {10}^{-9}$	$1\times {10}^{-9}$

Table 4. Hyperparameter configurations of the machine learning models across different embeddings.

Model	Embedding	LR	Depth	N	Colsample	Subsample	Alpha ($\mathit{\alpha }$)	Lambda ($\mathit{\lambda }$)
LightGBM	MiniLM	0.30	13	500	0.50	0.50	10.0	10.0
LightGBM	Snowflake	0.30	15	500	1.00	1.00	10.0	10.0
LightGBM	Granite	0.30	13	500	1.00	0.50	10.0	10.0
XGBoost	MiniLM	0.30	10	300	0.50	1.00	10.0	10.0
XGBoost	Snowflake	0.21	10	293	0.92	0.87	1.45	0.28
XGBoost	Granite	0.17	10	300	1.00	1.00	$1\times {10}^{-9}$	$1\times {10}^{-9}$

5. Evaluation Metrics

1.

Accuracy: it helps evaluate classification models. It is a ratio between the number of right predictions and the total number of input samples [67].

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(4)

Where:

• TP: True Positive.
• TN: True Negative.
• FP: False Positive.
• FN: False Negative.

2.

Precision: it tries to recognize the number of positive predictions that were error-free [68].

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(5)

3.

Sensitivity: It measures the model’s ability to predict positive samples accurately [69].

$$Sensitivity={\displaystyle \frac{TP}{TP+FN}}$$

(6)

4.

Specificity: Specificity helps to determine the test’s ability to correctly classify safe prompts as unsafe or possible attack [70].

$$Specificity={\displaystyle \frac{TN}{TN+FP}}$$

(7)

6. Results

6.1. Data Sanitization and Hardware Profiling

The initial sanitization process yielded a stratified test set of 93,398 prompts, with a real-world class imbalance of 77.8% safe and 22.1% unsafe inputs. The hardware profiling results verified the efficiency of the architecture; average CPU usage was 7.2%, while average GPU usage was 6.43%. Neither the CPU nor the GPU was a bottleneck during execution, and accuracy showed absolutely no degradation (89.24%) at 95th-percentile GPU heat levels (61.0°C).

Of particular interest is the analysis of dropout cases (Figure 2), which indicated occasional errors during the tokenization stage due to non-standard Unicode characters and dense code blocks in specific models, where the Granite model dropped 2,072, the MiniLM model dropped 5,525, and the Snowflake model dropped 8,427. It is important to note that no case occurred where all three models experienced tokenization failures simultaneously.

It is important to note that there was never a case where the three embedding models encountered tokenization problems at once. This is not to say that such a guarantee is architecturally enforced, but it is important to recognize the operational benefit that comes from spreading out parsing among different tokenizers; the system is more robust against failure.

6.2. Model Performance

Six sub-models’ independent predictive accuracy was assessed in order to set a benchmark. The hyperparameters were finely tuned, with the LightGBM architecture tending towards deeper decision tree depths (13–15) coupled with a high learning rate (0.30), which was offset by regularization, whereas for XGBoost, it was the other way around.

As seen from Figure 3, each individual model was able to score an accuracy rate of between 85% and 88%. It becomes apparent that there was a clear behavioral pattern among the two algorithms; while LightGBM algorithms focused on the need for safety with high sensitivity/recall rates (80.40% when using Granite), the XGBoost algorithm emphasized user convenience by having a high specificity rate (92.53% when using MiniLM).

Figure 4 presents the baseline performance of the six individual sub-models, emphasizing the obvious behavioral divide between the two classification algorithms. First, Snowflake XGBoost emerges as the most accurate standalone sub-model with an accuracy of 87.8%, thus making it the most balanced one. But the key aspect of the comparison is the relationship between the False Positive Rate (FPR) and False Negative Rate (FNR). All of the XGBoost models demonstrate themselves as conservative classifiers; they ensure good user experience through lower FPR (with a pipeline-best rate of 7.5% for MiniLM XGBoost), but suffer from higher FNR, thus, making the system susceptible to threat misclassification (up to 33.6%). In turn, the LightGBM models are sufficiently sensitive to security. They provide consistently low False Negative Rate to capture as many threats as possible (the best pipeline result of 19.6% is achieved by Granite LightGBM), but at the cost of a higher FPR (up to 13.1%). This sharp difference directly demonstrates the need for an ensemble approach, since no single model can balance both metrics.

6.3. Ensemble Dynamics and Voting Behavior

The confidence-based routing technique helped to improve the performance of the predictive power of the aggregate models. Figure 5 shows that the aggregated model had an accuracy of 89.23%, which was better than that of any of its components (i.e., Snowflake XGBoost at 87.80%).

Partial Vote (< 6 Active): This denotes infrastructural degradation in terms of the system’s fault tolerance. The presence of non-standard Unicode characters and dense code blocks leads to one or more embedding tokenizers ignoring the prompt (e.g., Snowflake discarding 8,427 prompts), which forces the ensemble to vote using an incomplete set of classifiers. The accuracy rate becomes 82.0% when the prompt is ignored, not because the classifiers are confused, but because the system temporarily loses some of its representational semantic capacity. Split Vote (Conflict): This case involves algorithmic degradation due to classifier disagreement. In such a case, the infrastructure is completely operational as all six models process the prompt, but the prompt in question is too ambiguous or is adversarially obfuscated, leading to a 3-3 or 4-2 vote split. The accuracy rate falls dramatically to 72.3% due to the linguistic camouflage breaking the classifier consensus.

The consensus margin was highly predictive of prediction quality. Unanimous consensus saw an increase in the accuracy score of 95.10%, whereas, in a situation where there is no agreement, the accuracy score dropped to 72.32%. Entropy analysis was conducted, and the results show that the predictions that were made correctly had very low entropy (0.2628), while wrong predictions had a high entropy score of 0.6534.

Performance analysis of the Ensemble Baseline model over the test set with $N=\mathrm{93,398}$ samples demonstrates outstanding predictive ability and acceptable risk balance for quick and proper identification of safe activities. With regard to 72,694 actual benign requests, the classifier identified 68,410 samples as Safe (True Negatives), which resulted in the relatively low False Positive Rate (FPR) of 5.89% ($n=\mathrm{4,284}$), which is illustrated in Figure 7A. The low level of FPR indicates the operability of the Guardrails principle as it enables avoiding excessive impact on the benign activities of users. The classifier successfully identified 14,930 malicious examples as Unsafe (True Positives) among a total of 20,704 malicious activity examples, yielding a Recall (Sensitivity) of 72.11% and a Precision of 77.70%. Altogether 5,774 malicious inputs managed to evade the baseline protection (False Negatives), which led to the evasion rate of 6.18% across the whole data collection. On average, the baseline classifier demonstrated a global Accuracy of 89.23% and an F1-score of 0.7481. This provides a good empirical starting point, given high accuracy for legitimate traffic and clear optimization targets.

The sensitivity analysis of the $\Delta$ parameter confirms the correctness of the selected threshold. Applying only unanimous decisions for the Fast Route ($\Delta >4$) allowed achieving a minimal increase in accuracy (95.10%), while the rest of 11,667 active 5:1 votes would be sent via Llama Guard 3, which results in the total delay cost of about 8,400 seconds. Reducing the threshold value to the level at which 4:2 weak majorities could be used ($\Delta >0$) would expose the entire system to higher mathematical entropy (0.6534) due to adversarial decisions, resulting in reduced precision. Hence, $\Delta >2$ is the optimal mathematical border between efficiency and security.

6.4. Bidirectional Verification and Vulnerability Analysis

The conclusion drawn from the analysis of intercepted attacks justifies the use of the Bidirectional Verification paradigm. As seen in Figure 6, while the Input Guard Rail succeeded in detecting most attacks (particularly Violent Crimes and Intellectual Property attacks), it was not entirely foolproof.

The secondary output guardrail stopped 1,359 instances of malicious inputs that the primary guardrail did not stop at the input stage. In the absence of such a bidirectional filter, these successful injections could penetrate the system and cause “silent failures.”

An analysis of the system’s weaknesses showed that there were 1,987 false negatives (19.7% of all errors) that the ensemble failed to recognize despite a very high level of certainty ($\ge 0.80$). The high level of consensus led to low entropy in these inputs; hence, they evaded the protection offered by the Llama Guard 3 system.

Although Gemma 3:1B was deliberately chosen as the "worst case" subject for testing, as an inevitable result of using SLMs in this experiment, we have to admit that this method constrains the generalization of the bi-directional intercepting rates to the more robust models. Naturally, the generative behaviors and types of failures would differ when using enterprise-level systems. But since the Llama Guard 3 output validation mechanism depends solely on violations of semantic policies and has nothing to do with the architecture of the LLM, we can conclude that the stability of the bi-directional safeguard should remain theoretical regardless of the LLMs used.

6.5. End-to-End Pipeline Performance

Although the ensemble baseline provided an accurate performance of 89.23%, the real efficiency of the proposed system can be proven by considering the complete end-to-end pipeline. The baseline figures (Figure 7A) only demonstrate the performance of the main input layer before the interference of the confidence-based routing and bidirectional guardrails. By routing the ambiguous inputs ($\Delta \le 2$) to the Llama Guard 3 expert model, the system managed to resolve the issues related to the algorithms that affected the split vote accuracy. In addition, the second filter was able to capture an additional 1,359 malware samples that managed to escape the first round of classification.

As seen in Figure 7B, in which the end-to-end confusion matrix is shown, there has been a considerable increase in performance by our system over the baseline one. The end-to-end pipeline accuracy went up from 89.23% to 90.69% while the overall system Recall (also known as Sensitivity) increased from 72.11% to 78.68%. It is especially worth noting that the Final FPR has stayed at 5.89%, confirming that the incorporation of the Llama Guard 3 additional layers has managed to boost the system’s resilience to silent failures.

7. Conclusions

The findings obtained in this study confirm the effectiveness of the multi-layered defense architecture proposed here and provide unambiguous answers to the three main research questions motivating the current study.

• RQ1: How will the integration of a multi-vector representation approach with a voting-based routing method influence the efficiency of prompt injection detection? The use of multi-vector semantic diversity definitely addressed the problem of a single point of failure associated with single embedding model approaches. Whereas individual tokenizers were dropping thousands of requests because of complex Unicode/complexity, the tri-model redundancy approach did not allow any simultaneous drops among 93,398 prompts, thus assuring fault tolerance of the system. Also, the voting-based routing algorithm helped to overcome the challenge of trade-off between base rate fallacy (the challenge of finding the balance between security and usability) by making LightGBM and XGBoost classifiers, which were exhibiting opposite behavior, vote for their decisions. As a result, the system showed an outstandingly low FPR of 5.89%, while keeping the pipeline efficient by employing Llama Guard 3 only for ambiguous ($\Delta \le 2$) inputs.
• RQ2: Will a two-way verification approach (input and output filtering) be able to deal with "silent failures," should the input guardrails be circumvented? The threat assessment clearly highlighted that one-layered input filters were not enough for the prevention of adaptive prompt injections. As a result of interception of 1,359 attacks on the output layer—attacks which had managed to bypass the main ensemble filter—the two-way verification process became absolutely necessary in dealing with “silent failures”.
• RQ3: Is it possible to design an effective prompt injection protection mechanism using only open-source models? Empirical evidence from this study proves that enterprise-level security for language models does not have to rely on proprietary and black-box APIs. As a result of leveraging exclusively open source embedding models with sub-billion parameters (Snowflake, IBM Granite, MiniLM) in conjunction with tree-based classifiers (XGBoost, LightGBM) and an open weight expert model (Llama Guard 3), the system managed to achieve the accuracy rate of 90.69%. That shows that companies can build an efficient privacy-preserving defense mechanism solely on their local edge devices.

Production deployment of LLMs requires the ability to provide protection mechanisms that can withstand adversarial attacks in the form of complex prompt injections without compromising fundamental functionalities. The current research confirms that depending only on single detection models is insufficient to provide effective security against adversarial attacks within an enterprise. Experimental outcomes confirm that although embedding models possess inherent weaknesses, namely, their inability to process some prompt queries owing to tokenizer issues or API timeouts, the multi-vector solution developed within this work demonstrated high empirical fault resilience. Although the system misclassified 10,059 inputs, the 93,398 input prompts tested successfully without leading to a system crash, thus guaranteeing a continuous process despite some tokenizers failing.

Apart from physical redundancy, the model relies on behavioral diversity. The design takes advantage of the conflicting nature of the different approaches through the combination of the highly-sensitive Granite classifier (80.40% recall) and the conservative MiniLM+XGBoost approach (92.53% specificity). This way, by using mathematics to combine the conflicting models, the ensemble is able to get an 90.69% accuracy. Notably, this routing mechanism helps address the security vs. usability dilemma, which is prevalent among many single-layer defense strategies [2]. In contrast to the 13.08% false positives of a singular model such as Granite+LightGBM, the ensemble reduces this figure to 5.89%.

Implementation of the second triage level with the Llama Guard 3 was impressively successful. Similar to hybrid constitutional filtering systems [12], sending such prompts to this model introduced a very small delay of 0.72 seconds. The double check not only managed to stop the threats classified as S1 (toxic) on the input side, but also filtered out jailbroken responses at the output side. Therefore, this double filtering not only prevents abuse directly, but also reduces any potential repercussions from compromising the model’s operational parameters.

Though highly accurate predictions—with no decline observed whatsoever, even when subjected to severe GPU temperatures (61.0°C)—are achieved by the system, it still faces some restrictions, imposed not by the system itself, but by its external surroundings. The absence of a relationship between the prompt length and processing duration suggests that the 95th-percentile latency peaks (12.08 seconds) are caused not by computing, but by the network delay and rate limiting issues.

8. Future Research

Even with such a well-established architecture for security, the fast-changing nature of the attacks calls for continuous improvement within three core areas:

Overcoming “Confidently Wrong” Consensus: The main weakness of the proposed framework can be seen in the way in which highly advanced adversarial prompts can fool the entire model by leading to a wrong consensus, with low entropy. Future research on the matter should move beyond the realm of semantic embedding analysis, and also include internal monitoring of behavioral states (hidden states, activations, etc.), to pinpoint any irregularities caused by the processing of mathematical inputs. Specialized Routing: Moving on from general expertise towards domain-specific expertise is one way to significantly improve the security of the system. In the future, research should look into training the ensemble node with specialized instructions regarding particular contexts, such as financial data manipulation, privacy leaks, and code injection attacks. Infrastructure Optimization: In order to remove the unwanted tail latency due to network congestion, future efforts should assess the feasibility of using fully local, heavily quantized embeddings and classification models at the edge. By changing this architecture to an event-driven edge runtime environment, any dependency on API will be removed, making the multi-layer architecture a full-fledged protection system for autonomous LLM agents.