AI Security Suite
LLM Firewall - Prompt & Output Analysis
OWASP LLM Top 10 (2025) — Detection Coverage
Which recognised LLM-risk categories this module has a wired detector for today. "Active" means at least one real pattern/check in the LLM Firewall, Identity Scanner or Model Security scanner is tagged to that category — not that the category is fully covered. Categories with no detector are shown as roadmap, not hidden.
MITRE ATLAS — Agentic Technique Coverage (Aria's 40-Agent Loop)
The OWASP tile above answers "is there a detector for this risk category on a single LLM call".
This answers a narrower, harder question: does Aria's own 40-agent
investigation loop — the SOC analyst / threat hunter / incident responder agents in
src/agents/security_agents.py, watched
hop-by-hop for exfil-shaped tool sequences and destructive-tool-outside-declared-intent — have a
wired detector for each real, MITRE-published 2025 agentic technique (tool invocation, tool-credential
harvesting, agent context/memory poisoning, agent-config tampering). Every id shown is validated
against a registered technique; a technique with no wired detector is shown as roadmap, not hidden.
Non-Human Identity Scanner
AI Model Security Scanner
Model Artifact Provenance & Drift
Every model in Aria's sovereign router registry, with a real provenance check: where the artifact came from, its actual content hash (never fabricated), whether it has a cryptographic signature, and whether that hash has changed since the last check. Cloud-hosted models are honestly marked "not applicable" — there is no local artifact to hash. A model this backend has never verified shows "hash unavailable" or "unregistered", not a fake hash.
✅ What actually runs today
An honest inventory. Aria does not currently integrate any third-party guard vendor.
| Capability | How it works today | State |
|---|---|---|
| Prompt-injection / jailbreak check | Heuristic pattern matching on submitted text (LLM Firewall tab) | HEURISTIC |
| Non-human-identity scan | Static analysis of pasted config for exposed keys / over-broad scopes | HEURISTIC |
| Model-config review | Checklist scan of a supplied model/serving config | HEURISTIC |
| Data-residency enforcement | Real: fail-closed India/BFSI routing in the sovereign LLM router — off-shore models refused for locked tenants | LIVE |
| PII detection on prompts | Real: Indian-PII detector (incl. Indic-digit folding) in the router path | LIVE |
| Tamper-evident decision trail | Real: hash-chained decision ledger records every routing decision | LIVE |
🎯 Tier-0 target controls — the roadmap (T280–T292)
Prompt injection is not a model flaw — it's a system-architecture flaw. Every LLM is a non-human privileged user: scope it · audit it · sandbox it · watch its behaviour. These are the controls we are building toward; none is claimed as implemented.
| ID | Control | Intent | State |
|---|---|---|---|
| T280 | Prompt-injection firewall | Inline guard on customer-facing LLM calls; screen direct + indirect (retrieved-doc) PI | PLANNED |
| T281 | Agent sandbox | Per-task scope, ephemeral credentials, outbound FQDN allow-list; no super-agent | PLANNED |
| T282 | Tool-call approval | Human interstitial on file-write / http-POST / email-send / code-exec / db-mutate | PARTIAL — approval gate exists in the action path |
| T283 | Context segregation | Delimit system ≠ user ≠ retrieved ≠ tool-output; retrieved content is never instruction | PLANNED |
| T284 | AI-BOM | Track every model/version in production as an inventoried asset | PLANNED |
| T285 | Safetensors-only + picklescan | Refuse pickle deserialization of model weights in production | PLANNED |
| T286 | Shadow-AI discovery | Find unsanctioned LLM usage across the estate | PLANNED |
| T287 | RAG corpus signing + TTL | Sign and expire retrieved corpora so poisoned docs can't persist | PLANNED |
| T288 | Continuous model eval | PI-resistance / jailbreak / hallucination / bias regression gate before promotion | PLANNED |
| T289 | Per-session scope limits | Smallest scope that completes the task; audit every elevation | PLANNED |
| T290 | Jailbreak / many-shot detector | Entropy, role-play markers, long-conditioning and crescendo patterns | PARTIAL — heuristic patterns only |
| T291 | Output filter | Screen model output for secret / PII / training-data regurgitation | PLANNED |
| T292 | UEBA on agent traces | Behavioural baselines per agent to catch PI-driven exfil | PLANNED |
Sovereign angle: every guard above is intended to run on an India-resident model via the on-shore router, so screening never ships prompts off-shore.