Structured PREreview of Mitigating LLM Prompt Injections via Multi-Vector Representation and Voting-Based Routing

Does the introduction explain the objective of the research presented in the preprint?

Yes

Justification: The introduction and abstract clearly articulate the security problem, architectural motivation, and core research objectives: Problem Context: Existing prompt injection defenses often suffer from high false-positive rates (the base-rate fallacy), disrupt user experience, or rely on proprietary black-box APIs or intrusive weight fine-tuning . Furthermore, single-embedding classifiers exhibit latent-space blind spots and tokenizer dropouts when handling non-standard Unicode or dense code blocks. Core Research Objectives: The introduction explicitly formulates three guiding research questions: RQ1: How does integrating a multi-vector semantic diversity layer with a voting-based consensus routing mechanism influence detection efficiency and false-positive rates? RQ2: Can a bidirectional verification framework (filtering both input prompts and generated responses) eliminate "silent failures" when input guardrails are bypassed? RQ3: Is it possible to deploy an enterprise-grade prompt injection defense using exclusively sub-billion parameter, open-source models on local edge hardware? Scope & Pipeline Architecture: The authors present a multi-layered defense pipeline combining a Triple Modular Redundancy (TMR) embedding layer (Snowflake Arctic-Embed, IBM Granite, MiniLMv2), a 6-classifier ensemble (XGBoost and LightGBM), an adaptive consensus router, and Llama Guard 3 as an expert fallback and output interceptor . The framework is empirically evaluated on a stratified dataset of 93,398 test prompts targeting a local Small Language Model (Gemma 3:1B).

Are the methods well-suited for this research?

Highly appropriate

Justification: The multi-layered defense methodology is well-engineered, sound, and directly addresses single-point-of-failure vulnerabilities inherent in single-embedding classifiers. Methodological Strengths: Triple Modular Redundancy (TMR) Embedding Layer: User inputs are simultaneously mapped into three distinct vector spaces using small open-source encoders under one billion parameters: Snowflake Arctic-Embed (33 million parameters), IBM Granite-Embedding (30 million parameters), and Sentence-Transformers MiniLMv2 (33 million parameters). This structural diversification prevents individual tokenizer dropouts and mitigates latent-space blind spots. Dual Gradient Boosting Ensemble: The framework trains two complementary gradient boosting decision tree models—XGBoost (optimized for high specificity) and LightGBM (optimized for high sensitivity)—across all three vector representations. This produces a robust six-classifier ensemble. Confidence-Based Consensus Routing: Predictions are evaluated using an adaptive vote margin defined as the absolute difference between safe and malicious votes across the six models. Queries with strong consensus take the Fast Route for immediate forwarding or blocking. Uncertain queries with a vote margin of two or fewer trigger the Slow Route, delegating the decision to an expert fallback model, Llama Guard 3. Bidirectional Output Interception: A secondary Llama Guard 3 filter inspects generated LLM output responses to catch late-execution payloads, system prompt leaks, and data exfiltration attempts that managed to bypass input guardrails. Edge Hardware Validation: The entire system was implemented and evaluated on local consumer hardware (an Intel i7 processor with an NVIDIA GeForce RTX 4070 GPU running Ollama) using a deduplicated, stratified dataset of 93,398 test prompts. Constructive Feedback: Quantifying Edge Latency Bottlenecks: While the Fast Route achieves fast decision times, processing ambiguous queries through the Slow Route introduces an average end-to-end latency peak of over twelve seconds on edge hardware. Adding a detailed breakdown separating local embedding calculation times from Ollama server overhead would provide clearer insights for real-time production deployment.

Are the conclusions supported by the data?

Somewhat supported

Justification: The empirical findings across the 93,398 test prompts provide strong statistical support for the core architecture claims, though certain boundary conditions and failure modes are explicitly noted. Key Empirical Strengths: End-to-End Pipeline Metrics: Enabling the full end-to-end pipeline (confidence routing plus output filtering) increased overall classification accuracy from an ensemble baseline of 89.23% to 90.69%. Overall recall (sensitivity) improved from 72.11% to 78.68%, while maintaining a low False Positive Rate of 5.89% and a high specificity. Bidirectional Output Interception: The secondary Llama Guard 3 output filter successfully intercepted 1,359 malicious responses that had bypassed initial input classification, reducing False Negatives by 23.5% without increasing false alarms . Triple Modular Redundancy (TMR) Fault Tolerance: While individual embedding tokenizers experienced dropouts on complex Unicode or dense code blocks (Snowflake dropped 8,427 prompts, MiniLM dropped 5,525, and Granite dropped 2,072), zero concurrent tri-model tokenization dropouts occurred across all 93,398 test cases. Constructive Bounds & Limitations: Confidently Wrong High-Consensus Errors: The authors transparently identify a key vulnerability: 1,987 false negatives (representing 19.7% of all errors) occurred when all ensemble classifiers were confidently incorrect with high probability (greater than or equal to 0.80). Because these misclassifications exhibited low entropy, they bypassed the Llama Guard 3 fallback. Model Scale Scope: Testing was conducted using Gemma 3:1B as a representative edge Small Language Model. While Gemma 3:1B serves as a useful worst-case baseline for edge vulnerability, evaluating whether these exact interception rates generalize to multi-billion parameter enterprise LLMs or agentic tool-use environments remains an important area for future study.

Are the data presentations, including visualizations, well-suited to represent the data?

Somewhat appropriate and clear

Justification: The visualizations and data presentations in the manuscript are informative, logically structured, and aligned with the defense pipeline, though minor visual formatting adjustments and an additional latency chart would further enhance readability. Visual Strengths: Architectural Flowchart (Figure 1): Figure 1 provides a clean, self-contained overview mapping the five-stage defense pipeline (from multi-vector mapping to consensus voting, Small Language Model execution, and output verification). Performance Benchmark Charts (Figures 3 and 4): Figures 3 and 4 effectively contrast individual sub-model performance, clearly highlighting the operational trade-off between XGBoost (higher specificity and lower false positive rate) and LightGBM (higher sensitivity and lower false negative rate) across all three embedding models. Threat Interception Breakdown (Figure 6): Figure 6 presents a clear bar chart breaking down the top threat categories caught at the input guardrail versus the output guardrail, demonstrating where the secondary filter adds value. Side-by-Side Confusion Matrices (Figure 7): Figure 7 displays side-by-side confusion matrices (evaluated on the 93,398 test set) comparing the baseline ensemble against the full end-to-end pipeline, making the reduction in false negatives easy to interpret. Constructive Feedback & Areas for Improvement: Visual Formatting Inconsistencies (Figure 2): In Figure 2 (showing missing predictions per embedding model due to tokenization dropouts), the bar styling and axis formatting could be harmonized with the rest of the manuscript's visual theme. Text Label Sizing in Summary Diagrams (Figure 5): In Figure 5 (ensemble voting accuracy breakdown), the text annotations and percentage labels are relatively small and can be difficult to read in lower-resolution print views. Latency Profile Plot: While the manuscript discusses latency metrics (such as Fast Route execution times and 95th-percentile tail latency peaks), adding a dedicated line plot or bar chart illustrating inference time distributions across Fast Route versus Slow Route calls under load would make the latency trade-off much clearer.

How clearly do the authors discuss, explain, and interpret their findings and potential next steps for the research?

Somewhat clearly

Justification: The authors provide clear analytical explanations for their architectural choices, transparently analyze system failure modes, and outline actionable future research directions. Strengths in Discussion and Interpretation: Architectural Rationale: The discussion clearly justifies why an even number of six classifiers (3 embedding spaces multiplied by 2 decision tree algorithms) was intentionally chosen: to induce statistical ambiguity (a vote margin of 2 or fewer) during obscure attacks, effectively triggering the Slow Route fallback to Llama Guard 3. Analysis of Failure Modes: The authors transparently examine the primary vulnerability of their system: "confidently wrong" low-entropy false negatives. They analyze how 1,987 malicious prompts bypassed the fallback filter because all six ensemble models misclassified them with high confidence (probability greater than or equal to 0.80). Value of Bidirectional Interception: The paper clearly explains why output verification is necessary, demonstrating that 1,359 malicious responses (such as system prompt leaks and data exfiltration payloads) were caught after evading initial input classification. Constructive Feedback & Next Steps: Dissecting Edge Latency Overhead: While the manuscript notes an average 95th-percentile tail latency peak of 12.08 seconds for Slow Route queries on edge hardware, the discussion could be expanded by explicitly separating local GPU embedding computation time from Ollama server communication overhead. Roadmap for Agentic & Larger Models: Section 8 identifies three actionable future research directions: (1) internal activation state monitoring to detect low-entropy adversarial bypasses, (2) domain-specific expert routing (such as financial, medical, or code guardrails), and (3) fully local event-driven edge deployments to eliminate network tail latencies. Outlining how this multi-vector defense scales to multi-tool agentic workflows or larger models (70B+ parameters) would further strengthen the research roadmap.

Is the preprint likely to advance academic knowledge?

Somewhat likely

Justification: The manuscript makes a practical contribution to applied AI security by demonstrating how multi-vector semantic diversity and confidence-based consensus routing can be implemented entirely using sub-billion parameter open-source models on edge hardware. Key Contributions to Academic Knowledge: Open-Source Reference Architecture: The paper provides a fully functional, open-source defense repository (github.com/adolfojara10/blue-team-ai) that operates locally without sending sensitive user prompts to third-party cloud API endpoints or requiring intrusive model weight fine-tuning. Bridging TMR Principles to LLM Guardrails: The study effectively adapts Triple Modular Redundancy (TMR) concepts from fault-tolerant hardware systems to natural language security. By simultaneously mapping inputs across three distinct bi-encoder latent spaces (Snowflake Arctic-Embed, IBM Granite, and MiniLMv2), it proves that structural diversification eliminates single-point tokenization dropouts and latent-space blind spots. Addressing the Usability-Security Trade-off: The confidence-based voting mechanism balances computational efficiency and detection accuracy. By utilizing an adaptive vote margin threshold, the system reserves heavy evaluation by Llama Guard 3 strictly for ambiguous split-vote queries (a vote margin of 2 or fewer), maintaining a low False Positive Rate of 5.89% while boosting overall recall. Demonstrating Bidirectional Interception: The paper empirically validates that output response filtering catches silent failures—intercepting 1,359 malicious payloads that managed to bypass initial input guardrails. Potential for Broader Impact: While the empirical validation focuses on a specific Small Language Model baseline (Gemma 3:1B) , the multi-vector TMR routing architecture provides a flexible blueprint that researchers and security engineers can extend to larger models, specialized domain guardrails, and autonomous agentic workflows.

Would it benefit from language editing?

Yes

Justification: The manuscript is generally well-written, logically structured, and easy to follow. However, it would benefit from a light pass of copyediting to polish minor grammatical colloquialisms and technical phrasing prior to formal publication. Areas for Minor Polish: Technical Phrasing & Terminology: A few expressions read slightly informally for a peer-reviewed publication. For example: Refining phrases such as "having a high amount of false positives" to "exhibiting a high false positive rate". Adjusting statements such as "performing a 1 billion parameter model" to "evaluating a 1-billion parameter Small Language Model". Sentence Structure & Flow: Streamlining occasional run-on sentences and passive voice constructions in the system implementation and discussion sections will improve readability. Heading & Acronym Consistency: Harmonizing capitalization across subheadings and ensuring all technical acronyms are formally defined on first mention. These minor refinements are easy to address and will elevate the manuscript to formal conference or journal publication standards.

Would you recommend this preprint to others?

Yes, but it needs to be improved

Justification: I recommend this preprint to security researchers, AI engineers, and system architects working on Large Language Model (LLM) guardrails and edge deployments. The paper introduces a practical, open-source defense architecture that successfully addresses the trade-off between security and user experience without relying on closed proprietary APIs or intrusive model retraining. Key Reasons for Recommendation: Innovative Architecture: Combining Triple Modular Redundancy (TMR) semantic diversification across three distinct bi-encoders (Snowflake Arctic-Embed, IBM Granite, MiniLMv2) with a six-classifier ensemble (XGBoost and LightGBM) provides an effective blueprint for preventing tokenizer dropouts and single-point classifier failures. Strong Empirical Results: On a large-scale test dataset of 93,398 prompts, the end-to-end system achieved an overall accuracy of 90.69%, a sensitivity of 78.68%, and a low False Positive Rate of 5.89%. Demonstrated Value of Bidirectional Interception: The secondary output filter successfully stopped 1,359 malicious responses that managed to bypass input guardrails, demonstrating the necessity of two-way verification. Open Science & Reproducibility: The authors provide a publicly accessible code repository containing their pipeline implementation, making their work easily verifiable and reusable by the community. Suggested Improvements Before Final Publication: Analyze Confidently Wrong Adversarial Bypasses: Provide deeper discussion on the 1,987 low-entropy false negatives where all ensemble models were confidently incorrect, and detail how internal activation state monitoring could address this vulnerability in future work. Deconstruct Edge Latency Distribution: Expand the latency discussion beyond noting the 12.08-second 95th-percentile tail latency peak by separating local GPU embedding computation times from Ollama network communication overhead. Visual & Proofreading Polish: Increase label font sizes in Figure 5, harmonize bar formatting in Figure 2, and conduct a light copyediting pass to polish minor technical phrasing.

Is it ready for attention from an editor, publisher or broader audience?

Yes, after minor changes

Justification: The paper introduces a solid, well-engineered, and reproducible open-source defense architecture against prompt injection attacks. It is ready for attention from an editor, publisher, or broader academic audience once the following minor, straightforward refinements are made: Analyze Confidently Wrong High-Consensus Evasions: Expand the discussion on the 1,987 low-entropy false negatives (where all six ensemble models were confidently incorrect with probability greater than or equal to 0.80) to explain how internal activation state monitoring can address this limitation in future work. Deconstruct Edge Latency Distribution: Dissect the 12.08-second 95th-percentile tail latency peak by separating local GPU embedding computation times from Ollama server communication overhead. Visual & Language Polish: Increase label text sizes in Figure 5, harmonize bar chart formatting in Figure 2, and conduct a light proofreading pass to polish minor technical phrasing.

Competing interests

The author declares that they have no competing interests.

Use of Artificial Intelligence (AI)

The author declares that they used generative AI to come up with new ideas for their review.