Sangamesh.Dandin
Résumé
All projects

Case 01 / 09LLM securityCompleted

ZEROINJECT SHIELD.

Multi-LLM screening for prompt injection in a chat app.

A FastAPI middleware in front of a demo shop chatbot. An LLM first extracts the legitimate request from each message and blocks it outright if nothing legitimate remains. Three Groq-hosted verifiers (Llama 3.3 70B, Llama 3.1 8B and Qwen3 32B) then score the original text, their weighted consensus maps to BLOCK, SANITIZE or ALLOW, and rule-based overrides handle known attack phrases. Every decision is logged to SQLite and shown on a React dashboard.

What I built

  • Built the FastAPI middleware: LLM sanitization, an early block when no legitimate request remains, and enforcement before the chatbot is ever called.
  • Built the weighted three-model verifier ensemble on the Groq API and the threshold policy that turns its score into block, sanitize or allow.
  • Added rule-based overrides with a re-check of sanitized text, and SQLite logging behind a React analytics dashboard.
Problem
Prompt injection
Built with
FastAPI, React, Groq
Result
Block, sanitize or allow
  • LLM security
  • FastAPI
  • React
  • Groq API
  • SQLite
  • Multi-agent

▶Demo

See it work.

An animated walkthrough of the interface, not a screen recording. The scores and confidences shown are example values, not measurements.

01Architecture

How it's built.

Drawn from the project's source code, not its README: what each part actually does and how a request moves through it.

ZeroInject secure-chat detection and enforcement flow A chat message is sanitized by an LLM, blocked early if no legitimate intent remains, otherwise scored by three Groq-hosted verifier models with weighted consensus, mapped to BLOCK, SANITIZE or ALLOW by a threshold policy and router overrides, then either answered with a canned reply or forwarded to the chatbot model, with every completed request logged to SQLite for the analytics dashboard. CLIENT 01 SANITIZE 02 GATE 03 VERIFY + SCORE 04 POLICY 05 OVERRIDE 06 ENFORCE 07 LOG NO YES SCORE 1.0 SCORE FAST RECHECK Three verifiers evaluate the original input. A single-agent recheck of the sanitized text can subsequently change the decision. BLOCK SANITIZE/ALLOW NovaCart widget 5 regex: UI-only pre-scrub, ignored for detection; uses original_input sends POST /api/secure-chat GROQ Sanitizer llama-3.3-70b-versatile extracts the real request No legitimate intent? GROQ ×3 Verifier ensemble original_input · sequential, 1s gap Instruction Detector w 0.35 llama-3.3-70b-versatile Intent Classifier w 0.40 llama-3.1-8b-instant Semantic Safety w 0.25 qwen/qwen3-32b score = Σ wᵢ·pᵢ / Σ wᵢ pᵢ = conf if injection, else 1 − conf RULE Policy engine decide_action() ≥ 0.70 BLOCK ≥ 0.40 SANITIZE < 0.40 ALLOW policy kw (3): discount offer coupon + no strong cue → score capped 0.39 RULE Router overrides routers/secure_chat.py 1 one of 5 exact phrases in original → BLOCK, score 1.0 2 else, if text was sanitized: re-verify it, Agent 1 only < 0.40 + router kw → ALLOW can reverse BLOCK; sends the sanitized text SANITIZE + ≥ 0.40 → BLOCK router kw (7): discount product shipping offer coupon return track BLOCK canned reply by keyword chatbot never called GROQ Chatbot LLM llama-3.1-8b-instant SANITIZE → sanitized text ALLOW → original text, or sanitized text when the recheck forces ALLOW. STORE analysis_logs SQLite · verdict · injection_score · action_taken · agent1–3 verdicts · attack_type · chatbot_response Analytics dashboard reads GET /api/stats · GET /api/logs LEGEND Start / outcome Step Decision Detection core Store GROQ LLM call via Groq API RULE Deterministic Python Injection score HTTP Recheck / log write

Read from the code at commit f838bbb · Open full size ↗

02Under the hood

How it works.

  1. 01

    Sanitize

    An LLM extracts the legitimate request; if none is left, the message is blocked

  2. 02

    Verify

    Three LLM verifiers score the original message

  3. 03

    Consensus

    Weighted score across the three (0.35, 0.40, 0.25)

  4. 04

    Policy

    0.70 or more blocks, 0.40 or more sanitizes, otherwise allow; rule overrides on top

  5. 05

    Log

    Every decision is written to SQLite for the dashboard

→Up next · 02 / 09

Next project.

RedTeam Copilot AI — An automated recon-to-report pentest assistant.

Back to all projects