LLM Firewall Using Validator Agent for Prevention Against Prompt Injection Attacks

Large Language Models with Retrieval-Augmented Generation are considered to be modern, chat-native interfaces to enterprise knowledge. However, deploying such systems safely requires precautions more advanced than input filtering. Numerous LLM-related security threats (including the top one: prompt injection attacks) demand robust defense mechanisms beyond input filtering. This paper extends our dual-agent RAG architecture as an LLM firewall with output-level security validation. Similar to network firewalls, which monitor semantic boundaries, we position the Validator Agent as a response firewall performing multi-feature security checks: prompt injection detection, policy compliance verification, sensitive information redaction, and toxic content filtering. While existing defense approaches focus mainly on input-level screening, our architecture proposes to analyze the output, where a successful attack becomes more obvious. The proposed architecture was verified to be viable using the Polish Bielik 2.3 LLM in an on-premise RAG system designed for energy auditing.