ChainGuard: A Layered, Stateful, and Provenance-Aware Runtime Security Architecture for Prompt Injection Defense in Locally Operated Large Language Models

Prompt injection remains a major security challenge for large language model (LLM) applications because untrusted content from retrieval systems, tools, memory, or multi-turn interactions can influence model behaviour without an enforced control–data boundary. This paper presents ChainGuard, a locally executable runtime security architecture that combines provenance-aware input handling, semantic and lexical analysis, lightweight local classification, bounded conversational state, policy enforcement, and output leakage detection. The finalized detector was evaluated on a researcher-authored post-development holdout comprising 80 attack sessions and 100 benign sessions, together with a matched transparent lexical baseline.

ChainGuard detected 61 of 80 attack sessions (76.25%; 95% CI: 65.86–84.24%) while falsely blocking 7 of 100 benign sessions (7.0%; 95% CI: 3.43–13.75%). The lexical baseline detected 1.25% of attacks with a 6.0% false-block rate, and paired attack outcomes significantly favoured ChainGuard (exact McNemar p<0.001). Detection was strongest for encoding, obfuscation, and indirect source injection, while multilingual attacks and protected-text transformations remained the main sources of detector escape.

These results show that the integrated ChainGuard architecture provides substantially broader detector-level coverage than the evaluated lexical baseline while remaining lightweight, local, and auditable. The study also highlights the need for future validation against learned guard models and independent public benchmarks.