DECEPTION AS DEFENSE: A MIDDLEWARE APPROACH TO ADVERSARIAL ATTACK MITIGATION IN LLM-BASED SYSTEMS

Sammanfattning

Large Language Model (LLM)-based systems are increasingly deployed in high-stakes environments, making them attractive targets for adversarial attacks. The prevailing defensive paradigm, outright blocking of suspected malicious prompts, carries a structural weakness: it reveals to attackers when an attempt has been detected, enabling iterative refinement of attacks. This thesis investigates whether a deception-based defensive strategy, implemented as an external middleware layer, can serve as a more effective alternative. The work comprises three interconnected contributions. First, a structured narrative literature review with systematic search elements produces a taxonomy of adversarial attacks targeting the LLM interaction layer, covering prompt injection, jailbreak techniques, indirect manipulation, and goalhijacking. Second, a BERT-based intent classifier is designed and evaluated for its ability to identify adversarial inputs at the prompt level. Third, a Python prototype middleware is implemented that intercepts adversarial prompts and returns contextually plausible but misleading responses, while routing benign queries to the underlying LLM without modification. The system is evaluated against a blocking-based baseline using three metrics: attack success rate (M1), mean interaction turns per session (M2), and attacker recognition rate (M3). Experiments are conducted across ten standardised attack scenarios drawn from the HackAPrompt dataset and published jailbreak literature. Results demonstrate that deception-based performs comparably to blocking across the evaluated settings, with identical mean interaction length (M2) and no observable attacker recognition (M3). Due to the absence of annotated outcomes for successful attacks, the attack success rate (M1) could not be conclusively determined. The work concludes with design recommendations for integrating deception-based defenses into real-world LLM deployments. This thesis contributes to the emerging field of LLM security by establishing deception as a theoretically grounded and practically viable defensive paradigm, and by providing an open-source prototype that can be applied to existing LLM deployments without modification of the underlying model.