Wrap
Content is marked with signed Guard Band boundaries that authenticate the body and marker metadata.
LLM application security
Cryptographic boundaries for untrusted LLM content.
Guard Bands is a working proof-of-concept for making user-controlled content inert by default before it reaches trusted instructions, policy paths, or tool execution.
Signed inert boundary
INERT:START v nonce iat exp
Untrusted content is wrapped, signed, bound to context, freshness-checked, verified, and audited before sensitive handling.
VERIFY -> ENFORCE -> AUDIT
The problem
LLM apps often mix data and authority in one channel.
Documents, emails, tickets, web pages, and other untrusted inputs can contain text that looks like instructions: ignore policy, reveal private data, call a tool, update a record, or treat user content as system policy.
Prompt wording helps, but it is not a security boundary. The application needs a verifiable way to distinguish untrusted content from trusted control paths before sensitive operations happen.
The approach
Wrap, bind, verify, enforce.
Guard Bands adds a cryptographic control plane around untrusted content, similar in spirit to how prepared statements separate SQL data from SQL commands.
Bind
The signature binds content to context such as tenant, user, request, workflow, issuer, lifetime, or policy path.
Verify
The application checks the marker, MAC, nonce, key id, issuer, expiry, and expected context before trust.
Enforce
Tool calls and policy-controlled paths fail closed unless the content was verified first.
Two-channel architecture
Untrusted data and trusted instructions on separate services.
The two-channel reference architecture separates the planes twice over: a data plane that can only wrap untrusted content into signed inert blocks, and a control plane that holds the tools. The planes deploy as separate services on different ports, hosts, or network segments, and they hold different keys: the data plane signs with an Ed25519 private key, and the control plane holds only the public key, so even a fully compromised control plane cannot forge data-plane provenance.
The control plane admits data only when the signature proves it came through the data plane (key id, issuer, and channel binding are all authenticated), and takes instructions exclusively from its own authenticated channel. An injected instruction inside a document selects nothing, and tampered, unwrapped, or foreign-issuer content is rejected fail-closed at the single cryptographic join point. Both planes refuse to start without real key material — there are no development fallback keys.
Threat model
The model is not the root of trust.
Guard Bands helps prevent forged safe-content markers, tampering, replay in the wrong context, confusion between data and instructions, and unverified content reaching sensitive tool calls.
It does not make LLMs intrinsically safe or truthful. Production systems still need authorization, least-privilege tools, sandboxing, output validation, monitoring, and human review where appropriate.
Current POC
A working implementation with realistic controls.
The core project is the Guard Bands boundary mechanism. The POC also includes practical controls smaller teams often want from enterprise LLM security stacks without adopting a heavyweight platform. It is published as versioned, tagged releases — see the GitHub repository for the latest.
HMAC-SHA256 and Ed25519 signing with domain separation
Verification-only public keys for split trust
Full marker-metadata authentication
Two-channel data-plane / control-plane architecture
Issued and expiry timestamps
Context binding
Canonical context serialization
FastAPI wrap / verify / chat endpoints
FastAPI verification middleware
Python SDK for the API and two-channel APIs
Reference support-ticket app
50 KB content limits
Per-user or per-IP rate limiting
Preflight LLM cost guardrails
Identity-aware audit logs
PostgreSQL and Splunk sinks
Async audit fan-out
Keycloak and oauth2-proxy SSO
Pluggable secrets: env, AWS Secrets Manager, or Vault
Pytest coverage
CodeQL and GitHub secret scanning
GitHub Actions CI for Python 3.11 and 3.12
Pinned dependencies and Dependabot
Tagged releases with release notes
Docker Compose evaluation stack
Hardened production Compose overlay
Non-root container image
Enterprise-style controls
Built to evaluate in realistic application conditions.
The repository includes a local multi-service stack with API, Postgres, Keycloak, oauth2-proxy, audit logging, cost checks, and demo integration flow.
It also includes a hardened production overlay with a TLS front door, optional AWS Secrets Manager or HashiCorp Vault secret backends, release notes, API examples, replay-protection notes, key-management expectations, and security tests around the boundary mechanism.
Validation
Security tests exercise the boundary.
The included test suite covers signature verification, context binding, content tampering, forged marker rejection, unwrapped content rejection, malformed marker hardening, middleware enforcement, reference-app authorization flow, replay ledger behavior, and normal wrapped-content verification.
The result is not a complete LLM security platform. It is a concrete, inspectable pattern for separating untrusted data from application authority.
Project status
Research and evaluation, not production-ready as-is.
Guard Bands is suitable for reviewing the pattern, testing the API flow, evaluating the threat model, experimenting with LLM boundary enforcement, and extending the implementation.
What is implemented
HMAC-based wrapping and verification, authenticated metadata and freshness, a two-channel data/control-plane reference architecture, app-side fail-closed enforcement, context binding, API endpoints, cost guardrails, audit events, SSO-aware identity propagation, and automated tests.
Production gaps
The default stack is evaluation-focused. Production still needs environment-specific authorization design, distributed replay handling, retention policy, operational review, and a key-rotation workflow.
Security notes
A hardened overlay, non-root image, and secret-manager support are now included, but the cryptographic signal is useful only when the surrounding application enforces policy from it.