Wrap
Content is marked with signed Guard Band boundaries that authenticate the body and marker metadata.
LLM application security
Cryptographic boundaries for untrusted LLM content.
Guard Bands is an open protocol and small library for making user-controlled content inert by default before it reaches trusted instructions, policy paths, or MCP tool execution.
Signed inert boundary
INERT:START v nonce iat exp
Untrusted content is wrapped, signed, bound to context, freshness-checked, verified, and audited before sensitive handling.
VERIFY -> ENFORCE -> AUDIT
The problem
LLM apps often mix data and authority in one channel.
Documents, emails, tickets, web pages, and other untrusted inputs can contain text that looks like instructions: ignore policy, reveal private data, call a tool, update a record, or treat user content as system policy.
Prompt wording helps, but it is not a security boundary. The application needs a verifiable way to distinguish untrusted content from trusted control paths before sensitive operations happen.
The approach
Wrap, bind, verify, enforce.
Guard Bands adds a cryptographic control plane around untrusted content, similar in spirit to how prepared statements separate SQL data from SQL commands.
Bind
The signature binds content to context such as tenant, user, request, workflow, issuer, lifetime, or policy path.
Verify
The application checks the marker, MAC, nonce, key id, issuer, expiry, and expected context before trust.
Enforce
Tool calls and policy-controlled paths fail closed unless the content was verified first.
Two-channel architecture
Untrusted data and trusted instructions on separate services.
The separate reference deployment demonstrates a two-channel architecture: a data plane that can only wrap untrusted content into signed inert blocks, and a control plane that holds the tools. The planes deploy as separate services on different ports, hosts, or network segments, and they hold different keys: the data plane signs with an Ed25519 private key, and the control plane holds only the public key, so even a fully compromised control plane cannot forge data-plane provenance. The complete deployment lives in guard-bands-reference, rather than in the core library.
The control plane admits data only when the signature proves it came through the data plane (key id, issuer, and channel binding are all authenticated), and takes instructions exclusively from its own authenticated channel. An injected instruction inside a document selects nothing, and tampered, unwrapped, or foreign-issuer content is rejected fail-closed at the single cryptographic join point. Both planes refuse to start without real key material — there are no development fallback keys.
Threat model
The model is not the root of trust.
Guard Bands helps prevent forged safe-content markers, tampering, replay in the wrong context, confusion between data and instructions, and unverified content reaching sensitive tool calls.
It does not make LLMs intrinsically safe or truthful. Production systems still need authorization, least-privilege tools, sandboxing, output validation, monitoring, and human review where appropriate.
Project structure
Small core, interoperable implementations, separate deployment.
The reusable boundary mechanism now lives independently from the larger evaluation stack. Python and TypeScript share protocol v2 and deterministic conformance vectors; operational examples live in a separate reference repository.
Python core v0.11.0
TypeScript core v0.1.0
Protocol v2 with RFC 8785/JCS canonical JSON
HMAC-SHA256 and Ed25519 signing with domain separation
Verification-only public keys for split trust
Full marker-metadata authentication
Issued and expiry timestamps
Context binding
Inline text bands and detached JSON envelopes
Reserved-marker parser hardening
FastAPI verification middleware
MCP 2.x tools/call input and output verification
Visible Guard Bands around MCP text outputs
Cross-language HMAC, Ed25519, and MCP vectors
Legacy protocol v1 verification during migration
Python and Node quality gates plus CodeQL
Explicit independent-review gate before v1.0.0
Python core
The canonical protocol implementation, FastAPI middleware, MCP integration, replay primitives, and normative specification.
Open guard-bandsTypeScript core
A Node.js implementation of protocol v2 and MCP wrappers, tested against the same language-neutral vectors.
Open guard-bands-tsReference deployment
The API, SDK, two-channel services, identity, audit, secret-manager, Docker, and evaluation examples.
Open guard-bands-referenceReference deployment
Operational examples without bloating the core.
guard-bands-reference contains the local multi-service stack with API, Postgres, Keycloak, oauth2-proxy, audit logging, cost checks, SDK examples, and demo integration flows.
It also includes a hardened production overlay with a TLS front door, optional AWS Secrets Manager or HashiCorp Vault secret backends, release notes, API examples, replay-protection notes, key-management expectations, and security tests around the boundary mechanism. Core code is consumed as a versioned dependency and is not copied between repositories.
Validation
Security tests exercise the boundary.
Python and TypeScript reproduce deterministic protocol v2 signatures byte-for-byte. The suites cover signature verification, context binding, content tampering, marker hardening, algorithm and version confusion, detached JSON values, MCP call binding, middleware enforcement, and replay behavior.
The result is not a complete LLM security platform. It is a concrete, inspectable pattern for separating untrusted data from application authority.
Project status
Research and evaluation, not production-ready as-is.
Guard Bands is suitable for reviewing the pattern, testing the API flow, evaluating the threat model, experimenting with LLM boundary enforcement, and extending the implementation.
What is implemented
Python v0.11.0, TypeScript v0.1.0, protocol v2, HMAC and Ed25519, inline and detached envelopes, FastAPI middleware, MCP tools/call protection, conformance vectors, and a separate reference deployment.
Production gaps
The libraries are not yet published to PyPI or npm. Remote KMS/HSM signing is designed but not implemented, and independent protocol/security review is still required before v1.0.0.
Security notes
Review is publicly tracked in GitHub issue #31. Guard Bands authenticates data boundaries; it does not make signed content true, benign, or authorized, and it does not replace application policy.