Skip to content

Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models

🕒 Published (v1): 2026-07-09 09:23 UTC · Source: Arxiv · link

Why this paper was selected

Multi-agent firewall for LLM privacy; practical open-source architecture for safe agentic deployments

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper proposes Minos Verdict Mesh, an open-source, local-first multi-agent firewall that intercepts LLM-bound traffic via a browser extension and MiTM proxy, then runs a DAG-orchestrated hybrid detection pipeline (deterministic + NER + LLM semantic agents) to prevent sensitive data leakage. It achieves F1 scores up to 94.93% on optimal configurations while keeping all inference on-premises.

Problem

Existing DLP approaches for LLM interactions suffer from three mutually exclusive limitations: SDK-integrated tools require source-code access and cannot protect end-users; cloud inspection services create a privacy paradox by routing sensitive prompts through external vendors; private LLM deployments eliminate frontier-model capability. No prior system provides transparent, local, semantically-aware interception across both browser and API channels simultaneously.

Method

The framework combines two interception sensors with a backend multi-agent pipeline:

Interception layer: - A Chromium Manifest V3 browser extension using an adapter pattern over platform-specific DOM structures to intercept prompts and file uploads before submission. - A transparent MiTM proxy (via mitmproxy) covering HTTP(S) and WebSocket Secure (WSS) traffic, with selective host/path filtering to target known LLM provider endpoints.

Multi-agent security pipeline (implemented as a DAG state machine via LangGraph): 1. Document ingestion: OCR for standard formats; VLM-based analysis for screenshots/unstructured visual data. 2. Deterministic detectors: Regex/pattern matching for structured PII. 3. NER agent: SpaCy-based named-entity recognition for semi-structured entities. 4. Code similarity node: Fuzzy string matching against indexed public/private Git repositories to detect proprietary code leakage even when snippets are paraphrased or embedded in natural language. 5. Conditional escalation: Only when earlier stages yield findings does the pipeline invoke a local LLM semantic reasoning agent for contextual analysis. 6. Risk/policy engine: Assigns configurable risk levels; outputs block/warn verdicts, or an anonymized sanitized prompt with typed placeholders replacing sensitive values.

The pipeline applies a Privacy Agentic Workflow internally—sensitive fields detected in early stages are sanitized before being forwarded to any optional third-party detection modules, preventing leakage within the pipeline itself.

Key Contributions

  • Dual-layer transparent interception (browser extension + MiTM proxy) requiring zero application-side modification.
  • DAG-orchestrated multi-agent pipeline with tiered escalation from low-latency deterministic detectors to LLM semantic agents, avoiding unnecessary LLM invocation.
  • Proprietary code leakage detection via fuzzy matching against indexed Git repositories, robust to paraphrasing.
  • Multimodal analysis supporting PDF, images, and code files via OCR + VLM.
  • Intra-pipeline privacy preservation: sensitive fields are anonymized before reaching any external/optional detection module.
  • Provider-agnostic LLM backend (local open-weight models, proprietary APIs, or trusted cloud) without architectural change.
  • Human-in-the-Loop (HITL) graduated enforcement in the browser extension (block / warn / sanitize-and-send / override) versus fully automated enforcement in the proxy (HTTP 403 / WebSocket drop).
  • Fail-closed policy on backend unavailability in both sensors.

Results

  • Achieves F1 = 94.93% on optimal pipeline configurations (specific benchmark dataset and baseline comparisons not detailed in the provided excerpt).
  • Evaluation covers multiple pipeline configurations trading off computational cost, detection depth, and latency (full details in Section 5, not included in the excerpt).

Limitations

  • Evaluation details (dataset composition, per-class breakdown, latency numbers, baseline comparisons) are in Section 5, which was truncated—specific benchmark provenance cannot be verified from the provided text.
  • Browser extension limited to Chromium-based browsers; no Firefox support noted.
  • Adding new binary document formats (e.g., .docx) requires additional parsing dependencies.
  • Standalone single-device deployment is compute-constrained; heavy LLM agents require a centralized local server for robust performance.
  • Code leakage detection relies on fuzzy matching, which may struggle with heavily transformed or semantically equivalent but syntactically distant code.
  • Current scope is user→LLM direction only; LLM→user response monitoring is listed as future work.
  • LPPA-style syntactic obfuscation of prompts could partially evade the deterministic/NER stages before LLM escalation is triggered.

Relevance to Agentic AI / LLM Agents

Agentic and programmatic LLM usage (CLI tools, IDE integrations, agent pipelines) is a primary threat vector this work explicitly targets—the MiTM proxy is designed precisely for API-level interception of agentic traffic, including WebSocket-based real-time inference used by agent runtimes. The intra-pipeline privacy workflow (sanitizing fields before passing data to sub-agents) is directly analogous to the data-handling challenges in multi-agent orchestration systems, where intermediate agents may inadvertently expose context to external services. For researchers tracking LLM agent security, this paper provides a concrete, deployed architecture for runtime data-leakage guardrails that complement prompt-injection defenses, and its DAG/LangGraph-based agent orchestration pattern is representative of the broader trend of using agent pipelines for security enforcement rather than rule-based static filters.