Defense-in-Depth for LLM Apps

Layered defense strategy for AI applications covering network, application, model, and output layers, how each layer contributes, and why single-layer defense always fails.

Defense-in-depth is the principle that no single security control should be trusted alone. For LLM applications, this means building multiple independent defense layers so that when one layer fails -- and it will -- others catch the threat.

The Four Defense Layers

Layer 1: Network and Infrastructure

This layer operates before any AI-specific processing occurs. It handles authentication, authorization, rate limiting, and transport security.

# Rate limiting middleware example
from datetime import datetime, timedelta
 
class RateLimiter:
    def __init__(self, max_requests: int = 60, window_seconds: int = 60):
        self.max_requests = max_requests
        self.window = timedelta(seconds=window_seconds)
        self.requests: dict[str, list[datetime]] = {}
 
    def check(self, user_id: str) -> bool:
        now = datetime.utcnow()
        user_requests = self.requests.get(user_id, [])
        # Remove expired entries
        user_requests = [r for r in user_requests if now - r < self.window]
        if len(user_requests) >= self.max_requests:
            return False
        user_requests.append(now)
        self.requests[user_id] = user_requests
        return True

What this layer cannot do: It cannot inspect content for semantic threats. A perfectly crafted jailbreak at 1 request per minute passes through all network-layer controls.

Layer 2: Application (Input Processing)

This layer analyzes and sanitizes inputs before they reach the model.

class InputProcessor:
    def __init__(self):
        self.prompt_shield = PromptShield()
        self.content_safety = ContentSafetyClient()
        self.max_input_tokens = 4096
 
    def process(self, user_input: str, session: Session) -> ProcessResult:
        # Size check
        if count_tokens(user_input) > self.max_input_tokens:
            return ProcessResult.blocked("Input exceeds maximum length")
 
        # Prompt injection detection
        if self.prompt_shield.is_injection(user_input):
            return ProcessResult.blocked("Input flagged as injection")
 
        # Content safety check
        safety = self.content_safety.analyze(user_input)
        if safety.max_severity > THRESHOLD:
            return ProcessResult.blocked(f"Content safety: {safety.category}")
 
        # Session-level behavior analysis
        session.add_message(user_input)
        if session.escalation_score > ESCALATION_THRESHOLD:
            return ProcessResult.blocked("Behavioral escalation detected")
 
        return ProcessResult.allowed(user_input)

What this layer cannot do: It cannot prevent the model from generating harmful content in response to benign-looking inputs, and it cannot detect attacks that the shield model has not been trained on.

Layer 3: Model (Inference Controls)

This layer constrains the model's behavior during generation.

What this layer cannot do: It relies on the model following instructions, which is exactly what prompt injection attacks subvert. Model-layer controls are necessary but never sufficient alone.

Layer 4: Output (Post-Processing)

This layer analyzes and sanitizes the model's output before returning it to the user.

Why Single-Layer Defense Fails

Consider this attack progression against a system with only input filtering:

Now the same attack against a defense-in-depth system:

Even when one layer fails, the remaining layers maintain protection.

Defense-in-Depth Checklist

Use this checklist to evaluate an application's defense coverage:

Further Reading

• Guardrails & Safety Layer Architecture -- detailed architecture of the application and output layers
• Runtime Monitoring & Anomaly Detection -- the cross-cutting monitoring layer
• Rate Limiting, Sandboxing & Execution Controls -- infrastructure-layer controls
• Red Team Findings to Remediation -- translating defense gaps into actionable findings

Related Topics

• Guardrails & Safety Layer Architecture - Detailed architecture of the application and output layers
• Runtime Monitoring & Anomaly Detection - The cross-cutting monitoring layer
• Rate Limiting, Sandboxing & Execution Controls - Infrastructure-layer controls
• Red Team Findings to Remediation - Translating defense gaps into actionable findings
• AI System Architecture for Red Teamers - Component-level view of the systems these defenses protect

References

• "Defense in Depth: A Practical Strategy for Achieving Information Assurance" - NSA (2012) - Foundational document on layered defense strategy adapted for AI applications in this page
• "NIST Cybersecurity Framework" - NIST (2024) - Framework for organizing defense controls across identify, protect, detect, respond, and recover functions
• "Securing LLM-Integrated Applications" - Microsoft Security (2024) - Practical guidance on implementing multi-layer defense for LLM applications
• "OWASP Top 10 for LLM Applications" - OWASP (2025) - Risk classification that maps to specific defense layers in a depth strategy