The Big Picture
A three-stage agent pipeline plus semantic caching eliminated high-risk prompt injections on a 301-prompt test, while reducing model calls by about 41.6% and improving overall vulnerability metrics by 67%.
ON THIS PAGE
The Evidence
A generator, a guard that sanitizes outputs, and a final policy enforcer—each paired with short- and long-term semantic caches—work together to block injection attacks reliably. Across 301 adversarial prompts spanning ten attack families, no prompt produced a high-risk breach and 84.4% of prompts were classified secure. Reusing previously seen responses via semantic similarity saved many model calls and made behavior more consistent, though increased transparency choices slightly traded off with the strictest compliance scores. guardrails-pattern and Semantic Capability Matching Pattern.
Not sure where to start?Get personalized recommendations
Data Highlights
10 high-risk breaches out of 301 adversarial prompts (zero prompts reached the high-risk threshold).
267% improvement in the composite vulnerability score (TIVS-O) vs a memoryless baseline under the tested configurations.
341.6% reduction in model calls (semantic cache hit rate leading to 527 actual calls vs 903 baseline calls for the 301 prompts).
What This Means
Engineers building production agent pipelines: adopt layered defenses with semantic caching to stop repeated injection templates and cut compute. Security and compliance teams: use the guard + enforcer pattern to add audit-friendly checks and reduce the chance of data leakage. Technical leaders evaluating agent reliability: this shows a practical trade-off between transparency and the strictest compliance that you’ll need to tune for your risk profile. In practice, teams can apply Consensus-Based Decision Pattern to coordinate guardrails and policies across agents.
Key Figures
Fig 1: Figure 1: OFP-based multi-agent pipeline. The user submits a prompt via OFP_REQUEST; the Front-End Agent produces an initial response (OFP_RESPONSE); the Guard-Sanitizer reviews and sanitizes it (OFP_REVIEW); and the Policy Enforcer delivers the final output (OFP_FINAL) back to the user. A separate KPI Evaluator receives all intermediate outputs to compute injection vulnerability metrics (TIVS-O and OSR) over the full pipeline.
Fig 2: Figure 2: Agent–CMS pairing. Each of the three main agents is equipped with a dedicated Continuum Memory System that maintains medium-term memory (MTM) for recent prompts and long-term memory (LTM) for frequently recurring patterns, as described in Section 5 .
Fig 3: Figure 3: Nested Learning memory consolidation flow. User prompts are embedded and checked against MTM cache ( τ = 0.87 \tau=0.87 threshold). Cache misses trigger LLM inference, with responses stored in MTM using LRU eviction. Periodic consolidation (every 10-100 prompts) promotes frequently accessed entries from MTM to LTM using LFU policy.
Fig 4: Figure 4: Agent generation controller decision flow. The controller coordinates cache lookups, LLM invocations, and memory updates according to configured update frequencies (Frontend: MTM every 10 prompts, Guard-Sanitizer/Policy Enforcer: every 5 prompts).
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreConsiderations
The evaluation used a synthetic, curated 301-prompt corpus and specific open-weight models run locally; results may differ with other datasets or commercial models. Semantic caching relies on a tuned similarity threshold (0.87) that can cause false matches or misses if not retuned for your traffic. Observability choices increased clarity (more reasoning exposed) but led to a small drop in the strictest compliance score, so pick your observability-security balance deliberately. Retrieval-Augmented Generation.
Methodology & More
A three-stage pipeline—front-end generator, guard-sanitizer, and policy enforcer—was tested against 301 adversarial prompts covering ten attack types. Each agent has a Continuum Memory System with a medium-term cache (least-recently-used) and a long-term store (least-frequently-used) that consolidates frequent patterns. Prompts are embedded using a sentence transformer and compared by cosine similarity with a threshold of 0.87; hits let the system reuse earlier responses and associated security metadata instead of calling the model again. A separate evaluator computed five metrics (infection success, policy overrides, sanitization rate, compliance consistency, and an observability score) and a composite vulnerability score called TIVS-O across multiple weighting configurations. LLM-as-Judge across evaluator configurations. Results showed zero high-risk breaches and a 67% improvement in the composite vulnerability score over a memoryless baseline, while semantic caching cut the number of model calls by 41.6%. Cache hit rates rose in downstream layers, producing more consistent, repeatable responses and reducing variability that attackers could exploit. The trade-offs: adding observability (more explicit reasoning and metadata) improved auditability but slightly reduced the strictest compliance score, and the synthetic dataset plus local model choices mean teams should validate the approach with their real traffic. The implementation and configs are provided open-source and the prompt dataset is available to vetted researchers for replication and further tuning.
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
Authors have low h-index values and no recognizable top-affiliations; arXiv venue.