• Prathmesh Mishra
• Rashid Patel

Grounded generation frameworks relying on dense vector retrieval have become standard practice for curbing hallucinations and integrating private institutional knowledge into large language models. However, expanding the inference boundary to uncurated external corpora introduces an insidious vulnerability: indirect prompt injection. By embedding adversarial control directives inside retrieved passages—such as customer tickets, vendor contracts, or scraped documentation—attackers can hijack internal decoder attention, trigger unauthorized tool calls, or precipitate corporate data exfiltration. Conventional defenses present an impractical dilemma. Static regular expression filtering executes with negligible overhead but collapses under semantic paraphrasing and obfuscation, whereas external cloud-hosted guardrails (e.g., Llama Guard or auxiliary LLM evaluators) incur prohibitive latency penalties (800–1200 ms), substantial recurring operational costs, and confidentiality compliance violations. To reconcile this security-efficiency tension, we design, implement, and benchmark a localized, five-tier defensive gateway. Integrated into an end-to-end operational pipeline (rag_app), our system cascades: 1. Deterministic boundary and pattern filtration 2. Binary magic-byte validation and active object-tree sanitization (excising PDF JavaScript, launch actions, and embedded OLE macros via PyMuPDF) 3. Localized semantic intent classification driven by an on-premises compact model (Ollama Qwen2.5-3B) 4. Structural schema and encoding enforcement (neutralizing non-printable Unicode planes, token-flooding denial-of-service, and base64 payloads) 5. Sliding-window transaction throttling coupled with SHA-256 deduplication Filtered chunks are indexed within a pgvector datastore using Hierarchical Navigable Small World (HNSW) indexing, and answer generation is restricted to grounded Gemini Flash. Extensive benchmarking across 39 automated integration suites and 500 adversarial payloads demonstrates that the localized gateway attains a 96.8% injection detection recall, maintains a low 3.6% false positive rate, and restricts amortized latency to 18.5 ms—achieving a 98.0% latency reduction over cloud guardrails while preserving absolute on-premises data privacy.

Retrieval-Augmented Generation (RAG), Indirect Prompt Injection, Input Sanitization, Defensive Gateway, Vector Database Security, Local Language Models (SLM), Adversarial Robustness, Zero-Trust AI Architecture.

" Mitigating Indirect Prompt Injection in RAG Architecture via Localized Input Sanitization.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 9, page no.b475-b481, September-2026, Available :http://www.jetir.org/papers/JETIR2609155.pdf

" Mitigating Indirect Prompt Injection in RAG Architecture via Localized Input Sanitization.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 9, page no. ppb475-b481, September-2026, Available at : http://www.jetir.org/papers/JETIR2609155.pdf