Abstract

This document discloses an architecture, at a security gateway that mediates a language model’s use inside an organisation, for operating a model that must be assumed untrusted — because the dominant model supply-chain threat is behavioural, not byte-level. A poisoned or backdoored model (weight-level backdoor, trigger-phrase exfiltration, memorised-secret leakage, injection-amplification, steganographic encoding) is byte-authentic: its content hash and any signature over its weights verify perfectly, because the taint lives in learned behaviour, not in the bytes.

Detecting such behavioural backdoors from weights is an open research problem this disclosure does not claim to solve. Instead the disclosed principle is contain the consequence, do not detect the cause: treat the model as a hostile component inside a zero-trust perimeter and bound what a tainted model can do. The disclosed contribution is a composition of six co-operating controls, applied specifically to a byte-authentic behaviourally-tainted model, that together convert “a model may be bad” into a bounded, provable incident:

(1) an egress-contained model runtime — the inference process has no network reachability except back through the gateway, so a tainted model has no socket to phone home and every action it attempts is policy-mediated;

(2) output-path data-loss inspection — every token the model emits is inspected on the egress path for secrets, keys, and encoded exfiltration before it can leave, with a bounded-lag streaming buffer that blocks (not merely redacts) on a hard match and is recursive-decode-aware and session-aggregating so encoding tricks do not defeat it;

(3) least-privilege per-model capability identity — each model runs under a scoped cryptographic workload identity, and policy authorises tool calls at the level of the arguments, not merely the tool name, so a tainted model’s blast radius is its explicit grant, not the whole tool surface;

(4) a quarantine-to-promote onboarding gate — a newly imported/converted model enters a restricted tier (no tool access, extra output scrutiny, rate-limited) and is admitted to normal service only after passing a signed, versioned canary battery compared against a behavioural baseline, with the quarantine state derived from a fail-closed catalogue keyed on model digest and re-enforced at policy on every request;

(5) digest-bound inference provenance — every inference is bound, in a tamper-evident audit chain, to the exact model digest that served it, so when taint is disclosed later the operator can answer instantly which digest, which requests, which users, which data, between when and when and scope the incident;

and (6) fleet-wide digest revocation — allowlist-by-digest means removing a poisoned digest stops it serving across every deployment immediately, enforced by a fail-closed live-deny check and an active push that terminates already-loaded (“hot”) model processes, so revocation reaches models that were pinned resident and would never reload.

The disclosed unit is the composition and its synergy as applied to a byte-authentic tainted model; each mechanism is also disclosed individually and enablingly so that no third party may later patent either the whole or any part in a form assertable against the inventor or others.

Keywords: tainted model; poisoned model; model backdoor; weight-level backdoor; behavioural backdoor; byte-authentic taint; model supply chain; MLSecOps; blast-radius containment; contain-not-detect; security gateway; LLM gateway; egress containment; ring-fence; output-path DLP; data-loss prevention; secret exfiltration; streaming inspection; bounded-lag buffer; recursive decode; least-privilege; per-model identity; capability identity; SPIFFE; workload identity; argument-level authorization; Open Policy Agent; OPA; quarantine; canary battery; behavioural baseline; promotion gate; model digest; content-addressed; inference provenance; tamper-evident audit; Merkle chain; incident scoping; fleet revocation; kill-switch; digest allowlist; live-deny; hot-process termination; air-gap; regulated AI; agentic AI security.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS