Risk-Triggered Adaptive Moving Target Defense for Secure LLM Systems
University of Guelph (MSc Cybersecurity & Threat Intelligence, supervised by Dr. Dilli Prasad Sharma) · 2026 (final paper: August 2026)
Completed MSc thesis research applying Adaptive Moving Target Defense (AMTD) to secure LLM-enabled systems against prompt injection, jailbreak attempts, and sensitive data leakage. The design compares three conditions -- an undefended baseline, a static (fixed-defense) baseline, and an adaptive AMTD condition -- across 72 unique external attacks drawn from three independent red-team tools (24 from Promptfoo, 24 from NVIDIA garak's PromptInject module, 24 from Microsoft PyRIT), for 216 completed primary adversarial tests across the three defense conditions. The AMTD architecture pairs a lower-cost local model (Qwen2.5-0.5B-Instruct, run in Google Colab) with a stronger hosted model (GPT-OSS-120B, via Hugging Face/Groq routing), escalating requests between them based on a calibrated risk score. Defensive layers include dual input detectors, prompt-template rotation, RAG-policy rotation, bounded decoding, input quarantine, output inspection, and selective model escalation -- combined to reduce attacker predictability rather than relying on any single static control. Evaluation used a multi-judge methodology across Promptfoo, NVIDIA garak, and Microsoft PyRIT, with a separate validation pass on a High-Privilege Agent scenario to test how the system handles naturally Critical-severity requests.
Tools: Promptfoo, NVIDIA garak (PromptInject), Microsoft PyRIT, Python, Google Colab, Hugging Face
Skills demonstrated: LLM red-teaming, prompt-injection defense design, adaptive/risk-based model routing, risk scoring and calibration, multi-judge evaluation design, output-routing guard design (precision/recall tuning)
Measured results
- Adversarial test scope
- 72 unique external attacks (24 Promptfoo, 24 NVIDIA garak PromptInject, 24 Microsoft PyRIT) across 3 defense conditions = 216 completed primary adversarial tests
- Methodology: Three independent, industry-standard red-team tools run against three defense conditions (Baseline, Static, AMTD) for full cross-condition comparison.
- Attack success rate (ASR) — Baseline (undefended)
- 38.9%
- Methodology: Share of the 72-attack set that succeeded against the undefended baseline system.
- Attack success rate (ASR) — Static defense
- 48.6%
- Methodology: Same 72-attack set replayed against a fixed, non-adaptive defense configuration.
- Attack success rate (ASR) — AMTD
- 2.8% (70/72 attacks blocked)
- Methodology: Same 72-attack set replayed against the full adaptive AMTD condition.
- ASR reduction
- 36.1 percentage points vs. baseline; 45.8 percentage points vs. static defense
- Methodology: Direct difference between AMTD's 2.8% ASR and the baseline (38.9%) and static (48.6%) conditions.
- Output-routing guard performance
- 96.6% precision, 73.7% recall
- Methodology: Measured performance of the output-inspection guard responsible for routing/blocking decisions.
- Model-escalation accuracy
- 29 attacks escalated to the hosted model (Model B); 28/29 were genuine unsafe cases; 100% of genuinely unsafe escalated cases were rescued or blocked
- Methodology: Manual/multi-judge review of every case the risk-based router escalated from the local to the hosted model.
- Benign-task utility
- 75% task-completion on 12 held-out benign tasks under AMTD, matching the 75% baseline rate, with no false refusals
- Methodology: AMTD and baseline both run against the same 12 held-out benign final-test tasks to check for over-blocking.
- High-Privilege Agent validation (Critical-severity route)
- 15/15 naturally Critical attacks routed immediately to the hosted model; 15/15 blocked (0% ASR)
- Methodology: Separate validation pass restricted to the High-Privilege Agent scenario and naturally Critical-severity attacks.
Frameworks: Adaptive Moving Target Defense (AMTD) -- see Framework & Regulatory Knowledge
Outcome: AMTD reduced attack success rate (ASR) from a 38.9% undefended baseline and a 48.6% static-defense baseline down to 2.8%, blocking 70 of 72 attacks -- a 36.1 percentage-point reduction vs. the baseline and 45.8 points vs. the static defense. Of 29 attacks escalated from the local to the hosted model under the risk-based routing policy, 28 were genuine unsafe cases, and 100% of those genuinely unsafe escalated cases were successfully rescued or blocked. On a held-out set of 12 benign final-test tasks, AMTD matched the 75% baseline task-completion rate with no false refusals. A separate High-Privilege Agent validation (15 naturally Critical-severity attacks) showed all 15 routed immediately to the hosted model and all 15 blocked -- a 0% ASR on the Critical route.