Adaptive Moving Target Defense for LLM Security

MSc research applying Adaptive Moving Target Defense (AMTD) to secure LLM-enabled systems against prompt injection, jailbreak attempts, and sensitive data leakage. The design compares a static baseline, a fixed-defense baseline, and an adaptive AMTD condition, introducing controlled changes to the defensive prompt layer, route-selection logic, and response handling based on assessed input risk -- combining prompt risk analysis, adaptive prompt wrapping, prompt randomization, and layered defense to reduce attacker predictability. Methodology in progress, per dated research-update posts: deploying a lower-cost local model alongside a stronger API-based model with an adaptive switching mechanism that escalates requests based on assessed risk; a risk-scoring pipeline that selects a defensive response by severity; red-team attack integration via Promptfoo, with broader testing planned using Garak and PyRIT; comparison of static vs. adaptive defense strategies measured on attack success rate, benign-task performance, latency, cost, routing behaviour, and resilience; a multi-judge evaluation design with an adjudicator for disagreement cases; and a canary-string method (planting a unique marker inside protected context and checking whether adversarial prompts cause the model to reveal it) as a data-leak detection technique. Candidate models evaluated for the pipeline (via Hugging Face) include deepset/deberta-v3-base-injection, meta-llama/Prompt-Guard-86M, several openai/gpt-oss variants, and zai-org/GLM-5.2.

Tools: Promptfoo, Garak, PyRIT, Hugging Face

Skills demonstrated: LLM red-teaming, prompt-injection defense design, adaptive/risk-based routing, canary-based data-leak detection, multi-judge evaluation design

Frameworks: Adaptive Moving Target Defense (AMTD) -- see Framework & Regulatory Knowledge

Outcome: Research in progress -- attack-success-rate, latency, and resilience results are not yet finalized.