Andrii Bidochko

• Updated: July 16, 2026
• 8 min read

Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models

Direct Answer

The paper introduces an open‑source, multi‑agent firewall that sits between users and Large Language Models (LLMs) to block accidental data leakage, code exposure, and prompt‑injection attacks. By combining deterministic scanners with LLM‑driven semantic analysis, the system offers a practical, low‑latency shield for both web‑based and programmatic LLM interactions, making it a critical piece of infrastructure for any organization that relies on AI assistants for sensitive workflows.

Background: Why This Problem Is Hard

LLMs such as ChatGPT, Claude, or Gemini have become ubiquitous productivity tools, but their “stateless” design means every prompt and response travels over the same network channel. In practice, this creates three intertwined risks:

• Unintentional data leakage: Users often paste confidential text—contracts, medical records, or proprietary code—into a chat window, trusting the model to “forget” it after the session. In reality, the model may retain fragments in its context window, logs, or downstream fine‑tuning pipelines.
• Code‑exfiltration: Developers use LLMs for code generation, yet the same model can inadvertently reproduce licensed snippets or internal libraries, violating intellectual‑property policies.
• Prompt‑injection attacks: Malicious actors embed hidden instructions that cause the model to reveal protected data or execute unintended actions, a problem that scales with the number of integrations.

Current mitigations fall into two camps. Static filters (regexes, keyword blocklists) are cheap but brittle; they miss nuanced semantic leaks and generate high false‑positive rates. Post‑hoc monitoring (audit logs, manual review) catches breaches after the fact, which is too late for regulated industries. Moreover, most solutions focus on a single communication protocol (usually HTTP) and ignore WebSocket streams used by real‑time chat widgets, leaving a blind spot for many modern AI‑enabled products.

What the Researchers Propose

The authors present a layered, multi‑agent firewall architecture that can be deployed on any device or server that interacts with an LLM. The design is deliberately modular, allowing organizations to trade off detection depth, computational cost, and latency. The core components are:

• Browser Extension: A lightweight client‑side plugin that captures every outbound request from the user’s browser, whether it travels over HTTP(S) or WebSocket.
• Proxy Interceptor: A local or network‑wide proxy that mirrors the extension’s traffic, guaranteeing total visibility for programmatic API calls (e.g., server‑side scripts, CI pipelines).
• Multi‑Agent Pipeline: A sequence of autonomous agents, each specialized in a particular detection task:
  • Deterministic detectors (regex, pattern matching) for fast, low‑cost screening.
  • LLM‑driven semantic analysis agents that reinterpret the payload in context, spotting subtle privacy violations.
  • Code‑leakage prevention agents that compare snippets against a proprietary fingerprint database of licensed code.
  • Extensible plug‑in slots for future capabilities such as prompt‑injection evasion or data‑masking policies.

Each agent can be toggled on or off, and the pipeline can be re‑ordered to suit specific compliance regimes. The architecture is open source, encouraging community contributions and auditability.

How It Works in Practice

When a user types a query into a web‑based LLM interface, the browser extension intercepts the outbound payload before it reaches the remote model. The payload is then forwarded to the local proxy, which mirrors the request to the actual LLM endpoint after it has passed through the multi‑agent pipeline. The same flow applies to server‑side code that calls an LLM API: the proxy sits in the network path, ensuring that no request bypasses inspection.

The pipeline operates as follows:

1. Capture: The extension or proxy captures the raw request body (JSON, multipart, or plain text) and any associated metadata (headers, timestamps).
2. Pre‑filter: Deterministic detectors scan for obvious violations—credit‑card numbers, social security numbers, or disallowed file extensions. If a match is found, the request is blocked instantly, returning a user‑friendly warning.
3. Semantic Scan: A lightweight LLM (often a distilled model) re‑writes the request in a neutral form and evaluates whether the intent reveals protected information. This step catches paraphrased data, indirect references, or context‑dependent leaks that regexes miss.
4. Code Fingerprint Check: For any code snippet, a hash‑based comparison against a curated database of proprietary and open‑source licenses determines whether the snippet is likely to violate IP policies.
5. Policy Enforcement: Based on the combined scores, the pipeline either forwards the request, redacts sensitive fragments, or aborts the transaction. The decision is logged for audit purposes.
6. Response Handling: The LLM’s answer travels back through the same agents, allowing a second‑stage check for inadvertent data echoing (e.g., the model repeating a confidential excerpt).

What sets this approach apart is the hybrid use of deterministic and generative analysis within a single, configurable pipeline. Deterministic agents provide speed, while LLM‑driven agents add depth without requiring a full‑scale model for every request. The proxy’s ability to intercept both HTTP(S) and WebSocket traffic eliminates the “blind spot” that plagues many existing security products.

Evaluation & Results

The authors evaluated the firewall on three realistic workloads:

• Enterprise document review: Simulated users pasted excerpts from NDAs, financial statements, and HR records into a ChatGPT‑style interface.
• Developer code assistance: Automated scripts sent snippets of proprietary source code to an LLM for refactoring.
• Adversarial prompt injection: Crafted inputs attempted to trick the model into revealing previously seen confidential data.

For each scenario, the team measured precision, recall, and overall F1 score under three configurations: (1) deterministic only, (2) deterministic + semantic, and (3) full pipeline with code‑leakage detection. The full pipeline achieved an F1 of 94.93 % on the combined test set, outperforming the deterministic‑only baseline by 22 percentage points. Latency remained under 150 ms per request on a modest CPU‑only server, demonstrating that the system can be deployed in latency‑sensitive environments such as real‑time chat widgets.

Beyond raw metrics, the evaluation highlighted two practical insights:

1. False‑positive reduction: Semantic agents cut false alarms by 40 % compared to regex‑only filters, improving user experience and reducing “alert fatigue.”
2. Robustness to obfuscation: The hybrid pipeline detected paraphrased confidential data that traditional pattern matching missed, confirming the value of LLM‑driven analysis.

Why This Matters for AI Systems and Agents

Enterprises that embed LLMs into internal tools—customer‑support bots, code‑review assistants, or data‑analysis pipelines—must now address privacy as a first‑class requirement. The multi‑agent firewall provides a turnkey, auditable layer that can be inserted without rewriting existing application code. This has several downstream effects:

• Compliance readiness: Organizations can demonstrate proactive data‑protection controls to regulators (GDPR, HIPAA, CCPA) because every request is inspected and logged.
• Agent reliability: By preventing accidental data exposure, downstream agents receive cleaner inputs, which improves the quality of generated outputs and reduces hallucination risk.
• Scalable governance: The modular pipeline can be extended with organization‑specific policies—e.g., blocking mentions of upcoming product roadmaps—without redeploying the entire stack.
• Cost efficiency: Because deterministic agents handle the majority of traffic, computationally expensive semantic checks are only invoked when needed, keeping cloud‑compute bills low.

For teams building AI‑driven workflows on the Enterprise AI platform by UBOS, the firewall can be integrated as a pre‑processing step in the Workflow automation studio, ensuring that every automated task respects privacy constraints before invoking a language model. Similarly, AI marketing agents can safely generate campaign copy without risking accidental leakage of customer PII.

What Comes Next

While the prototype demonstrates strong detection capabilities, the authors acknowledge several open challenges:

• Adaptive adversaries: Prompt‑injection techniques evolve rapidly; future work will explore self‑learning agents that update detection heuristics in near‑real time.
• Cross‑modal data: Current pipelines focus on text and code; extending support to images, audio, or multimodal embeddings will be essential as LLMs become multimodal.
• Distributed deployment: Scaling the proxy to large, geographically dispersed enterprises may require edge‑node orchestration and federated policy synchronization.

Potential next steps for practitioners include:

1. Deploying the firewall on the UBOS homepage as a sandbox to evaluate impact on existing AI workflows.
2. Customizing the plug‑in architecture for niche industries—e.g., adding a medical‑term detector for healthcare providers.
3. Contributing to the open‑source repository by adding new deterministic signatures or training domain‑specific semantic agents.

Startups looking for a rapid‑deployment privacy layer can explore the UBOS for startups offering, while small‑ and medium‑size businesses may find the UBOS solutions for SMBs package a cost‑effective entry point.

For a deeper dive into the technical details, read the original arXiv paper. Organizations interested in trialing the firewall can download the source code from the authors’ GitHub repository and integrate it with existing UBOS platform overview components.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.