~/sabarish.dev
← all posts

~/posts/promptshield-graph-pride-2026

PromptShield Graph: catching cross-agent prompt injection (PRIDE 2026)

Sabarish R3 min read
  • research
  • llm-security
  • ai-agents

Status: prototype presented at PRIDE 2026 (Panimalar Research Innovation Development Ecosystem), Panimalar Engineering College — with my teammates Vignesh R, Shafeeq S, and Rohith V K. Full paper, demo video, and repository details get added once I pull the files from my vault.

This project has a backstory. Before RUSH HOUR 24, my team compared two ideas for the hackathon: MCP Guardian and this one. The comparison deck was blunt: "PromptShield Graph is a great idea for a research paper — not for a 24-hour hackathon." Guardian shipped in 24 hours and won the weekend — and the graph idea didn't die. It became this: PromptShield Graph, presented at PRIDE 2026.

The problem

Prompt injection doesn't stop at one agent. Real AI pipelines hand messages from agent to agent — a research agent, a summarizer, an action agent — and once a poisoned instruction enters that chain, it propagates. The summarizer agent's input looks clean; it's the summary it received that carries the hidden directive.

Existing defenses have a blind spot here:

  • They inspect only the initial user prompt
  • They treat every LLM call in isolation
  • They lose visibility the moment output is passed to another agent
  • They cannot trace how an attack spread across a pipeline

An injected instruction can travel unnoticed from agent A to agent C while every single hop looks legitimate at its own input boundary.

The approach: the pipeline as a graph

PromptShield Graph models the entire multi-agent pipeline as a graph and makes every handoff inspectable:

  1. Graph modeling — every agent is a node; every message handoff is an edge. The full pipeline becomes a traceable graph, not a sequence of isolated calls.
  2. Per-edge detection — a detector classifies each handoff as CLEAN, SUSPICIOUS, or INJECTED before the message is allowed downstream.
  3. Taint propagation — if an upstream node is compromised, that risk is tracked forward through the graph, flagging agents even when their own input looks clean.
  4. Block & log — flagged handoffs are quarantined, the edge is marked tainted, and the pipeline halts before the attack reaches the acting agent.
User Query
   │
   ▼
Research Agent ──▶ handoff ──▶ DETECTOR (CLEAN / SUSPICIOUS / INJECTED)
                                   │
                                   ▼
                             Summarizer Agent ──▶ handoff ──▶ DETECTOR
                                                            │
                                                            ▼
                                                      Action Agent

If any handoff is flagged INJECTED, that edge is blocked and the pipeline halts — downstream agents never receive the tainted message.

Stack

  • LLM API — agents + detector (AI Studio prototype)
  • NVIDIA NIM API — tuning phase for the detector
  • NetworkX — the graph and taint-propagation model
  • Streamlit — the web UI

Why it's novel

  • ✕ inspect only the initial user prompt — ✓ instead, every agent-to-agent handoff is inspected
  • ✕ treat each LLM call in isolation — ✓ instead, the full pipeline is modeled as nodes and edges
  • ✕ no visibility once output passes onward — ✓ instead, taint propagation tracks risk across agents
  • ✕ can't trace lateral spread — ✓ instead, spread is traced and blocked before the acting agent

Why it's genuinely hard

The comparison deck's honesty is worth keeping: this is not a wiring exercise. Real cross-agent provenance — knowing which source influenced which message — is unsolved territory, and a 24-hour demo of it risks being a scripted fake that one judge question exposes. That's why it belongs on the research track rather than the hackathon track, and why the prototype takes an incremental route: start with a three-agent simulation and a known attack, prove the graph visibly detects and blocks it, then generalize.

Roadmap

  1. Prototype (done) — three-agent simulation with an LLM API, graph visualization, clean-run vs. attack-blocked demo
  2. Tuning — migrate the detector to NVIDIA NIM models; benchmark DeepSeek V4 / Qwen3.5 for detection accuracy
  3. Integration — wire into AgentFlow's live multi-agent infrastructure (Google ADK, MCP, Cloud Run)
  4. Scale & IP — formalize the graph-taint detection method toward the AICTE-KAPILA grant and patent filing

It's the natural next chapter of the MCP Guardian story: Guardian guards the conversation; PromptShield Graph guards the conversation between agents.