Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation
Anna Gazani, Spyridon Kounoupidis, Panagiotis Katsaros, Nikolaos Kekatos, Grigorios Tsoumakas, Georgios Koutidis
cs.CR · cs.AI
Quick verdict
Proposes Wazuh+NeMo two-layer defense against AI-SOC prompt injection; practical and honest, but evidence rests on just 20 self-authored synthetic attacks.
Summary
The paper addresses indirect prompt injection against LLM-powered Security Operations Centers, where adversaries poison system logs or CTI feeds to hijack alert-triage LLMs ('promptware' kill chains). It proposes a two-layer neurosymbolic defense-in-depth architecture: Layer 1 uses custom Wazuh SIEM decoders and atomic rules as a deterministic pre-filter that extracts injection payloads into an isolated field, truncates oversized inputs, and strips known signatures; Layer 2 wraps the LLM in NeMo Guardrails self-check input and output rails that block injection-like prompts and enforce a whitelisted action set (block_ip, delete_file, kill_process, none). Blocked events feed back into the SIEM (Rule 100300) for human-in-the-loop dashboard visibility. A prototype ingests Wazuh alerts as JSONL, renders them via an active-response template, and calls a locally hosted Gemma 3 12B (Ollama). On 20 self-authored poisoned alerts spanning four ATT&CK tactics, Layer 1 caught 3/20 while Layer 2 caught 18/20, failing on one tool-abuse and one instruction-override payload; the paper candidly reports these bypasses. Limitations: no end-to-end (combined-layer) detection figure, no baselines or latency measurements despite efficiency claims, N=20 synthetic data with no statistical analysis, one underlying model, and no released code or dataset.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 4
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A two-layer architecture combining Wazuh SIEM deterministic pre-filtering with NeMo Guardrails self-check input/output rails dismantles the promptware kill chain against AI-SOC pipelines.
- The deterministic layer neutralizes volumetric-padding and signature-based injections at ingestion (3/20 on the test set), while the neural self-check layer catches semantic jailbreaks (18/20 on the same set), with two sophisticated payloads bypassing Layer 2.
- Each layer is strictly necessary: structural filters alone are blind to semantic obfuscation, and neural guardrails alone are vulnerable to context-exhaustion denial-of-service.
- A closed-loop telemetry feedback loop surfaces every blocked injection attempt in the standard SOC dashboard, providing human-in-the-loop visibility.
- The defense maps onto and mitigates specific MITRE ATLAS techniques (AML.T0040, T0051, T0053, T0054, T0057) across the full promptware lifecycle.
Strengths
Concrete, deployable implementation detail
Full Wazuh PCRE2 decoder and atomic rule listings (Listing 1.1, Rule 100050 Level 10), the telemetry feedback path (/var/ossec/logs/injection-alerts.log, Rule 100300 Level 12), and every LLM prompt (self-check input, output, active-response template) are published in Appendix A, so practitioners can rebuild the pipeline.
Candid failure reporting
Section 5 explicitly reports that Layer 1 caught only 3/20 and that Layer 2 missed two payloads (one AML.T0053 tool abuse, one AML.T0054 instruction-override jailbreak), avoiding the common 100%-detection trap; Section 7 also scopes unmitigated vectors (multi-turn context shifting, memory poisoning, multimodal promptware).
Well-articulated threat model and taxonomy mapping
Sensible separation of defensive responsibilities
Weaknesses
Tiny, self-authored evaluation
The central synergy claim is never measured end-to-end
No baselines and no latency measurements despite efficiency claims
Same-model self-check circularity
Internal inconsistencies undermine precision
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (CRITIS 2026 preprint, arXiv:2609.10707; EU CYBERGUARD grant 101190251) targets indirect prompt injection against LLM-augmented SOCs: attackers poison system logs (Vector A) or CTI feeds/APIs (Vector B) so that payloads crossing the SIEM→LLM trust boundary execute a 'promptware' kill chain (Brodt et al., ref [3]). Central claims: (1) a two-layer neurosymbolic architecture — a Wazuh SIEM deterministic pre-filter (Layer 1) plus NeMo Guardrails self-check input/output rails (Layer 2) — dismantles this kill chain; (2) each layer covers the other's blindness (volumetric/structural vs semantic); (3) closed-loop telemetry gives human-in-the-loop (HITL) visibility; (4) the design mitigates specific MITRE ATLAS techniques (AML.T0040, T0051, T0053, T0054, T0057). The CTI-feed vector is modeled but never experimentally exercised.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is 'promptware' in this paper?
The term (adopted from Brodt et al., 2026) describes prompt-injection attacks that have evolved into multistep, malware-like kill chains: an adversary plants instructions in content an LLM system is guaranteed to ingest — for example SOC system logs or threat-intelligence feeds — and hijacks the model to achieve initial access, privilege escalation (jailbreak), persistence, and impact such as data exfiltration or unauthorized response actions.
How well does the proposed AI-SOC defense actually work?
On the paper's own test set of 20 author-written poisoned alerts, the deterministic Wazuh pre-filter caught 3 and the NeMo Guardrails self-check layer caught 18; two payloads (one tool-abuse, one instruction override) bypassed the neural layer. No combined end-to-end number for the full two-layer pipeline and no comparison against other defenses are reported, and the results come from a single run of one model (Gemma 3 12B).
What tools make up the secure AI-SOC stack?
Wazuh (open-source SIEM) with custom PCRE2 decoders and atomic rules performs deterministic pre-filtering at ingestion; NVIDIA NeMo Guardrails provides self-check input and output rails around the LLM (a locally hosted Gemma 3 12B served via Ollama in the prototype); and a telemetry feedback loop re-ingests blocked-injection events into Wazuh (Rule 100300) so analysts see attacks on the standard SOC dashboard.
Does the framework defend against poisoned threat-intelligence (CTI) feeds?
The architecture is designed to cover that vector — payload extraction at ingestion plus output whitelisting — but the experiments only exercise the log-poisoning vector. The poisoned-CTI-feed scenario, including its 'retrieval-dependent persistence' property, is argued in the threat model and ATLAS mapping (Section 3.5) rather than demonstrated experimentally.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Listing 1.3's criteria list numbers skip from item 2 to item 4 in the extracted text; this is either a PDF-extraction artifact or an omission in the paper itself — Section 4.2's prose does list prompt-extraction among the blocked categories.
- The abstract as given in the task metadata is cut off mid-word ('effectively di'), but the full abstract is present at the start of the paper text, so no content was lost.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.