Practical LLM Security · Core series October 15, 2026 · RAG and multi-agent groups October 16, 2026

Practical LLM Security

Implementation guides, worked examples, and interactive labs for protecting AI applications from abuse and fraud.

35 in-depth articles and seven interactive labs: why failures happen, where guardrails belong, and how to verify the final effect.

ADK · A2A · Model Armor · LangGraph · NeMo · MCP · OAuth

Choose a learning path

Start with attack mechanics if you are new to prompt injection. Move through ADK enforcement to understand model, tool, and approval boundaries. Compare other guardrail methods by the controls they provide, then work through fraud workflows and release evidence. Every chapter includes a worked case, implementation detail, failure tests, and primary references.

The RAG and Knowledge Security group goes deeper into the retrieval path: what an ingestion pipeline may admit, how permissions are enforced inside the vector query, how poisoned passages take over retrieval, how citations stay true after documents change, and how deletion and revocation reach every index and cache. The Multi-Agent Security group follows identity and authority across agent hops: per-hop token exchange, trust in remote agents, confused-deputy chains, sandboxed code execution, and containment of a compromised agent.

For a payment or support agent, prioritize tool authorization, exact-action approval, refund ledgers, account recovery, and incident response. For a read-only RAG assistant, prioritize indirect injection, source provenance, memory, output release, and tenant access. Content filters help, but authority comes from authenticated evidence and independently enforced service rules.

The labs run deterministic synthetic models in your browser. They do not call an LLM, inspect real people, send messages, or move money. Change one assumption at a time, inspect the decision trace, and export the result. The teaching outcomes are deliberately distinct from measured production security performance.

Attack mechanics and threat modeling

CHAPTER 01

Why LLM Abuse and Fraud Prevention Needs a Threat Model

Map attacker goals, trust boundaries, business losses, and enforceable controls before selecting an LLM guardrail.

CHAPTER 02

How LLM Jailbreaks Happen: Instruction Confusion and Context Pressure

Understand direct jailbreak mechanisms, long-context influence, attack transfer, and what model-level defenses can and cannot prove.

CHAPTER 03

Indirect Prompt Injection in RAG: When Retrieved Data Becomes an Instruction

Trace poisoned documents through retrieval, summarization, tool use, and answer rendering, then enforce source-specific authority.

CHAPTER 04

Multi-turn Jailbreaks and Memory Poisoning: Preserve Provenance Across Time

Protect conversation state, summaries, and persistent memory from gradual privilege changes and untrusted instructions.

CHAPTER 05

Multimodal Prompt Injection: PDFs, OCR, Images, and Voice Boundaries

Trace how extracted text and synthetic media can influence an agent, and design modality-aware screening and verification.

ADK enforcement

CHAPTER 06

ADK Guardrail Callbacks: Enforce the Right Boundary Before Side Effects

Place checks around model and tool execution, return explicit denials, and test that rejected ADK calls have no side effects.

CHAPTER 07

ADK Security Plugins: Shared Policy, Ordering, and Short-circuit Hazards

Centralize cross-agent checks while testing plugin precedence, cached responses, and per-request isolation.

CHAPTER 08

ADK Tool Authorization: Bind User Identity, Tenant Scope, and Capabilities

Design narrow tools whose backend permissions remain correct even when the model proposes unauthorized arguments.

CHAPTER 09

ADK Human Confirmation: Bind Approval to the Exact Action

Build confirmation flows that resist changed arguments, stale permissions, replay, and misleading approval screens.

CHAPTER 10

ADK Output Guardrails and Streaming: Prevent Disclosure Before Release

Design output validation around irreversible streaming, tool results, generated links, and authoritative action status.

Other guardrail methods

CHAPTER 11

Model Armor in an AFP Pipeline: Coverage, Failure Policy, and Evidence

Integrate a screening service without confusing a successful API call with complete inspection or permission to act.

CHAPTER 12

Gemini Safety Settings and Business Guardrails: Different Scores, Different Jobs

Configure content filtering deliberately while keeping fraud, authorization, and action limits in application policy.

CHAPTER 13

LangChain Guardrails and LangGraph Approval Flows: Enforce Across Resume

Compare middleware screening with durable workflow interrupts, and prevent replay or stale approval from authorizing effects.

CHAPTER 14

NeMo Guardrails and Policy-as-Code: Separate Dialogue Rules from Authority

Design input, retrieval, dialogue, execution, and output controls with explicit policy ownership and testable business invariants.

CHAPTER 15

MCP Tool Security for AFP: Authorization, Tool Metadata, and Egress

Protect an agent from overprivileged MCP integrations, misleading tool descriptions, token misuse, and unsafe outbound requests.

Abuse and fraud workflows

CHAPTER 16

Refund Fraud in LLM Agents: Atomic Reservations, Approval Binding, and Replay

Protect refund workflows from persuasive claims, concurrent requests, changed destinations, and uncertain processor outcomes.

CHAPTER 17

Account Takeover and Deepfake Requests: Identity Controls for LLM Support

Keep conversational persuasion, synthetic media, and recovery claims from becoming account access or payment authority.

CHAPTER 18

LLM Abuse Velocity: Quotas, Campaign Signals, and Bounded Agent Work

Limit repeated misuse and runaway workloads using shared budgets, behavioral evidence, and fair enforcement.

CHAPTER 19

LLM Fraud Scoring: Base Rates, Evidence, and Human Review Capacity

Use models to organize fraud evidence without turning uncertain scores into automatic accusations or unsafe approvals.

CHAPTER 20

Preventing Outbound Abuse: Consent, Recipient Scope, and Agent Messaging

Keep email, messaging, and document-sharing tools from turning an LLM assistant into an unapproved bulk-action service.

Evaluation and operations

CHAPTER 21

Red-team Evaluation for AFP: Test Attempts, Effects, and Legitimate Use

Build authorized synthetic evaluations that distinguish model violations, blocked tool calls, and actual business harm.

CHAPTER 22

Guardrail Metrics: Precision, Recall, Escape Rate, and Review Burden

Choose metrics that reveal both missed harm and unnecessary friction, with explicit denominators and production assumptions.

CHAPTER 23

Guardrail Outages and Fail-closed Design: Keep Useful Service Without Unsafe Actions

Define per-capability fallback behavior for classifier timeouts, policy failures, budget-store outages, and partial inspection.

CHAPTER 24

AFP Observability and Incident Response: Reconstruct Decisions Without Leaking Data

Build privacy-conscious decision traces, containment controls, and evidence-driven recovery for LLM abuse and fraud incidents.

CHAPTER 25

A Production AFP Blueprint: From Read-only ADK Pilot to Controlled Actions

Combine threat modeling, guardrails, authorization, evaluation, rollout, and incident readiness into a staged deployment plan.

RAG and Knowledge Security

Ingestion, permission-aware retrieval, index poisoning, citation integrity, and revocation across indexes and caches. Added October 16, 2026.

RAG 01

Document Ingestion Security for RAG: Connectors, Parsers, and Quarantine

Treat the ingestion pipeline as a security boundary: least-privilege connectors, isolated parsers, admission records, and a quarantine path for suspicious documents.

RAG 02

Permission-Aware Retrieval in Practice: Filter Pushdown, Starvation, and Row-Level Security Traps

Enforce document permissions inside the vector query, avoid filtered-search starvation, and test the database and vector-store behaviors that silently bypass access rules.

RAG 03

Embedding and Index Poisoning: Detect Retrieval Takeover Before It Reaches the Model

Understand how a few crafted passages can dominate retrieval, then control write paths, cap source concentration, monitor golden queries, and roll back poisoned index versions.

RAG 04

Citation Integrity Over Time: Versioned Spans, Revalidation, and Laundered Sources

Keep citations true after the answer is written: bind them to versioned source spans, revalidate on display, and stop summaries and agents from laundering unverifiable sources.

RAG 05

Deletion and Permission Revocation Across RAG Indexes and Caches

Propagate document deletion and permission changes through chunks, vector and keyword indexes, semantic caches, memory, and logs, then prove the change took effect.

Multi-Agent Security

Delegated identity, agent-to-agent trust, confused deputies, sandboxed code, and containment of a compromised agent. Added October 16, 2026.

AGENTS 01

Delegated Identity for Agent Chains: Token Exchange, Attenuation, and Audience per Hop

Carry the user, the acting agent, and a shrinking set of permissions through every hop of a multi-agent workflow using token exchange, audience binding, and short lifetimes.

AGENTS 02

Agent-to-Agent Trust: Verify the Peer, Pin Its Keys, and Distrust Its Output

Separate identity, capability, and output trust for remote agents: verify signed Agent Cards against pinned keys, detect card drift, and validate every artifact as untrusted data.

AGENTS 03

Confused-Deputy Failures in Multi-Agent Chains: Five Traces and the Tests That Catch Them

Diagnose how locally correct agents compose into unauthorized actions, using five concrete delegation traces and a permission-matrix test harness.

AGENTS 04

Sandboxing Agent-Generated Code in Multi-Agent Pipelines: Executors, State, and Untrusted Output

Choose and configure ADK code executors, prevent cross-user state leakage, keep secrets and networks out, and treat sandbox output as untrusted input to the next agent.

AGENTS 05

Containing a Compromised Agent: Quarantine, Credential Revocation, and Taint Tracing

Bound the blast radius of one misbehaving agent: give each agent its own identity, quarantine it without stopping the system, revoke its credentials, and trace every output it influenced.

Seven hands-on experiments

INTERACTIVE LAB