Security Engineer focused on LLM systems and adversarial ML.
I design attack surfaces — then close them. Every decision starts with: how does this break, and how do I stop that.
I build both sides of that question: Agent Shield, a production prompt injection firewall live on Azure since May 2026, and Agent Strike, the autonomous red-team system that attacks it — generating novel adversarial prompts, logging real false negatives, and feeding harder variants back into the loop.
Everything here is shipped and deployed. No tutorials. No demos.
| Domain | What I Build |
|---|---|
| LLM Security | Prompt injection detection, layered defense architecture, attack classification |
| Adversarial ML / Red-Teaming | Multi-agent attack generation (CrewAI), Garak-based vulnerability scanning, blindspot detection loops |
| Secure API Design | FastAPI, BLAKE2b auth, rate limiting, PII sanitization |
| ML Infrastructure | Transformer fine-tuning, ONNX deployment, model versioning, GPU training pipelines |
| Cloud Engineering | Azure App Service, Blob, Table, Monitor — production infra |
| SOC / DevSecOps | Grafana SIEM, GitHub Actions CI/CD, Bandit, SonarCloud |
Open source prompt injection firewall for production AI systems.
Built for: AI teams, SaaS companies, and enterprises shipping LLM-powered products who need input validation before their first security incident — not after.
Intercepts malicious prompts before they reach your LLM. 5-layer detection pipeline. Self-improving via automated adversarial red-teaming. Live on Azure.
| Advantage | Why It Compounds |
|---|---|
| First-mover in open source LLM security | No production-grade open source prompt injection firewall existed before this. |
| Proprietary attack dataset | Every blocked request adds to a dataset nobody can buy. Your traffic. Your attacks. |
| Self-improving model | Agent Strike attacks the system continuously. Misses become training data. Model retrains. |
| 100% true positive rate under red-team | Tested against real adversarial attacks — not a benchmark dataset. |
| $13/month infra | First paying customer = profitable. Scales to B2/B3 as traffic grows. |
| Open source distribution | Stars → trust → integrations → word of mouth. Text layer is free on purpose. |
| Multimodal roadmap | Text + PDF are free and open source. URL, Image, and Video scanning are paid. |
Every prompt passes through 5 layers in sequence. One match = blocked.
| Layer | Model | Catches | Timeout |
|---|---|---|---|
| L1 | Vigil Signatures | Known jailbreaks, DAN, override patterns | N/A |
| L2 | DistilBERT ONNX | Semantic injection, adversarial phrasing | → BLOCK |
| L3 | mDeBERTa fp32 (HF Spaces) | Multilingual attacks, borderline cases | → ALLOW |
| L4 | Custom Rule Engine | Base64, ROT13, NATO, Atbash, Zalgo, Braille, Ecoji, homoglyphs, PII | N/A |
| L5 | Groq Llama3-70b | Social engineering, context-aware attacks | → ALLOW (advisory only) |
5 layers, not one model. One model has one blind spot. Layering catches what each individual layer misses.
Fail-closed on owned infra. Fail-open on external. If our ML times out — BLOCK. If HuggingFace goes down — ALLOW. Users don't pay for third-party outages.
Free text layer. Paid multimodal. Free = distribution and trust. Paid = PDF, Image, URL scanning. That's where revenue comes from.
Model trains on its own attack traffic. No competitor can buy this dataset. It only exists because Agent Shield is live in production.
| Metric | Value |
|---|---|
| Requests processed (live) | 265+ |
| Global block rate | 58.11% |
| ML validation accuracy | 99.92% |
| Agent Strike true positive rate | 100% |
| Agent Strike false positive rate | 4% |
| Tests passing | 156 |
| Bandit findings | 0 High · 0 Medium |
| Avg detection latency | ~801ms |
| Infra cost | ~$13/month on Azure |
Autonomous LLM red-teaming framework. Built to break Agent Shield, on purpose.
Built for: the same reason Agent Shield exists — you can't trust a detection system's accuracy claims until something is actively trying to defeat it, every day, with novel attacks no static benchmark ever covers.
Multi-agent system that generates new prompt injection attacks using an LLM, fires them at a live security API, and tracks every TP/FP/FN/TN outcome. False negatives don't get fixed manually — they get logged, mutated into harder variants, and re-tested automatically.
| Advantage | Why It Compounds |
|---|---|
| Attacks are LLM-generated, not static | A hardcoded attack list goes stale. An agent that invents new ones doesn't. |
| Closed feedback loop | Every false negative becomes the next training input — no manual attack writing. |
| Provider-independent | Migrated off OpenRouter's routing layer to direct Groq inference after a provider-side block — no single point of failure on a third-party router. |
| Honest measurement, not vanity metrics | Reports real block rate under active adversarial pressure — including the misses. |
| $2.50/month infra | Groq free tier, Kaggle free GPU, Azure Table + Blob. Adversarial testing at near-zero cost. |
Generate novel attack (Groq + Qwen3-32B, reasoning_effort=none)
→ Fire at Agent Shield /v1/check
→ Log verdict (BLOCK/ALLOW) + latency → agent_results.csv
→ ALLOW verdict (false negative) → missed_samples.csv
→ blindspot_detector.py reads missed_samples.csv
→ Generates harder mutated variants of each miss
→ Re-fires mutated attacks → loop continues
10 attack categories: direct injection, persona hijack, roleplay escalation, token smuggling, multilingual switch, indirect/context injection, chain-of-thought hijack, fictional framing, base64 mid-sentence, authority impersonation.
| Metric | Value |
|---|---|
| Total adversarial requests | 40,000+ |
| Blocked | 11,700+ |
| Adversarial block rate | 29.3% |
| Attack families (Garak) | 9 |
| Avg attack latency | ~1,553ms |
| Infra cost | ~$2.50/month |
Why 29.3% and not 90%+: this is adversarial traffic by design — every blocked attack here is one Agent Shield would have missed without Strike finding it first. Low block rate under active red-teaming surfaces real blind spots; it isn't a production accuracy number.
Only what I have actually shipped in production. No aspirational tools.
| Input Type | Status |
|---|---|
| 📝 Text / Prompt injection | 🟢 Production · Open Source |
| 📄 PDF / Document scanning | 🟢 Open Source · Backlog |
| 🌐 URL / Webpage scan | 🔒 Paid · Backlog |
| 🖼️ Image OCR | 🔒 Paid · Backlog |
| 🎥 Video analysis | 🔒 Paid · Backlog |
| Agent Strike Pipeline | Status |
|---|---|
| Red Team Agent | 🟢 Live |
| Blindspot Detector | 🟢 Live |
| Blue Team Agent | 🟡 In Progress |
| Analyst Agent | 🔴 Planned |
Open to: Security Engineering · LLM Infrastructure · MLOps · DevSecOps · Founding Engineer roles
For enterprise deployments, SLA, or custom integration: 📩 sandeep.int.2005@gmail.com
Agent Shield gets stronger every day. So do attackers. That's the point.