Web Application Firewall (WAF) for ML

Unlike traditional WAFs that scan for generic SQLi or XSS patterns, an ML WAF performs deep inspection of JSON and multipart request bodies. It parses nested structures to detect adversarial perturbations embedded within image tensors or tabular feature vectors. This includes:

• Recursive unpacking of compressed or serialized payloads
• Validation against strict schema contracts defined by the model's input specification
• Detection of statistical anomalies in feature distributions that signal evasion attacks

A critical ruleset unique to LLM-serving WAFs. The engine analyzes inbound prompts for direct injection (e.g., 'ignore previous instructions') and indirect injection (malicious content embedded in retrieved documents). Techniques include:

• Semantic similarity matching against known jailbreak templates
• Detection of token smuggling and delimiter manipulation
• Canary token injection to detect prompt leakage in responses
• Integration with guardrail architectures to block toxic or off-policy outputs before they reach the user

ML WAFs implement intelligent rate limiting that goes beyond simple request-per-second thresholds. They profile query patterns to detect model extraction attacks where an adversary systematically probes the decision boundary. Key capabilities:

• Sequential query analysis to identify boundary-following algorithms
• Differential throttling based on query similarity and entropy
• Blocking of high-frequency, low-diversity query bursts indicative of model stealing
• Integration with UEBA systems to correlate API behavior with user baselines

The WAF enforces a strict positive security model by validating every inference request against an OpenAPI or protobuf schema. This eliminates entire classes of fuzzing and malformed-input attacks:

• Rejection of unexpected fields, type mismatches, and out-of-range values
• Input sanitization to strip control characters, null bytes, and polyglot payloads
• Enforcement of maximum string lengths and array depths to prevent buffer overflows
• Automatic blocking of requests that deviate from the model's trained input distribution

The WAF acts as a Policy Enforcement Point (PEP) that validates authentication material on every request before it reaches the model server. It performs:

• Real-time token introspection (RFC 7662) against the authorization server
• Validation of Proof-of-Possession (DPoP) tokens to prevent replay attacks
• HMAC signature verification for request body integrity
• Correlation of session context with query behavior to detect credential compromise and session hijacking

Every request and response passing through the ML WAF is logged to a tamper-proof audit trail for compliance and forensic analysis. This includes:

• Full capture of request headers, payloads, and model responses (with optional data masking for PII)
• Cryptographic chaining of log entries to ensure non-repudiation
• Real-time streaming to SIEM platforms for anomaly detection
• Retention policies aligned with SOC 2, HIPAA, and EU AI Act requirements for algorithmic accountability

The enforcement of a strict data contract on all inference requests, typically defined by an OpenAPI Specification or JSON Schema. This rejects malformed or unexpected inputs that could trigger undefined model behavior.

• Rejects requests with extra fields, wrong types, or missing required parameters
• Prevents adversarial examples crafted to exploit input parsing bugs
• Works synergistically with WAF: WAF blocks known attack patterns, schema validation enforces business logic contracts

A security technology embedded within the model serving runtime that detects and blocks attacks in real-time by analyzing the application's internal state and execution context.

• Unlike WAF, which inspects traffic at the perimeter, RASP operates inside the application
• Can detect attacks that bypass WAF signatures by monitoring actual code paths
• Provides defense-in-depth for model serving containers
• Instrumentation of Python/Java runtimes for ML frameworks