Adversarial benchmark & honest limitations.
SentinelLLM is evaluated using PromptProbe, an offline reproducible test harness. We measure probabilistic content detection alongside deterministic action enforcement.
Classification performance across 16 inbound content cases
Evaluates the ability of regex heuristics and classifiers to detect direct imperative prompt injections, persona hijacking, and instruction extraction.
False negative on test case INJ-DIR-002
Case INJ-DIR-002 encodes an imperative prompt injection payload inside Base64 encoding. The sub-5ms regex heuristic tier examines plain text tokens and does not trigger on raw base64 character blocks, passing it as a false negative.
This failure highlights why content inspection alone is never sufficient for securing agentic systems. In SentinelLLM, even if an encoded payload convinces an LLM to request an unauthorized tool invocation, the Egress Policy Enforcement Point blocks the action deterministically.
Deterministic tool gating results
Across 7 action test cases testing missing permissions, parameter boundary violations, and unapproved sensitive calls: