Docs / AI Security / Security Pipeline

Security Pipeline

CloudVera's security pipeline runs on every request before it reaches the LLM provider. Each step can be configured to block, flag, or allow based on your policies.

Steps

  1. Authentication

    Verify the virtual API key, check permissions, and resolve the tenant and project context.

  2. Rate Limiting

    Enforce per-key and per-tenant rate limits. Reject requests that exceed configured thresholds.

  3. Obfuscation Normalization

    Detect and decode obfuscation techniques — zero-width characters, homoglyphs, Base64 encoding, HTML entities, and leetspeak — before pattern-based scanning.

  4. Prompt Injection Scan

    Detect injection attacks, jailbreak attempts, and adversarial prompts using 200+ patterns across 6 attack categories.

  5. Cross-Lingual Attack Detection

    Detect prompt injection delivered in non-English languages — attack keywords in 8 languages (Russian, Chinese, Arabic, Spanish, French, German, Japanese, Korean) and translation-mediated delivery.

  6. Semantic Attack Detection

    ML-based embedding analysis using Cloudflare Workers AI to catch rephrased injection attempts that bypass pattern matching.

  7. Payload Splitting Detection

    Detect fragmented injection payloads — variable concatenation, quoted fragment reassembly, step-by-step hidden instructions, and character code assembly.

  8. PII Detection

    Scan for personally identifiable information (SSN, email, phone, credit card, API keys) and redact or block as configured.

  9. Custom Guardrails

    Apply custom content policies — topic restrictions, banned phrases, regex rules, semantic matching, and output format requirements.

  10. Cost Check

    Verify the request won't exceed budget limits. Detect denial-of-wallet attacks via excessive token usage or repetition.

  11. Provider Call

    Forward the sanitized request to the LLM provider with automatic retry and failover.

  12. Response Scan

    Scan the model's response for toxic content, code/IP leaks, alignment degradation, PII leakage, and policy violations.

  13. Logging

    Log the full request/response with metadata: tokens, cost, latency, security scan results, and routing decisions.

  14. Audit Trail

    Write an immutable audit record for compliance. Tracks who sent what, when, and what security actions were taken.