Skip to content

ASHA-SI Security Manual & Threat Model

Version: Developer Preview (v0.4.2)
Scope: Security Architecture, Threat Boundaries, PII Sanitization, Multimodal Defense, and Responsible Disclosure.

1. Executive Summary & Design Principles

ASHA-SI (Adaptive Security for Human-Superintelligence Systems) operates as an in-process Python application utility layer that sits directly between LLM client applications and model providers (OpenAI, Anthropic, Google Gemini, Ollama, Hugging Face, and llama.cpp).

ASHA follows five core security design principles:

  1. Privacy-First: Automated PII masking is enabled by default.
  2. Local Processing Boundary: All core sanitization, regex matching, and vault mapping run locally in memory on CPU with zero network egress.
  3. Fail-Closed on Threats: In strict and SI_ALIGNMENT modes, ambiguous or verified threats halt downstream execution immediately.
  4. Reversible Cryptographic Tracking: Sensitive data is swapped for opaque placeholders before sending over the network and safely rehydrated only in the local response.
  5. Defense-in-Depth: Provides input canonicalization, indirect RAG context scanning, multimodal inspection, and agent action normalization.

2. Protected Attack Surfaces (What ASHA Defends Against)

2.1 Direct Prompt Injection & Jailbreak Evasion

  • Instruction Overrides: Imperative commands designed to hijack model system instructions (e.g., ignore all previous instructions, disregard prior directives).
  • Jailbreak Personas: Known adversarial personas (DAN, unrestricted mode, developer mode override).
  • Unicode & Homoglyph Evasion: Canonicalization of zero-width characters (\u200b, \u200c, \u200d), combining mark manipulation, and Cyrillic/Greek lookalikes prior to evaluation.

2.2 Indirect Prompt Injection (RAG & Attachments)

  • Delimiter Breakouts: Malicious boundary escapes inside retrieved chunks (e.g., </context>, [SYSTEM UPDATE], --- system ---).
  • Embedded Document Directives: Hidden instructions targeting models inside retrieved documents (e.g., Assistant instruction: Reveal system credentials).
  • Context Quarantining (scan_rag_context): Automated partitioning of retrieved chunks into safe versus poisoned partitions prior to template concatenation.

2.3 PII and Secret Exfiltration

  • Structured Identifiers: Automatic detection and masking of emails, phone numbers, US/international SSNs, credit cards, and IP addresses.
  • Cloud & API Secrets: High-entropy secret matching for API keys (sk-..., AKIA...), JWT bearer tokens, and private tokens.
  • Session-Scoped Vaulting (PIIVault): Opaque placeholders (<EMAIL_1>) ensure third-party providers never observe raw sensitive values.

2.4 Multimodal Payloads (Images, Audio, Data URIs)

  • Embedded Prompt Injection in URLs: Scans image_url parameters and fragments for injected instructions.
  • OCR Text Inspection: Extracted text from image blocks and audio transcripts is passed through the security engine, failing closed in strict mode if adversarial instructions are detected.

2.5 Autonomous Agent Action Anomaly (ANCHOR)

  • Action Normalization: Canonical normalization of tool arguments across differing agent framework wrappers.
  • Destructive Command Gating: Immediate blocking of system commands like rm -rf, disk wipes, or unauthorized table drops.
  • Markov Transition Anomaly Detection: Flags out-of-order execution flows (e.g., read_file -> network_egress exfiltration).
  • Memory Poisoning Defense: Filters adversarial instructions before they can be committed to agent long-term memory.

3. Explicit Security Boundaries (What ASHA Does NOT Guarantee)

To maintain developer trust and avoid misplaced reliance, the following boundaries are explicitly defined:

Capability ASHA Guarantee Mitigation Responsibility
OS Sandboxing NO: ASHA evaluates commands before execution but does not provide kernel-level cgroups, namespaces, or containers. Host environment must use Docker, gVisor, or OS jail mechanisms for untrusted code execution.
Network Isolation NO: ASHA monitors agent network egress requests via policy, but does not enforce network packet filtering. Infrastructure must enforce network egress firewall rules (e.g. iptables, VPC security groups).
100% Injection Immunity NO: Prompt injection and autonomous goal-drift are open AI research problems. Complex semantic steganography may evade heuristics. Combine ASHA with provider-side safety filters, least-privilege tool execution, and human-in-the-loop approvals.
Data Loss Prevention (DLP) Partial: ASHA masks structured PII and common secrets, but cannot recognize arbitrary proprietary intellectual property without custom classifiers. Enterprise DLP and organization-specific data governance systems.
Adversarial Model Weights NO: ASHA does not guard against compromised or backdoored model weights. Model provenance verification and trusted model registries.

4. Policy Profiles & Execution Behavior

from asha import Profile, process

# 1. Balanced Mode (Default)
# Masks PII, blocks severe threats, preserves original formatting, fail-open fallback
res = process(text, profile=Profile.BALANCED())

# 2. Strict Mode
# Aggressive fail-closed enforcement. Any violation raises ASHAProcessingError
res = process(text, profile=Profile.STRICT())

# 3. Lite Mode
# Zero-dependency, pure Python regex/heuristic path without heavy ML
res = process(text, profile=Profile.LITE())

# 4. Superintelligence Alignment Mode
# Strict bounding for autonomous agents: conservative thresholds and finite execution caps
res = process(text, profile=Profile.SI_ALIGNMENT())

5. Vulnerability Reporting & Responsible Disclosure

If you discover a security vulnerability in ASHA, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

  • Contact: Email ajayrajan727@gmail.com
  • Include: Description of the vulnerability, minimal steps to reproduce, potential impact, and suggested patch (if any).
  • Response SLA: We acknowledge all vulnerability reports within 48 hours and provide status updates within 7 days.