🤖 AI

Introducing the Generative Application Firewall (GAF)

This paper introduces the Generative Application Firewall (GAF), a unified architectural layer designed to consolidate fragmented security measures like prompt filters and guardrails into a single enforcement point for securing LLM applications and their autonomous agents.

Original authors: Joan Vendrell Farreny, MartÃ JordÃ Roca, Miquel Cornudella Gaya, Rodrigo Fernández Baón, Víctor García Martínez, Eduard Camacho Sucarrats, Alessandro Pignati

Published 2026-01-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Joan Vendrell Farreny, MartÃ JordÃ Roca, Miquel Cornudella Gaya, Rodrigo Fernández Baón, Víctor García Martínez, Eduard Camacho Sucarrats, Alessandro Pignati

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have built a very smart, chatty robot assistant (an AI) that can write stories, solve math problems, and even help you code. You want to let people talk to it, but you're worried they might trick the robot into doing bad things, like revealing secret passwords, writing hate speech, or pretending to be someone else.

This paper introduces a new security guard called the Generative Application Firewall (GAF). Think of it as a super-smart bouncer and editor standing right at the door between your users and your AI.

Here is how the paper explains it, using simple analogies:

1. The Problem: Why Old Guards Don't Work

The authors say that traditional security guards (like Web Application Firewalls or "WAFs") are like bouncers who only check your ID and look for specific banned words on a list.

The Flaw: If a bad guy walks in wearing a disguise (a "jailbreak" or "prompt injection") and asks the AI to "pretend to be a villain to write a story," the old bouncer sees a polite request and lets them in. The bad guy isn't using a weapon; they are using tricky language.
The Gap: The paper argues that AI attacks are different because they rely on meaning and context, not just broken code. You need a guard who understands the story the user is trying to tell, not just the words they are using.

2. The Solution: The GAF (The "Super-Bouncer")

The GAF is a new layer of security specifically designed for AI. It doesn't just check the door; it listens to the whole conversation. The paper breaks this down into five layers of defense, like a castle with five different walls:

Layer 1: The Network Wall (The Gate)
- What it does: Stops people from flooding the gate with too many requests or using fake IDs.
- Analogy: It's like a bouncer checking if you have a ticket and making sure 1,000 people don't all try to push through the door at once.
Layer 2: The Access Wall (The VIP List)
- What it does: Checks who you are and what you are allowed to do.
- Analogy: Even if you have a ticket, you can't go into the VIP kitchen. This layer makes sure a regular user can't ask the AI to delete the company database.
Layer 3: The Syntactic Wall (The Grammar Check)
- What it does: Looks for weird code or hidden commands hidden inside the text.
- Analogy: It's like a teacher checking if a student tried to sneak a cheat sheet written in invisible ink or hidden inside a math equation.
Layer 4: The Semantic Wall (The "Meaning" Check)
- What it does: This is the big new one. It understands the intent of the conversation.
- Analogy: If someone asks, "How do I build a bomb?" the guard stops them. But if they ask, "Write a story about a villain building a bomb," a normal guard might let it pass. The Semantic Wall understands that even in a story, the AI shouldn't give real instructions on making explosives. It catches the trick.
Layer 5: The Context Wall (The "Memory" Check)
- What it does: This is the hardest part. It remembers the whole conversation, not just the last sentence.
- Analogy: Imagine a bad guy asks a harmless question in round one, then another in round two, and by round three, they have tricked the AI into revealing a secret. The Context Wall is like a detective who remembers, "Hey, I've seen this pattern before! They are building up to something bad." It stops the conversation before the trap is sprung.

3. How It Works in Real Life

The paper explains that the GAF sits in the middle of the traffic.

It can edit on the fly: If the AI starts to say something bad, the GAF can cut that part out (like a radio censor) and let the rest of the answer through, so the user doesn't have to wait for the whole thing to be blocked.
It handles "Agents": If your AI is a robot that can also use tools (like checking the weather or sending emails), the GAF watches those tools too. It makes sure the robot doesn't accidentally send an email to the wrong person or download a virus.

4. The "5-Star" Rating System

The authors propose a way to measure how good a GAF is, similar to how you rate a hotel or a movie:

1 Star: You have basic network protection.
3 Stars: You have good grammar and access checks.
5 Stars: You have the full "Super-Bouncer" setup. You understand the meaning, remember the whole conversation, and can stop complex tricks.
The Goal: The paper suggests that companies should aim for 5 stars to be truly safe.

5. Why This Matters

The paper concludes that we can't just patch AI security with small fixes. We need a dedicated "firewall" layer, just like we needed one for the internet years ago. As AI gets smarter and more integrated into our lives, we need a guard that speaks the language of the AI, understands the context, and can stop bad actors before they trick the system.

In short: The GAF is a specialized security system that doesn't just look for bad words; it understands the story being told, remembers the history of the chat, and stops clever tricks before they can hurt the AI or the people using it.

Technical Summary: The Generative Application Firewall (GAF)

Problem Statement

The rapid adoption of generative AI in real-world applications has outpaced the development of unified security frameworks. Existing defenses—such as prompt filters, guardrails, and data-masking layers—remain fragmented and insufficient. Traditional security models, including Network Firewalls (Layer 3-4) and Web Application Firewalls (WAFs, Layer 4-7), fail to address the unique threat landscape of Large Language Model (LLM) applications.

Traditional tools rely on syntactic pattern matching and stateless request inspection. However, generative AI attacks, such as prompt injection, jailbreaking, and context manipulation, operate at the semantic layer. These attacks exploit natural language meaning and multi-turn conversational context rather than technical vulnerabilities like SQL injection or XSS. Consequently, malicious requests often appear as legitimate, semantically valid HTTP traffic, bypassing network and traditional application-layer defenses. Furthermore, the rise of autonomous agents introduces new vectors where tool interactions and indirect data poisoning occur, which current WAFs cannot detect or mitigate.

Methodology

The paper proposes the Generative Application Firewall (GAF) as a dedicated architectural layer situated between the user and the LLM application. The GAF functions as a centralized enforcement point that unifies disparate security controls into a coherent perimeter.

The Five-Layer Security Model

The GAF architecture is built upon a defense-in-depth principle, extending the traditional OSI model by introducing a Semantic Layer (Layer 8). The five operational layers are:

Network Layer: Enforces rate limits, blocks abusive IPs, and mitigates volumetric attacks (e.g., prompt flooding, DoS) before session establishment.
Access Layer: Manages authentication, authorization, and role-based access control (RBAC). It enforces least-privilege principles for tools and retrieval scopes, preventing session hijacking and privilege escalation.
Syntactic Layer: Inspects the structure of inputs and outputs to detect escape sequences, obfuscated tokens, and code injections. It validates formats and enforces type/length constraints, acting as a choke point for encoding-based attacks.
Semantic Layer: Detects single-turn attacks that exploit natural language meaning (e.g., DAN, DEV mode, Best-of-N jailbreaks) without requiring full conversational history. It identifies manipulative phrasing and indirect injection attempts.
Context Layer: Addresses multi-turn adversarial strategies (e.g., Echo Chamber, Crescendo attacks) by maintaining session history and role awareness. It correlates prompts and outputs over time to detect escalating intent and behavioral anomalies that isolated requests would miss.

Operational Architecture

The GAF operates as an inline reverse proxy, AI gateway, or sidecar. It manages traffic through a four-phase loop:

Admission: Evaluates identity, rate limits, and syntactic guards.
Generation: Forwards allowed requests with streaming hooks to monitor token-level signals.
Intervention: Executes granular actions upon policy triggers, including selective token redaction, stream termination, or redirection to safe fallbacks.
Post-action: Emits structured logs and updates longitudinal state for future analysis.

Governance and Rating System

The paper introduces a 5-Star Rating System to benchmark GAF maturity, where each star corresponds to the full implementation of one of the five security layers. This system aligns with governance frameworks such as the NIST AI Risk Management Framework (RMF) and ISO/IEC JTC 1 AI guidance, emphasizing risk identification, measurement, and management.

Key Contributions

Architectural Definition: The paper defines the GAF as a distinct architectural layer necessary for securing generative applications, differentiating it from existing concepts like AI Gateways (which focus on routing/scaling) or Prompt Guards (which focus solely on input inspection).
OSI Extension: It proposes the addition of a Semantic Layer (Layer 8) to the OSI model to formally account for the probabilistic, context-dependent nature of LLM interactions, distinguishing failures caused by meaning manipulation from those caused by syntax errors.
Unified Control Plane: The GAF unifies fragmented protections (network, access, syntactic, semantic, and context) into a single enforcement point, capable of orchestrating tools, agents, and user interactions.
Granular Enforcement: Unlike traditional WAFs that make binary allow/block decisions, the GAF supports fine-grained actions such as selective redaction, soft guardrails (redirects), and mid-generation stream termination to preserve usability while enforcing safety.
Standardization Framework: The introduction of the 5-Star Rating System provides a standardized metric for organizations to assess their GenAI security posture and identify gaps.

Results and Claims

The paper does not present experimental data or empirical results from a specific deployment. Instead, it claims the significance of the GAF through architectural necessity and theoretical alignment:

Gap Analysis: The paper argues that without a dedicated layer like GAF, organizations cannot effectively mitigate semantic and context-dependent attacks that bypass traditional WAFs.
Scalability and Policy: It claims that a centralized GAF enables consistent policy enforcement across multi-application environments, addressing the complexity of managing diverse models, agents, and tools.
Performance: The paper asserts that GAF can balance safety with user experience by using selective redaction and deterministic termination, though it acknowledges the need to measure latency overhead ( $\Delta$ ) and false-positive rates in real-world deployments.
Maturity Path: It outlines a progression from a 2-star baseline (identity and rate limiting) to a 5-star comprehensive system (full context awareness and governance integration), suggesting a clear path for adoption.

Significance

The paper positions the GAF as a critical evolution in application security, analogous to the introduction of WAFs for web traffic. It argues that as generative AI transforms the security landscape, a dedicated layer is required to address risks that traditional models cannot see. By providing a unified abstraction, a standardized rating system, and a clear threat model, the GAF framework aims to bridge the gap between rapid AI deployment and the need for robust, responsible safety controls. The authors emphasize that while specific use cases may require tailoring, the pursuit of a comprehensive (5-star) GAF implementation establishes a necessary standard for the safe deployment of generative AI systems.