CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems

1. Problem Statement

The Model Context Protocol (MCP) is an emerging standard for connecting Large Language Models (LLMs) to external tools, enabling autonomous agents to interact with APIs and data sources. However, this multi-layered architecture introduces significant security vulnerabilities beyond traditional prompt injection:

• Tool Poisoning (MCP03:2025): Attackers embed malicious instructions in tool descriptions, metadata, or schemas, causing the LLM to execute unintended actions.
• Indirect Injection & Data Exfiltration: Malicious instructions hidden within tool outputs can manipulate the model, or tools can be coerced into leaking sensitive user data.
• Limitations of Existing Defenses: Current solutions suffer from:
  • High False Positive Rates (FPR): Some systems report FPRs of 91–97%, making them unusable in production.
  • API Dependency: Many rely on external APIs, creating privacy risks for sensitive data.
  • White-Box Requirements: High-performance detectors often require internal model access (attention patterns), which is impossible for black-box API-based LLMs.
  • Synthetic Data Bias: Most evaluations use synthetic datasets, lacking verification on real-world attack scenarios.

2. Methodology: The CASCADE Architecture

The authors propose CASCADE, a three-tiered, cascaded hybrid defense system designed to operate fully locally (no external API calls). The architecture processes inputs sequentially, escalating complexity only when necessary to balance speed and accuracy.

Layer 1: Pre-Filter (Fast & Rule-Based)

• Function: Acts as a low-latency gatekeeper to block obvious attacks.
• Techniques:
  • Preprocessing: Normalizes text (Unicode NFKD), converts homoglyphs (e.g., Cyrillic to Latin), and decodes obfuscation (Base64, ROT13, Hex, etc.).
  • Multi-View Analysis: Analyzes the input in four views: original, normalized, squashed (compressed repeated chars), and lowercase.
  • Detection: Uses 100+ Regex patterns across 7 categories (e.g., direct injection, tool abuse, data exfiltration) and phrase weighting.
  • Decision: Calculates a risk score (0–100). Inputs >50 or matching specific injection modes are immediately BLOCKED.

Layer 2: Semantic Judge (Embedding + LLM Fallback)

• Function: Analyzes suspicious inputs that passed Layer 1 for semantic intent.
• Techniques:
  • Primary Mechanism: Uses BGE (Bilingual Embedding) embeddings to compute similarity against known attack patterns. This is fast and local.
  • Fallback Mechanism: If the embedding result is ambiguous, the system invokes a local Ollama Llama3 (8B) model for deeper semantic reasoning.
  • Decision: Produces a three-tier output: BLOCK (High Risk), REVIEW (Ambiguous, queued for human inspection), or ALLOW (Safe).

Layer 3: Output Filter (Response Inspection)

• Function: Inspects the final response generated by the MCP Host before it reaches the user.
• Techniques:
  • Keyword Detection: Scans for sensitive terms.
  • Secret Pattern Matching: Identifies API keys and credentials.
  • Entropy Analysis: Detects high-entropy strings (e.g., Base64 encoded data) indicative of data exfiltration attempts.
  • Decision: BLOCK or ALLOW.

3. Key Contributions

1. Hybrid Cascaded Architecture: A novel three-tier system combining regex, embedding-based semantic analysis, and LLM fallback, optimizing the trade-off between latency and detection depth.
2. Fully Local Operation: Unlike competitors (e.g., MCP-Guard), CASCADE uses BGE embeddings and Ollama Llama3, eliminating external API dependencies and ensuring data privacy.
3. Three-Decision Output: Moves beyond binary (Block/Allow) to include a REVIEW state, allowing human intervention for ambiguous cases and reducing false positives.
4. Real-World Dataset: Evaluation on a 5,000-sample dataset derived from real-world sources (GitHub Adversarial, VulnerableMCP, OWASP), rather than purely synthetic data.
5. Granular Analysis: Detailed performance breakdown across 31 attack types categorized into 6 tiers, identifying specific strengths and weaknesses.

4. Experimental Results

The system was evaluated on a dataset of 5,000 samples (3,479 malicious, 1,521 benign) running on a local MacBook Pro (M3 Max).

• Overall Performance:

  • Precision: 95.85% (High confidence in flagged malicious inputs).
  • False Positive Rate (FPR): 6.06% (Significantly lower than the 91–97% FPR of comparable studies like Jamshidi et al.).
  • Recall: 61.05%
  • F1-Score: 74.59%

• Performance by Category:

  • Data Exfiltration: 91.5% Recall (Highly effective).
  • Prompt Injection: 84.2% Recall.
  • Tool Poisoning: 59.9% Recall (Challenging due to technical terminology in tool descriptions).
  • Semantic Attacks: 52.5% Recall (Lowest performance; difficult to distinguish malicious intent from natural language requests).

• Error Analysis:

  • False Positives: All 92 false positives originated from the "Direct Attack" category, caused by benign content (e.g., security training docs) overlapping with attack patterns.
  • False Negatives: 62.4% of missed attacks were "Semantic Attacks," and 33.1% were "Tool Poisoning."

5. Significance and Conclusion

CASCADE addresses a critical gap in MCP security by providing a practical, privacy-preserving defense that avoids the high false positive rates and API dependencies of existing solutions.

• Significance: It demonstrates that a hybrid approach (Regex + Embedding + Local LLM) can achieve a usable balance between security and usability (95.85% precision, 6.06% FPR) without compromising user data privacy.
• Limitations & Future Work: The system struggles with highly nuanced semantic attacks and tool poisoning due to the complexity of tool descriptions. Future work aims to integrate ML-based semantic analysis, develop tool-specific detection mechanisms, and evaluate performance on multilingual and dynamic real-time environments.

In summary, CASCADE represents a significant step forward in securing the emerging MCP ecosystem, offering a robust, local-first defense mechanism against the evolving landscape of LLM-based tool attacks.