Nov 23, 2025

DuneBox - Prompt Injection Detection with SLM in Local Sandbox

Justin Shaw, Suzanna Lam Hio Lam, Paul Fangchen Huang

A locked-down sandbox environment designed to safely evaluate language models (SLMs/LLMs) and identify malicious attacks within a Chrome extension. The sandbox isolates model interactions from the broader browser and system, enabling users to test potentially malicious prompts without risking data exposure or unintended actions. It provides a controlled setting for examining prompt-injection risks, behavioral weaknesses, and other LLM vulnerabilities.

Review Project

See Code

Reviewer's Comments

Clever solution. The browser-based sandbox seems easy to access and experiment with, which could make this a useful testbed for developers. I think especially for orgs where no one on staff has expertise in AI or AI safety, this tool seems easy to use and approachable. I think this project would benefit from a clearer explanation of where this sandbox fits in the development pipeline. Is there evidence that behavior observed in this restricted environment will reflect how the model acts once it gains real-world permissions?

I would also love to see more clarity on what kinds of threats this setup is actually meant to catch. Since the model has no tool access, many of the high-impact failure cases for agents do not apply here.

Nice work, this feels like browser safe-browsing sandboxes that pre-scan links before the user opens them. Conceptually it also overlaps quite a bit with what AI labs are already doing with constrained sandboxes + behavioral monitors for tools/agents, e.g. OpenAI’s Agent Mode, just targeted at local SLMs inside the browser.

Strengths: A working Chrome extension with local SLM inference in hackathon timeframe is solid execution. The sandboxing approach is sound: strip capabilities and observe what the model tries to do anyway. The attack scenario coverage (multilingual injection, obfuscated payloads, role-play bypasses, DoS loops) shows good threat modeling instincts. UX polish is impressive for the time constraints.

Suggestions: Who's the end-user— Security researchers red-teaming prompts? Developers vetting inputs before production? Enterprise teams auditing MCP integrations? The tool works, but the persona matters for roadmapping/deployment at scale. Also worth noting: SLM behavior may not generalize to frontier models, which limits external validity.

POV from a Halcyon Ventures investor: The MCP gold rush makes sandboxed prompt testing more relevant. As agents get tool access, testing dangerous prompts safely before deployment becomes a real workflow need. Very well done, team!

Cite this work

@misc {

title={

(HckPrj) DuneBox - Prompt Injection Detection with SLM in Local Sandbox

author={

Justin Shaw, Suzanna Lam Hio Lam, Paul Fangchen Huang

date={

11/23/25

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Feb 2, 2026