Adversarial Resilience

# Adversarial Resilience

Part of [Agent Skills™](https://github.com/itallstartedwithaidea/agent-skills) by [googleadsagent.ai™](https://googleadsagent.ai)

## Description

Adversarial Resilience is the practice of hardening AI agents against deliberate attacks — prompt injection, data exfiltration, sandbox escape, and unauthorized capability escalation. As agents gain more access to tools, APIs, file systems, and code execution environments, the attack surface grows proportionally. An agent that can write files and execute shell commands is a powerful ally but also a potent attack vector if its instructions can be manipulated by adversarial input.

This skill addresses the security challenges encountered in building the Buddy™ agent at [googleadsagent.ai™](https://googleadsagent.ai), where user-provided Google Ads data could theoretically contain injection payloads embedded in campaign names, ad copy, or keyword lists. The defensive patterns here apply to any agent that processes untrusted input — which, in practice, is every agent. Even "internal" tools are vulnerable to indirect injection through documents, code comments, and API responses that contain adversarial content.

The defense model operates in layers: input sanitization strips known attack patterns before they reach the model, instruction anchoring makes the system prompt resistant to override, output filtering prevents sensitive data from leaking through responses, permission boundaries restrict what the agent can do regardless of what it is told to do, and audit logging creates a forensic trail of every action for post-incident analysis.

## Use When

- Agents process any form of user-provided or external input
- The agent has access to sensitive tools (file write, shell execute, API calls)
- Deployed agents are accessible to users outside your trusted organization
- Compliance requirements mandate security controls for AI systems
- You need to protect against both deliberate attacks and accidental injection
- The agent operates in a multi-tenant environment with data isolation requirements

## How It Works

```mermaid
graph TD
    A[Untrusted Input] --> B[Layer 1: Input Sanitizer]
    B --> C[Layer 2: Instruction Anchor]
    C --> D[Agent Core Processing]
    D --> E[Layer 3: Output Filter]
    E --> F[Layer 4: Permission Boundary]
    F --> G{Action Allowed?}
    G -->|Yes| H[Execute Action]
    G -->|No| I[Block + Alert]
    H --> J[Layer 5: Audit Logger]
    I --> J
    J --> K[Response to User]
    
    L[Secret Scanner] --> B
    L --> E
    M[Pattern Database] --> B
```

The five-layer defense model ensures that adversarial content is intercepted at the earliest possible point. Input sanitization detects and neutralizes known injection patterns before they enter the model's context. Instruction anchoring uses structural techniques (XML delimiters, priority declarations, identity reinforcement) to make the system prompt resistant to override. Output filtering scans generated responses for sensitive data leakage. Permission boundaries enforce hard limits on actions regardless of model intent. Audit logging provides complete forensic visibility into every input, decision, and action.

## Implementation

**Input Sanitization Engine:**

```python
import re

class InputSanitizer:
    INJECTION_PATTERNS = [
        r"ignore\s+(all\s+)?(previous|prior|above)\s+(instructions|prompts|rules)",
        r"you\s+are\s+now\s+(?:a|an)\s+",
        r"system\s*:\s*",
        r"<\s*/?system\s*>",
        r"BEGIN\s+SYSTEM\s+PROMPT",
        r"(?:ADMIN|ROOT|SUDO)\s*(?:MODE|ACCESS|OVERRIDE)",
        r"\[INST\]",
        r"<\|(?:im_start|im_end|endoftext)\|>",
    ]

    def __init__(self):
        self.compiled = [re.compile(p, re.IGNORECAS