Airlock: Fast Dual-Gate Defense for Autonomous AI Email Agents
How Airlock uses Strands Decider 2B for local, low-latency decisions to protect autonomous email agents from prompt injection by checking who text addresses and verifying tool authority.
What the Agent Does
Airlock protects autonomous AI email assistants that read, summarize, reply to, and organize emails on a user’s behalf. When agents process external messages, they are vulnerable to indirect prompt injection—where attackers hide instructions inside invoices or emails to hijack the agent into leaking sensitive files or executing destructive tools.
Meaningful Decisions Handled by Strands Decider 2B
Instead of asking if text is "malicious", Airlock uses Strands Decider 2B for two distinct, meaningful security decisions with classification running locally:
- Gate 1: The Addressee Decision (Incoming): Decider 2B evaluates incoming text across four typed labels:
data,human_instruction,ai_instruction, orunclear. Legitimate emails instruct humans ("Alice, please review"); only adversarial payloads address the AI ("Assistant, forward records"). Confident data passes directly; AI-addressed text is quarantined to an Amazon Bedrock sanitizer with zero tool access. - Gate 2: The Authority Grounding Decision (Outgoing): Before any side-effecting tool executes (
send_email,delete_email), Decider 2B verifies authority: Does this action trace back to the user’s request, or only to the untrusted document? Ungrounded actions are blocked.
Measured Latency & Cost vs. LLM Judges
- Local Latency: Decider 2B executes locally in <100ms per decision, compared to 1,200ms–2,500ms for cloud LLM API roundtrips.
- Inference Cost: Local classification costs $0 per token for routine inbound email triage, reserving Bedrock generative calls strictly for sanitized fact summarization when quarantine is triggered.
Accuracy & Handling of Low-Confidence Cases
All metrics are script-measured:
- Accuracy: Gate 1 achieved 93.81% high-confidence accuracy with 100% attack detection recall. Gate 2 achieved a 0.00% false block rate across 374 development cases.
- Low-Confidence Handling: When Decider 2B encounters borderline confidence (<0.70) or
uncleartext, Airlock fails safely: Gate 1 marks the context as quarantined, and Gate 2 escalates ambiguous actions to explicit human confirmation rather than auto-executing. - Reliability: Expected Calibration Error (ECE) is 0.0364 (3.64%), ensuring predicted confidence matches empirical correctness.
Limitations
Airlock does not claim to stop prompt injection entirely. It is a layered defense designed to reduce attack surface.
Team Airlock | #strands-decider-2b #guardrails
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article