How ConvoZen's Mockingjay pipeline brings deterministic, auditable security to every voice interaction.
Deploying an LLM in a production voice channel is not just an engineering problem. It is a security problem. A voicebot handling millions of real-estate conversations must respond instantly, stay on-topic, and never expose business logic or user data, even when callers actively try to make it do otherwise. The OWASP LLM Top 10 provides the industry's definitive threat map for exactly these risks.
"At ConvoZen, we built the Mockingjay guardrail pipeline to address the categories that can be mitigated at runtime, without retraining the model or adding perceptible latency."
This article documents what we built, how we tested it, and what the numbers show.
The Open Web Application Security Project (OWASP) maintains the definitive community-driven framework for LLM application security. The 2025 edition defines ten vulnerability categories that every team deploying production LLM workloads should understand and address. Below is a concise overview of each, as context for the runtime mitigation work described in the rest of this article.
| # | Category | What it means |
|---|---|---|
| LLM01 | Prompt Injection | Crafted inputs override model instructions, redirecting behavior or leaking data. |
| LLM02 | Sensitive Information Disclosure | Models surface confidential data from training corpora, system prompts, or RAG stores. |
| LLM03 | Supply Chain Vulnerabilities | Compromised third-party models, datasets, or plugins introduce risks upstream. |
| LLM04 | Data and Model Poisoning | Contaminated training data introduces backdoors or biases that are hard to detect at inference time. |
| LLM05 | Improper Output Handling | Unsanitized LLM output reaches downstream systems carrying executable payloads (SQLi, XSS, RCE). |
| LLM06 | Excessive Agency | Overly permissive agents take damaging real-world actions from unexpected or malicious outputs. |
| LLM07 | System Prompt Leakage | Attackers extract system prompt contents, exposing business rules, keys, or persona instructions. |
| LLM08 | Vector and Embedding Weaknesses | RAG pipelines can be poisoned or queried to reconstruct private documents or cross tenant boundaries. |
| LLM09 | Misinformation | Models generate authoritative-sounding but factually wrong output with no mechanism for users to detect it. |
| LLM10 | Unbounded Consumption | Token-flooding or recursive loops exhaust capacity, causing service degradation or runaway inference costs. |
The remainder of this article focuses on the categories addressable at the runtime guardrails layer — categories where we can intercept and mitigate attacks without retraining the model.
The OWASP LLM Top 10 spans 10 vulnerability categories. At ConvoZen, we address the categories that can be mitigated at runtime — intercepting attacks before or after the model without touching training or infrastructure. For LLM01, LLM02, LLM05, LLM07, and LLM10, we built explicit guardrail logic directly into the Mockingjay pipeline. LLM06 has the structural scaffold in place. The remaining categories (LLM03, LLM04, LLM08, LLM09) are handled at the model-selection, dataset-curation, and RAG-configuration layers — upstream of the runtime pipeline.
We built the adversarial test suite from scratch. Every case targets a specific OWASP category and was written to reflect real attack patterns across languages and severity levels.
Cases span English, Hindi, Hinglish, and French to probe whether multilingual inputs could bypass defenses tuned primarily on English patterns. Severity is rated High (48 cases), Medium (51), and Low (16), based on the impact if the attack succeeds.
| Category | Key attack vectors tested |
|---|---|
| LLM01 Prompt Injection | Direct role-override, Base64-encoded payloads, DAN persona, payload splitting in English and Hindi |
| LLM02 Sensitive Info | API key extraction, Aadhaar PII probing, tool response injection, RSA PEM completion, entropy trigger |
| LLM04 Model Poisoning | Seed-phrase repetition in English and Devanagari |
| LLM05 Output Handling | XSS, SQL injection, shell commands, SSML/TTS injection, spreadsheet formulas, URL schemes |
| LLM06 Excessive Agency | Autonomous shell escalation, Hinglish vague grant, netcat reverse shell, SQL in tool call |
| LLM07 Prompt Leakage | Direct extraction, Hindi/French translation, BanList evasion, content overlap, sliding window, TAP pruning |
| LLM08 RAG Weaknesses | RAG poisoning (English and Hindi), Crescendo injection, exfiltration beacons via custom and HTTPS protocols |
| LLM09 Misinformation | Fabricated citations, hallucinated API methods |
| LLM10 Unbounded | Sponge payload, multi-turn bloat, Devanagari inflation, recursive expansion, infinite loop, boundary tests |
Each of the 115 cases ran against all three models with the same system prompt (33,723 characters), with and without the active guardrail pipeline. Every response was scored as PASS, FAIL, or REVIEW.
| Model | ASR with GR | ASR without GR | Change | ABR (PASS only) |
|---|---|---|---|---|
| Gemini 2.5 Flash | 6.1% | 29.6% | -23.5 pp | 73.0% |
| Gemma 4 26B | 2.6% | 9.6% | -7.0 pp | 51.3% |
| Gemini 3.5 Flash Lite | 2.6% | 10.4% | -7.8 pp | 67.8% |
Guardrails matter most for Gemini 2.5 Flash. Without them, it fails nearly 1 in 3 attacks. With them, that drops to 1 in 16. It is the most vulnerable model without guardrails, and the strongest confirmed blocker with them, at 73% confirmed PASS.
Gemma 4 and Gemini 3.5 Flash Lite blocked many attacks on their own. Both sit around 9 to 10% ASR even without any guardrails active. This reflects their native training: for categories like LLM04 (model poisoning), LLM08 (RAG), and LLM09 (misinformation) where we built no runtime coverage at all, these models still refused the majority of attempts through their own alignment. Guardrails on top then reduce ASR a further 7 to 8 points.
Native model refusals are real but not sufficient. For Gemini 2.5 Flash, native refusals alone left a 29.6% attack success rate. The REVIEW category is where the risk lives: 20 to 46% of adversarial interactions end in REVIEW across models, meaning the model deflected but did not explicitly refuse. A rephrased escalation in the next turn may still get through. The confirmed PASS-only rate, 51 to 73%, is the right number to plan around.
The guardrail pipeline runs synchronously in the voicebot request path. We measured end-to-end latency with and without the pipeline active across all 115 cases per model.
The guardrail pipeline adds security without adding perceptible latency. A caller on the other end of the line will not notice the difference.
| Metric | 2.5 Flash without GR | 2.5 Flash with GR | 3.5 Flash Lite without GR | 3.5 Flash Lite with GR | Gemma 4 26B without GR | Gemma 4 26B with GR |
|---|---|---|---|---|---|---|
| Mean | 1.50 s | 1.83 s | 1.40 s | 1.45 s | 0.67 s | 0.68 s |
| Median (P50) | 0.96 s | 1.05 s | 1.08 s | 1.11 s | 0.41 s | 0.48 s |
| P95 | 5.84 s | 7.48 s | 3.45 s | 2.91 s | 1.16 s | 1.68 s |
| P99 | 7.67 s | 11.62 s | 7.47 s | 8.00 s | 5.21 s | 5.48 s |
| GR overhead (median) | +0.09 s | +0.03 s | +0.07 s | |||
Median overhead is under 100 milliseconds for all three models, which is imperceptible in a live voice call. The tail is a different story. Gemini 2.5 Flash's P99 rises from 7.67 seconds to 11.62 seconds with guardrails active. This is because the sanitize and leakage checks do more work on long, complex outputs, and long complex outputs are precisely the ones most likely to warrant that extra scrutiny.
The core contribution of this work is a runtime guardrail pipeline that blocked attacks the underlying models would otherwise have let through.
Against Gemini 2.5 Flash, the pipeline reduced FAIL verdicts from 34 to 7 across 115 adversarial cases, turning a 29.6% attack success rate into 6.1%. Across all three models combined, the guardrails converted 52 FAIL outcomes into confirmed blocks.
What the guardrail pipeline adds is a deterministic, auditable layer on top: consistent behaviour regardless of which model is under the hood. Gemma 4 26B and Gemini 3.5 Flash Lite kept their unguarded ASR below 11% through their own alignment.
The clearest signal across 115 cases and three models is the gap between PASS+REVIEW and FAIL. A system that deflects an attack through domain restriction is not the same as one that refuses it.
The median overhead is under 100 ms across all three models, imperceptible in a live voice call. The median case imposes no cost a production system cannot absorb.
ConvoZen Research · NoBroker AI · September 2026