Defense-in-depth for local LLM inference
+------------------------------------------------------+
| Layer 6: Intrusion Watchdog |
| Monitors processes + network, auto-wipes on alert |
+------------------------------------------------------+
| Layer 5: Secure Conversation Buffer |
| RAM-only storage, cryptographic wipe on close |
+------------------------------------------------------+
| Layer 4: Model Weight Integrity |
| SHA256 verification of model files at startup |
+------------------------------------------------------+
| Layer 3: Dependency Integrity |
| SHA256 manifest of all Python packages at startup |
+------------------------------------------------------+
| Layer 2: Process Network Isolation |
| iptables / Windows Firewall per-process rules |
+------------------------------------------------------+
| Layer 1: Localhost-Only Binding |
| Server binds to 127.0.0.1, unreachable from LAN |
+------------------------------------------------------+Rendered outermost (L6) to innermost (L1). Each layer operates as an independent control.
127.0.0.1 at the OS socket level — unreachable from any other machine on the network, regardless of firewall config.The HTTP server binds exclusively to the loopback interface. This is enforced at the OS socket level — no configuration, reverse proxy, or firewall rule can make the server respond to requests from other machines on the network.
netstat -an | findstr 8000 → shows 127.0.0.1:8000 only
Even if the server process is fully compromised — for example, via a dependency supply-chain attack — it cannot exfiltrate data because outbound network access is blocked at the OS level.
iptables OUTPUT rules scoped to a dedicated kwyre system user UIDNew-NetFirewallRule blocking outbound from the specific Python executable
The server runs as the kwyre user, which has no shell, no home directory, and no outbound
network capability.
Generates and verifies SHA256 hashes of all installed Python packages' RECORD files.
Run once on a clean install to generate the manifest, then verified at every startup.
Detects:
SHA256 hashes of model configuration files are computed on a verified clean install and hardcoded into the server. At every startup, hashes are recomputed and compared.
Files covered:
config.jsontokenizer_config.jsongeneration_config.jsontokenizer.jsonDetects: model substitution, config tampering, and file corruption introduced between installs.
SIGTERM handlerBackground thread scanning every 5 seconds for anomalies. Requires 2 consecutive detections to confirm a violation — avoiding false positives from benign system activity.
Scans for:
psutil)Detected tools include: x64dbg, WinDbg, Ghidra, IDA, Wireshark, Fiddler, mitmproxy, Burp Suite, Process Hacker, Cheat Engine.
On confirmed violation:
Each row maps a concrete attack vector to the layers that address it.
| Threat | Mitigated By |
|---|---|
| Network interception (MITM) | L1L2No network traffic exists to intercept |
| Remote access to inference | L1Localhost binding blocks all remote connections |
| Data exfiltration via compromised dependency | L2L3Outbound blocked + dependency hashes verified |
| Model substitution / poisoning | L4SHA256 weight verification at startup |
| Conversation persistence / disk forensics | L5RAM-only with cryptographic wipe |
| Active debugging / memory inspection | L6Watchdog detects and terminates |
| Server crash without cleanup | L5OS reclaims RAM on process exit — no disk artifacts |
Application-level security has inherent limits. The following threats require hardware-level controls.
psutilThese threats require hardware-level controls — TPM, Secure Boot, encrypted RAM — which are outside the scope of application-level security. Kwyre's architecture addresses the software attack surface only.