PALIM

A Framework for Designing Secure GenAI Applications

PALIM is a five-part framework for designing GenAI applications on top of LLMs that hold up under adversarial pressure. For each part, you assume the worst case, then design so the impact is contained. Built for solution architects, application engineers, and product owners.

Read the deep dive

LLMs introduce threats that can't be fully detected — prompt injection, hallucination, data leakage. There's no input filter, output filter, or guardrail that closes the gap. The limits are mathematical, not an engineering backlog.

So the architectural response isn't detect and block. It's assume and contain. Security cannot live inside the LLM. The model is a language layer — not a policy engine, not an access-control system, not a rule engine.

If enforcement lives inside the model boundary, it is not enforcement. It is an assumption.

P — Predefined Prompts Injectable. System prompts combined with user input can be overridden. Find every one; assume it gets turned against you. → Assess the impact.

A — Automation and Plugins Contained. When automation acts on LLM output, wrong or hijacked output becomes real-world action. → Bound the blast radius outside the model.

L — Logic Rules Deterministic. An LLM follows instructions that resemble rules; it doesn't enforce them. → Put consequential logic in deterministic code.

I — Isolation of Data Enforced. Point the LLM at a shared store and access control becomes a suggestion.
→ Scope per-user access at the data layer.

M — Model GenAI Threats First. Model the GenAI-specific threats (incl. confidently wrong output, the biggest one) before you commit architecture. → Understand before you design.

Apply PALIM by assuming the adversary succeeds at each concept, then reasoning backward to the design decision. The test is always the same: take anything the LLM can reach and ask whether it's enforced by code outside the model, using the authenticated user's identity. If it isn't, you've written a hope, not a control.