Securing LLM-powered features at Dropbox

Dropbox relies on large language models (LLMs) for features that let users chat with, summarize, transcribe, and retrieve information from their files. These models bring new attack surfaces: untrusted user inputs can trigger prompt injection, jailbreak attempts, or moderation failures, producing outputs that range from embarrassing to harmful. After evaluating a range of open-source, in-house, and commercial options, Dropbox selected Lakera Guard to sit in front of its LLM pipelines.

Hard requirements for a security layer

Dropbox narrowed its evaluation criteria to four non-negotiable requirements:

  • In-house deployment. The solution had to run on Dropbox's own infrastructure. No customer prompts or model outputs could be sent to a third party.
  • Low latency. Product teams set strict upper bounds on added latency. Performance had to hold up at long context lengths—many options degrade sharply past 4,000 tokens, while real Dropbox use cases routinely exceed that.
  • Granular confidence scores. The API needed per-category blocking controls with adjustable sensitivity, so product teams could set their own thresholds for things like jailbreak detection.
  • Continuous improvement. The vendor had to surface actionable intelligence about emerging attacks and payloads, since LLM security evolves quickly.

Testing methodology

Shortlisted tools were stood up internally and evaluated with Garak, an open-source LLM vulnerability scanner, customized with Dropbox-specific security tests. Each tool was then tested against the actual LLMs in use or under evaluation by product teams. This second step mattered because a tool that blocks 90% of malicious prompts might add little value if the model already deflects 85% of them on its own.

Alongside security coverage, the team measured response time added by each tool and watched network requests and file changes to confirm no prompt content was stored or exfiltrated. Lakera Guard met all criteria, with the best combination of low latency and high detection coverage.

Architecture and integration

Lakera Guard runs as a Docker container hosted as an internal Dropbox service, so any LLM pipeline can reach it with an RPC call. The design follows a LangChain-style chain layout.

A high-level representation of the internal AI/ML security infrastructure at Dropbox

Incoming textual prompts first pass through one or more security chains that make prompt-injection and jailbreak requests to the internally hosted container. The container returns confidence scores per category, and Dropbox services decide how to act based on their app's configuration. Safe prompts then go to the model—either a third-party API like GPT-4 or an internally hosted open-source model such as LLaMA 3—and the response flows through a moderation chain that calls Lakera's content moderation endpoint to flag harassing or explicit text before it reaches the user.

Rollout started with a single product calling the Docker container directly. Dropbox later built a custom service that auto-scales Lakera containers on demand, exposed through an LLM security layer within Dropbox's central machine-learning libraries.

Latency results and ongoing work

Latency was the biggest concern across product teams, especially for prompts longer than 8,000 characters. Close work with Lakera brought the average added latency down to a 7x improvement for those long prompts compared with initial results.

Dropbox has also contributed back to Lakera's development. The teams shared internal research on repeated token attacks that cause model hallucinations and collaborated on improving malicious-prompt detection. Some false positives traced back to poor user input sanitization, which Dropbox fed back to product teams for fixes. Lakera, in turn, worked to understand Dropbox's product flows to better align its detection features.

Dropbox plans to extend the Lakera Guard integration to every LLM-powered product. That means tuning detection thresholds per use case and probing for latency or false-positive issues that could arise with different data structures. The company has also invested in Lakera through Dropbox Ventures.