SQLProof: A Hybrid Security Verification Framework for LLM-Based Text-to-SQL Systems
DOI:
https://doi.org/10.70917/ijcisim-2026-4214Keywords:
Text-to-SQL, LLM security, prompt injection, backdoor attacks, hybrid verification, bounded semantic assurance, proof-carrying code, database authorization, information-flow provenanceAbstract
Large language model (LLM) Text-to-SQL systems can improve the accessibility of databases, but they also pose new
security risks not addressed by conventional SQL-injection classifiers. A query generated by a generator might be syntactically
correct and not contain any known payload signatures, but still fail to meet the user's intent, cross authorization boundaries, be
influenced by retrieved content that is not trusted, or be generated by a backdoored model. In this study, we introduce SQLProof,
a proof-carrying execution framework in which every generated SQL query should meet independent obligations of intent
alignment, policy compliance, source authorization, information-flow isolation, write safety and resource cost prior to execution.
The LLM is not part of the trusted computing base. SQLProof transforms a natural-language request into an intent contract,
combines it with a role- and context-aware authorization contract, converts the resulting query into a semantic graph, and performs
a bounded semantic comparison and a provenance analysis of the resulting obligations against a deterministic parsing and a policy
check. The framework was validated using the ProofSQL-Bench, which contains 4,000 executable security episodes, including
direct and indirect prompt injection, backdoor text-to-SQL generation, semantic privilege escalation, leakage of sensitive data, unsafe writes and resource-exhaustion queries. In the eight security scenarios, SQLProof could block the attacks with a macro-
averaged attack-blocking rate of 97.9%, while the strongest baseline that was evaluated in this study could block attacks with a macro-averaged attack-blocking rate of 80.1%. The acceptance rates for benign queries were 94.1% for SQLProof and 92.6% for
the strongest baseline evaluated in this study. SQLProof achieved an unauthorized-execution rate of 0.6%, as compared to 4.7%
for the best baseline tested in this study. Ablation results show that intent contracts and influence provenance contributed the most
to the end-to-end SQLProof decision latency beyond just policy-only enforcement, which was 43.8 ms. SQLProof was able to
conduct post-generation security verification for all the assessed text-to-SQL generators for the assessed threat model and
benchmark conditions.
