PayGuard Sentinel

B2B Payment Firewall & Active Canary Defense stopping AI invoice fraud on PayPal.

Comment

💡 Inspiration

The rise of autonomous AI accounting agents and automated B2B invoice processing has created a massive, unspoken vulnerability in corporate finance: AI-on-AI Financial Warfare.

While businesses use LLMs and OCR pipelines to speed up accounts payable, threat actors have evolved beyond basic phishing. Today's scammers deploy Indirect Prompt Injections hidden inside binary PDF layers (microscopic 0.8pt white-on-white text, off-page negative coordinates, and poisoned XMP metadata) designed to hijack corporate AI assistants into auto-approving fraudulent payouts. Furthermore, scammers now use autonomous scraping bots to process payment confirmations and drain accounts at machine speed.

We built PayGuard Sentinel to give PayPal B2B merchants an institutional-grade payment firewall that doesn't just passively scan invoices—it reads between the binary layers and actively traps autonomous scammer bots before a single dollar leaves the PayPal vault.

đŸ›Ąïž What it does

PayGuard Sentinel is an Enterprise B2B Payment Firewall and Active Deception Workbench built directly around the PayPal REST API v2. It protects businesses through four integrated pillars:

  1. Side-by-Side X-Ray PDF Forensic Scanner: Compares how a human sees an invoice against what an AI agent reads in the raw PDF Abstract Syntax Tree (AST). It detects microscopic prompt overrides (< 3.5pt), low-contrast white-on-white text, off-page negative coordinates $(x < 0, y < 0)$, Base64-obfuscated jailbreaks, and poisoned XMP metadata streams.
  2. Active Defense "Canary Honeytoken" Bot Trap: When a suspicious invoice is flagged, PayGuard Sentinel generates a deceptive Payment Verification & Remittance Advice PDF. To a human, it looks like a standard compliance hold notice. However, embedded in the invisible machine-readable layer is a unique Canary Honeytoken URL. When the scammer's automated AI agent parses the document and hits the trap endpoint in sub-second time ($TTI < 800\text{ ms}$), our system proves mathematically that the counterparty is a malicious bot, captures its telemetry (User-Agent, IP, headers), and permanently blacklists the merchant.
  3. OSINT Homograph & Ledger Arithmetic Auditor: Automatically verifies invoice line-item math, tax calculations, and detects IDN homograph domain spoofing (e.g., paypaI-b2b-settlement.com using an uppercase I instead of a lowercase l).
  4. PayPal Sandbox Cryptographic Settlement Interlock: Connects live to the PayPal Sandbox REST API (/v1/oauth2/token & /v2/checkout/orders). Verified clean invoices can be executed individually or in batch payouts with a single click. Any invoice with a Risk Score $R \ge 25$ or an active Canary trigger is hard-blocked at the API gateway level (HTTP 403 PAYPAL_FIREWALL_BLOCKED), saving thousands in potential losses and generating a downloadable Official Forensic Audit Report PDF.

⚙ How we built it

We engineered PayGuard Sentinel as a high-precision, full-stack monorepo with a clean institutional daylight UI inspired by Stripe Radar and PayPal Enterprise:

  • Backend (/backend — Python & FastAPI):
    • Byte-Level PDF AST Forensics (PyMuPDF / fitz): We built a deterministic scanner using page.get_text("rawdict", clip=INFINITE_RECT()) to inspect every span outside the standard visible MediaBox, sampling background luminance contrast and font matrices without relying solely on external LLMs.
    • Adversarial & Canary PDF Compiler (ReportLab): Dynamically generates a 12-scenario B2B invoice corpus on startup (covering cloud vendors, logistics, BEC spoofing, and multi-layer prompt injections) as well as live Honeytoken PDFs and downloadable Forensic Audit Certificates.
    • Live PayPal Sandbox Gateway (httpx): Performs real-time OAuth2 handshakes, measures round-trip API latency, creates live PayPal Sandbox orders, and enforces the backend security interlock.
    • Hybrid AI Enrichment: Works 100% autonomously out-of-the-box via our deterministic AST heuristic engine, with an optional runtime API Vault supporting Google Gemini (google-genai) for deep multimodal reasoning.
  • Frontend (/frontend — Next.js 15, TypeScript & Tailwind CSS):
    • Designed a clean, distraction-free enterprise workspace with instant Bilingual Support (ES / EN) and 5 dedicated views: Invoice Inbox & Batch Payouts, Side-by-Side X-Ray Inspector, 3-Step Active Canary Bot Hunter, Custom Adversarial Attack Lab, and PayPal Sandbox Ledger & API Vault.

📐 Mathematical & Forensic Models

To eliminate false positives and provide deterministic security guarantees before calling the PayPal Orders API, PayGuard Sentinel evaluates three mathematical models on every PDF document:

1. Visual Luminance & Contrast Stealth Ratio

To catch invisible white-on-white or near-background prompt injections, we compute the relative perceptual luminance $L$ of every text span $(R, G, B) \in [0, 1]^3$ against the rendered page background $L_{\text{bg}}$:

$$L = 0.2126 R + 0.7152 G + 0.0722 B$$

$$C_{\text{ratio}} = \frac{\max(L_{\text{text}}, L_{\text{bg}}) + 0.05}{\min(L_{\text{text}}, L_{\text{bg}}) + 0.05}$$

Any text span where font size $s < 3.5\text{ pt}$, contrast ratio $C_{\text{ratio}} < 1.15$, or coordinates $(x_0, y_0) \notin [0, W] \times [0, H]$ is flagged as a stealth layer anomaly.

2. Composite Invoice Risk Score ($R$)

The PayPal Settlement Firewall calculates a bounded risk score $R \in [0, 100]$ combining four weighted forensic vectors:

$$R = \min\left(100, \; w_{\text{AST}} \cdot S_{\text{AST}} + w_{\text{sem}} \cdot S_{\text{sem}} + w_{\text{math}} \cdot S_{\text{math}} + w_{\text{OSINT}} \cdot S_{\text{OSINT}}\right)$$

where:

  • $S_{\text{AST}}$ measures hidden structural anomalies (microscopic fonts, off-page coordinates, XMP metadata tampering).
  • $S_{\text{sem}}$ scores adversarial jailbreak patterns (SYSTEM OVERRIDE, IGNORE PREVIOUS, Base64 payloads).
  • $S_{\text{math}}$ flags ledger discrepancies where $\left| \sum (\text{Qty}_i \times \text{Unit}_i) + \text{Tax} - \text{Total} \right| > \epsilon$.
  • $S_{\text{OSINT}}$ detects homograph domain spoofing and unauthorized PayPal merchant destination changes.

If $R \ge 25$, the PayPal gateway enforces a cryptographic block (HTTP 403).

3. Non-Human Velocity Verification (Canary Time-To-Interaction)

When our Canary PDF is dispatched at timestamp $t_{\text{emit}}$ and the embedded Honeytoken URL is triggered at $t_{\text{hit}}$, we compute the Time-To-Interaction ($\Delta t$):

$$\Delta t = t_{\text{hit}} - t_{\text{emit}}$$

Because a human operator requires $\Delta t_{\text{human}} \ge 15,000\text{ ms}$ to download, open, and visually read a remittance PDF, any callback where $\Delta t < 800\text{ ms}$ (e.g., $\Delta t \approx 155\text{ ms}$ in our live parser test) provides cryptographic certainty ($P(\text{Bot}) > 0.999$) that the counterparty is running an automated scraping agent.

🚧 Challenges we ran into

  1. Catching Off-Page Negative Coordinates in PDFs: Standard PDF text extractors automatically clip text outside the visible page boundaries, meaning an LLM parser might still read raw streams while security scanners miss them. We solved this by configuring PyMuPDF with INFINITE_RECT() clipping and normalizing bounding boxes so our frontend X-Ray view can visually render off-canvas attacks for human auditors.
  2. Translating Complex Forensics into Executive Clarity: Early iterations of our interface looked like an overwhelming terminal full of raw hex dumps and AST logs. We completely tore down the UI and rebuilt it from scratch into a clean, Stripe/PayPal-inspired daylight workflow where any finance manager can immediately compare "What a human sees" vs. "What the hidden trap says" in plain language.
  3. Ethical Active Defense: Instead of attempting intrusive counter-hacks, we engineered our Canary Honeytoken Engine using standard HTTP webhook telemetry inside verification documents—making our active bot detection 100% compliant, legal, and deterministic.

🏆 Accomplishments that we're proud of

  • End-to-End Live PayPal Sandbox Integration: Creating real PayPal Sandbox orders (v2/checkout/orders) for verified invoices while proving our HTTP 403 security interlock blocks poisoned invoices in real time.
  • Sub-200ms Autonomous Bot Interception: Building a working asynchronous Honeytoken pipeline where a simulated scammer scraper parses our Canary PDF and gets caught and blacklisted in ~155 ms.
  • 12-Scenario Realistic B2B Corpus + Custom Attack Builder: Shipping the platform with 12 diverse B2B invoices ready to test in one click, plus an interactive lab where judges can craft their own custom prompt-injected PDFs and watch PayGuard Sentinel catch them live.

📚 What we learned

We learned how deeply PDF rendering engines differ from LLM tokenization pipelines, and how easily standard OCR/AI accounting workflows can be manipulated through typography and coordinate manipulation. We also learned that the most effective defense against automated AI fraud is turning the attacker's speed against them through Canary Honeytokens and strict pre-settlement API interlocks.

🚀 What's next for PayGuard Sentinel

  • PayPal Webhooks & Invoicing API Sync: Automatic ingestion of incoming INVOICING.INVOICE.CREATED events directly from a merchant's PayPal Business account.
  • Email Gateway Plugin (IMAP / Google Workspace / Microsoft 365): Intercepting supplier PDF attachments in the inbox and automatically replying to high-risk scammers with armed Canary Verification PDFs inside a sandboxed quarantine thread.
  • Shared Threat Intelligence Network: Allowing PayPal merchants to anonymize and share intercepted scammer bot fingerprints and blacklisted merchant IDs across the PayGuard network.

Built With

Share this project:

Updates

Submission history