Skip to main content

Prompt Injection Detection

prompt-injection detects jailbreak and instruction-override signals in requests. It supports regex attack patterns, encoding changes, boundary checks, external embeddings, and data-poisoning signals.

Full example​

pack:
  name: injection-protection
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
policy:
  prompt-injection:
    backend: local
    attack_patterns:
      - ignore.*previous.*instructions
      - forget.*system.*prompt
      - reveal.*system.*prompt
    encoding:
      decode_base64: true
      normalize_unicode: true
      detect_homoglyphs: true
    boundaries:
      enforce_delimiters: true
      reject_fake_boundaries: true
    response:
      action: block

Field reference​

FieldTypeNotes
backendstringlocal or external.
endpointstringNecessary when backend: external.
modelstringEmbedding model identifier for the external backend.
api_keystringOptional bearer token for the external backend. The value is literal. This field does not expand ${ENV_VAR}.
timeout_msintegerTimeout for external embedding calls.
embedding_thresholdnumberSimilarity threshold for embedding-based detection.
attack_patternsstring[]Regex patterns appended to the built-in detector list.
encoding.decode_base64booleanDecode Base64-like input before matching.
encoding.normalize_unicodebooleanNormalize Unicode escapes and related encodings.
encoding.detect_homoglyphsbooleanFold homoglyphs before matching.
boundaries.enforce_delimitersbooleanDetect delimiter confusion across role boundaries.
boundaries.reject_fake_boundariesbooleanDetect fake system-boundary markers.
response.actionstringUse block. The detector blocks each standard prompt-injection match.
data_poisoning.enabledbooleanTurn on anomaly-style data-poisoning checks.
data_poisoning.backdoor_trigger_patternsstring[]Custom trigger strings to examine.
data_poisoning.perplexity_thresholdnumberThreshold for anomalous text detection.
data_poisoning.anomaly_actionstringblock, warn, or audit.

To use the external embedding backend, install a CLI build with embedding-external. Other builds use the local detector with backend: external.

External backend credentials are literal

The api_key field does not support environment or secret-store references. Do not put a provider key in version-controlled config. Use backend: local when stored secret references are necessary for your security policy. The external backend does not have that behavior.

When data-poisoning checks find a signal, only anomaly_action: block changes the verdict. warn and audit allow the request and record details.

Standard patterns​

Local-only detector​

policy:
  prompt-injection:
    attack_patterns:
      - ignore.*previous.*instructions
      - forget.*system.*prompt
    encoding:
      decode_base64: true
      normalize_unicode: true
      detect_homoglyphs: true
    boundaries:
      enforce_delimiters: true
      reject_fake_boundaries: true
    response:
      action: block

External embedding backend​

Use this shape only for an endpoint that operates without a bearer credential. You can also use it in a protected runtime config. Your organization must approve the config for literal secret handling:

policy:
  prompt-injection:
    backend: external
    endpoint: https://embedding-service.example.com/v1/embeddings
    model: approved-embedding-model
    embedding_threshold: 0.8

Add data-poisoning checks​

policy:
  prompt-injection:
    attack_patterns:
      - ignore.*previous.*instructions
    data_poisoning:
      enabled: true
      backdoor_trigger_patterns:
        - cfzq
        - sleeper trigger
      perplexity_threshold: 50
      anomaly_action: block

Best practices​

  • Put prompt-injection at the start of the chain so hostile input is blocked before downstream policies run.
  • Keep custom attack_patterns narrow and clear. Broad regex patterns cause many false blocks.
  • Use backend: external only when semantic similarity checks and the built-in detector are necessary, and the security policy specifies literal credentials.
  • Use data_poisoning as a signal layer, not a replacement for the standard attack patterns and boundary checks.

Next steps​