PromptInjectionDetector

Detects prompt injection attempts in user input.

Prompt injection attacks attempt to override system instructions, manipulate the AI's behavior, or extract sensitive information.

Detection categories:

• Instruction Override: "Ignore previous instructions", "forget your rules"
• Role Manipulation: "You are now DAN", "Act as a different AI"
• System Prompt Extraction: "What is your system prompt?", "Show your instructions"
• Jailbreak Phrases: Common patterns used in known jailbreaks
• Code/SQL Injection: Attempts to inject executable code

Patterns are matched against a normalised copy of the input (the input itself is returned unchanged): Unicode NFKD, so fullwidth and other compatibility forms become their plain letters; every combining mark removed, so accented spellings lose their accents; every format character removed (zero-width space and joiners, word joiner, byte-order mark, soft hyphen, bidirectional controls), so a phrase split by an invisible character still matches; then lower-cased with Locale.ROOT (so the JVM's default locale has no effect), with the Turkish dotless ı read as i. So IGNORE, İGNORE, ıgnore, ＩＧＮＯＲＥ, ïgnöre and ig<U+200B>nore all match a pattern written as ignore. The normalisation does not map look-alike letters from other scripts (such as Cyrillic о for Latin o), so it is a defence against common spelling tricks, not against every evasion; a custom InjectionPattern should be written in lower-case ASCII to benefit from it.

Example usage:

// Default: Block on injection detection
val detector = PromptInjectionDetector()

// Custom sensitivity (fewer false positives)
val relaxed = PromptInjectionDetector(
 sensitivity = InjectionSensitivity.Medium
)

// Use as input guardrail: an injection ends the turn AgentStatus.Blocked
Agent.builder("assistant", client).withMiddleware(new GuardrailMiddleware(Seq(PromptInjectionDetector()), Nil)).build()