Open-source prompt-injection detector, with a real-world attack corpus collected from a live red-team game

Releasing a detector for prompt injection and jailbreak attempts against LLM inputs, under Apache-2.0. The security-relevant bits: – Defence in depth rather than one model. A regex fast-reject layer (~430 patterns covering direct overrides in ~11 languages, DAN/persona jailbreaks, template-injection sigils, agentic CoT injection, homoglyph and zero-width evasion) runs first, backed by a decode-then-scan step for base64/ROT13/leetspeak. A quantised DeBERTa-v3 classifier handles the ambiguous remainder. – Multimodal coverage: OCR + EXIF/PNG/XMP metadata for images, with a lossy re-encode that destroys LSB steganography and adversarial perturbation before OCR; PDF/DOCX including headers, footers and comments; audio via ASR. – A real attack corpus. I ran a gamified platform where people competed to defeat a live detector. 13,230 successful/attempted bypasses were anonymised (identifiers stripped, in-text PII redacted, high-risk rows quarantined for manual review) and published as a real-world split alongside the synthetic data. – Code: https://github.com/Josh-blythe/bordair-detector – Dataset: https://github.com/Josh-blythe/bordair-multimodal Threat model is runtime injection only (text placed in the context window at inference time); training-time attacks are explicitly out of scope. Interested in adversarial review – if you can bypass the regex layer trivially, that’s useful to know. submitted by /u/BordairAPI [link] [comments]Technical Information Security Content & DiscussionRead More