PromptGuard Core Features
Engineered as an enterprise-grade pre-execution firewall for Large Language Model applications, combining multi-stage linguistic heuristics with mathematical risk bounding.
Six-Layer Detection Pipeline
PromptGuard inspects every incoming prompt sequentially across six specialized algorithmic layers before computing risk scores or initiating any LLM communication.
Unicode Preprocessing & Normalization
Decomposes and normalizes Unicode strings via NFKC. Strips invisible zero-width spaces (\u200b, \u200c, \ufeff), collapses whitespace, and unescapes URL entities.
Rule-Based Threat Detection
Matches high-confidence adversarial signatures across 9 categories: Instruction Overrides, System Prompt Extraction, DAN Persona Jailbreaks, Developer Overrides, Secret Extraction, Tool Exploits, and Exfiltration.
Instruction Hierarchy Analyzer
Protects the canonical hierarchy: System > Developer > User > External Content. Identifies forged boundary tokens (<|im_start|>) and instruction priority inversions.
Obfuscation & Cipher Detection
Extracts Base64 substrings with automatic padding recovery and recursive payload evaluation. Identifies hex byte sequences, Unicode homoglyphs, and leetspeak substitution attacks.
Behavioral Intent Analysis
Evaluates prompt intent along 5 threat vectors: revealing hidden information, credential harvesting, unauthorized tool invocation, modifying system behaviors, and exfiltrating data out-of-band.
Semantic Similarity Clustering
Differentiates benign academic/educational inquiries ("What is prompt injection?") from active exploits. Evaluates semantic distance to OWASP LLM01 and CWE-1427 datasets.
10-Factor Adaptive Risk Engine
Signals from all detection layers are combined by the risk engine using ten weighted factors. Risk scores range strictly from 0 to 100 and map directly to four enforcement tiers based on project policy thresholds.
| Risk Factor | Weight | Evaluation Focus |
|---|---|---|
| 1. Instruction Override | 20% | Priority subversion and directive override signatures. |
| 2. System Prompt Extraction | 15% | Attempts to leak confidential initial system instructions. |
| 3. Role Manipulation | 15% | DAN modes, persona evasion, and ethical dilemma jailbreaks. |
| 4. Obfuscation & Ciphers | 10% | Base64, Hex, Homoglyphs, and leetspeak payload masking. |
| 5. Semantic Proximity | 10% | Vector distance from known OWASP LLM01 injection clusters. |
| 6. Context Delimiters | 8% | Forged ChatML (<|im_start|>) and XML boundary delimiters. |
| 7. Tool Manipulation | 8% | Unauthorized function calling, shell, and bash execution. |
| 8. Sensitive Requests | 6% | Credential, token, database connection string requests. |
| 9. Data Exfiltration | 5% | Out-of-band Markdown trackers and image payload telemetry. |
| 10. Behavioral Anomalies | 3% | Deceptive framing, hypothetical evasion, and refusal avoidance. |
Configured Policy Enforcement Levels
Clean prompt. Forwarded directly to downstream LLM provider.
Quarantined and wrapped in defensive system boundary delimiters.
Severe injection threat. Isolated and kept away from production model.
Execution stopped immediately at edge. Zero tokens sent to downstream model.
Multi-Provider Abstraction
PromptGuard abstracts downstream model providers behind a unified asynchronous gateway interface. The following providers are confirmed in the project source code:
OpenAI
Provider: "openai"
Supports GPT-4o, GPT-4 Turbo, GPT-3.5 with pre-execution token cutoff and API key masking.
Google Gemini
Provider: "gemini"
Integrates Gemini 1.5 Pro and Gemini 1.5 Flash via official Google Generative AI Python SDK.
Anthropic Claude
Provider: "anthropic"
Compatible with Claude 3.5 Sonnet and Haiku with custom XML boundary isolation headers.
Local Simulator
Zero KeyProvider: "local"
Deterministic local sandbox simulating unshielded vs shielded LLM responses without external API keys.
Ready to test these features locally?
Download the Windows executable or run from source in under 2 minutes.