fix(ENG-12702): strip boundary markers from input before classification

[hiskudin]

Summary

Defender wraps sanitized outputs with [UD-<id>]...[/UD-<id>] markers. When those outputs are fed back as input — nested tool calls, cached responses, multi-hop agent traces, or attacker-spoofed tags — the tokenizer counts the tag tokens as part of the classified sentence and the v4 ONNX model treats the structure as injection-adjacent.

Measured impact

Benign Jira board-list payload pre-wrapped by upstream defender:

Input	Tier 2 score	Risk
With UD tags in values	0.992	high ✗ blocked
UD tags manually stripped	0.008	medium ✓ allowed
With this fix (tags auto-stripped at entry)	0.008	medium ✓ allowed

Self-flagging feedback loop closed — the classifier no longer sees its own output format as suspicious.

Implementation

The stripBoundaryPatterns utility already existed at src/utils/boundary.ts:68 with this exact use case in its docstring ("Boundary tags like [UD-xyz]...[/UD-xyz] corrupt per-sentence model scores because the tokenizer treats the tag text as part of the sentence") but had zero callers. This PR wires it into the three Tier 2 entry points — classify, classifyByChunks, prepareChunks — before the length check and tokenization.

Also strips XML-style <user-data-*>...</user-data-*> boundaries for completeness (same utility handles both).

Secondary benefit: spoofing defense

Closes the attack surface PR #49 was targeting. An attacker injecting [UD-*] tags into tool-result content can no longer use them to mask injection payloads as "already-trusted" boundary-wrapped data — defender strips everything that looks like a boundary marker before classifying.

Semantics

Scores on payloads containing boundary markers now match scores on the same payloads with markers manually stripped. Added a spec that asserts bit-identical scoring between classify(wrapped) and classify(bare).

Test plan

• New spec: identical scores for wrapped vs bare input
• 201/202 existing tests pass (1 pre-existing ONNX calibration flake, unrelated)
• End-to-end verified against test.json: 0.992 → 0.008
• Re-run Gmail fixture comparison to confirm no regression on real email payloads

---

Summary by cubic

Strip defender boundary markers from Tier 2 inputs before classification to stop false positives and boundary-tag spoofing. Addresses ENG-12702; wrapped and unwrapped texts now score the same (e.g., 0.992 → 0.008 on a benign Jira payload).

• Bug Fixes
  • Apply stripBoundaryPatterns in classify, classifyBySentence, classifyByChunks, and prepareChunks before tokenization/splitting.
  • Remove implicit .trim() from stripBoundaryPatterns to preserve whitespace semantics; no call sites changed.
  • Update spec to skip in CI and use toBeCloseTo for float tolerance; asserts matching scores for wrapped vs bare input.

^{Written for commit 6f5b34c. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Auto-approved: This PR fixes false positives in the Tier 2 classifier by correctly stripping internal boundary markers before processing. The logic uses an existing utility and includes verification tests.}

[Copilot]

Pull request overview

This PR prevents Tier 2 prompt-injection scoring from being distorted by Defender boundary wrappers (e.g., [UD-*]...[/UD-*] and <user-data-*>...</user-data-*>) by stripping those markers from inputs before length checks and tokenization, closing a self-feedback false-positive loop and reducing spoofing surface.

Changes:

• Wire stripBoundaryPatterns() into Tier2Classifier entry points (classify, classifyByChunks, prepareChunks) prior to sizing/tokenization.
• Add a spec asserting wrapped vs unwrapped inputs produce identical Tier 2 scores after stripping.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
src/classifiers/tier2-classifier.ts	Strips boundary markers at Tier 2 entry points to avoid tokenizer/model score distortion.
specs/tier2-classifier.spec.ts	Adds regression test for identical scoring between boundary-wrapped and bare input.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.