Skip to content

promptbadger 0.2.0

Choose a tag to compare

View all tags
@cyberchup cyberchup released this 07 Oct 14:53
· 9 commits to main since this release
v0.2.0
5fabc93

First tagged release since v0.1.0. It adds obfuscation handling, indirect-injection scanning, output checks and four more direct-injection rules (18 rules in total).

pip install "promptbadger @ git+https://github.com/cyberchup/promptbadger.git@v0.2.0"

What's new

Obfuscation handling (decode-and-rescan). Each input is also scanned in decoded views: leetspeak, letter spacing, base64 / hex / binary, escape sequences and HTML entities, Cyrillic look-alike letters, Unicode tag characters, rot13 and reversed text. A rule fires once, in the first view that matches. A match in a decoded view adds ATLAS AML.T0068 and records view and decoded on the detection, and match spans point into the raw input. New rule PI-018: an encoded payload paired with a decode-and-obey instruction.

Indirect injection: scan_context(). Scans retrieved documents, emails, web pages and tool output. Rules now carry a scope. PI-015 (content addresses the AI reading it), PI-016 (content tells the model what to do with the user) and PI-017 (instructions hidden in markup) run on context only, because talking to the AI is normal in a user's own prompt but a red flag inside an email.

Output checks: scan_output().

  • PB-CANARY: plant a token from make_canary() in the system prompt and flag any model reply that contains it, even if the token is spaced out or de-hyphenated.
  • PB-EXFIL-IMAGE / PB-EXFIL-LINK: data carried in rendered image or link URLs to untrusted hosts (EchoLeak style). Tune with --trusted-domain.
  • PB-SMUGGLE: Unicode tag characters (ASCII smuggling). This also runs on prompts and context.

More direct-injection coverage. PI-012 context reset, PI-013 RAG grounding override, PI-014 secret and credential requests (medium, so it reaches suspicious on its own), and wider DE / ES / FR / RU / BCS wording in existing rules.

SIEM. Events gain Direction and optional User and SessionId fields. New CLI flags: --direction, --canary, --trusted-domain, --user, --session-id. Sentinel content adds context_injection.kql and output_leak.kql (canary leaks, URL exfiltration), and the hunting queries gain a per-session one hunting query that combines per-turn scores with the scanner's noisy-OR to surface slow-burn conversations. All queries use column_ifexists(), so tables built from v0.1 events still work.

Breaking change

OWASP tags move to the LLM Top 10 2026 edition. LLM01:2025 becomes LLM01:2026, and system prompt leakage moves from LLM07:2025 to LLM08:2026 (Hidden Context Exposure; LLM07 is now Misinformation). Update any SIEM filters or workbooks that key on OWASP IDs.

Measured

Held-out test splits, alerting on suspicious or worse. None were used to tune rules (one caveat below).

Dataset Recall v0.1.0 → v0.2.0 Precision FPR
deepset/prompt-injections 0.200 → 0.250 1.000 0.000
xTRam1/safe-guard-prompt-injection 0.260 → 0.282* 1.000 0.000
jackhhao/jailbreak-classification 0.655 → 0.655 1.000 0.000

*The PI-014 part of this gain (0.263 → 0.282) is optimistic: similar safe-guard misses had been read before the rule was written.

  • Indirect injection, LLMail-Inject phase 2 (21,007 attacks): recall 0.149 with input rules only → 0.165 with scan_context and v0.2 views. 0 false positives on 203 LLMail benign emails, 16,545 Enron emails and 4,467 Wikipedia passages.
  • Obfuscation: 95–100% of held-out injections that are caught in plain form are still caught after each supported transform, against 0–2% with views off (tag characters excepted: PB-SMUGGLE flags those either way). The decoders were built against this table, so it is a development measurement of technique coverage, not recall. Caesar shifts other than rot13 and words split into chunks are not decoded (0%).
  • False positives: 0 suspicious-or-worse on 52,002 Alpaca prompts.
  • Cost: views add about 0.1 ms to a short prompt and about 50% to a long email (3.6 → 5.4 ms).

Limits

The regex layer is a high-precision, low-recall tier. Paraphrased attacks, long custom-persona jailbreaks and unsupported encodings get through; see Known gaps. Next up is v0.3: an ML classifier layer combined with the rule scores.

Full reports: eval/results/

Full Changelog: v0.1.0...v0.2.0

Assets 2
Loading