promptbadger 0.3.0

Adds an optional ML classifier layer, PB-ML, alongside the rule pack. The rules are unchanged from 0.2.0, and so are their metrics.

pip install "promptbadger @ git+https://github.com/cyberchup/promptbadger.git@v0.3.0"

What's new

Classifier layer: PB-ML (opt-in). A TF-IDF + logistic regression model that scores the prompt as a whole and adds one detection to the same noisy-OR score as the rules. Its confidence is the model's probability, and the detection lists the terms that drove it. Enable it with Scanner(classifier=True) or promptbadger scan --ml. It is medium from p ≥ 0.572 (suspicious on its own) and high from p ≥ 0.834 (malicious on its own), and adds nothing below that.

• Inference is pure Python from a 443 KiB bundled model: no new runtime dependency. scikit-learn is only needed to retrain (.[train]).
• About 160 ms to load, about 3 ms for a 29,000-character prompt. It runs on scan() only. Documents and email (scan_context) would need their own measurement.
• run_eval.py gains --ml and --ml-only. eval/train_classifier.py and eval/classifier_eval.py reproduce the model and its held-out report.

Demo. A checkbox adds the classifier, plus two examples: a reworded override only the classifier catches, and a benign story prompt it flags (a known false positive).

Measured

Built to a protocol written before training: trained on train splits only, with any text that also appears in an evaluation set dropped. Thresholds were set from a false-positive budget on training data, then each held-out set was scored once with nothing changed afterwards.

Recall at suspicious or worse:

Dataset	Rules	Rules + classifier
reshabhs/SPML_Chatbot_Prompt_Injection (independent)	0.182	0.403
Lakera/gandalf_ignore_instructions (independent)	0.517	0.741

False positives are the price. On 52,002 benign Alpaca instructions the rules flag nothing and the classifier flags 162 (0.31%), 13 of them at malicious. Most are creative-writing requests and ordinary security vocabulary. On SPML it adds 1 false positive in 3,470 benign prompts. That profile suits a review queue better than a block decision, which is why the classifier is off by default.

The same-source test splits (deepset, safe-guard, jailbreak-classification) score much higher with the classifier, but it trained on their train splits, so those numbers are optimistic. The independent sets above are the generalisation numbers. Full tables: Classifier (v0.3).

All rule reports were regenerated at 0.3.0 and reproduce the 0.2.0 numbers exactly.

Limits

A bag-of-words model learns each dataset's vocabulary. Paraphrased attacks with no telltale words still get through: the demo's "known miss" example scores 0.14. Next up is a stronger model or an LLM-as-judge layer for inputs the fast layers mark suspicious, each measured under its own protocol.

Full reports: eval/results/

Full Changelog: v0.2.0...v0.3.0