Live at
- PyPI: https://pypi.org/project/prompt-shield-ai/0.4.0/
pip install --upgrade prompt-shield-ai
- npm (n8n community node): https://www.npmjs.com/package/n8n-nodes-prompt-shield
npm install n8n-nodes-prompt-shield@0.2.0
- Paper (Zenodo DOI): https://doi.org/10.5281/zenodo.19644135
- PDF in-repo:
docs/papers/cross-domain-techniques.pdf
Headline
+34.5 percentage-point F1 improvement on deepset/prompt-injections from a single new detector (d028 Smith-Waterman alignment), with zero added false positives. The novel technique ablation across five public datasets is reproducible with one command: python docs/papers/evaluation/run_public_datasets.py.
Two of seven novel cross-domain techniques now live
d028_sequence_alignment— Smith-Waterman local alignment with a 15-group semantic substitution matrix (analogous to BLOSUM in bioinformatics). Catches paraphrased, filler-padded, and synonym-swapped attacks that verbatim regex misses. ~180 curated attack sequences, pure Python, <5 ms per scan, no new dependencies.prompt_shield.fatigue— EWMA near-miss tracker with per-source threshold hardening. Models adversarial probing campaigns as cumulative-stress fatigue (materials-science S-N curves). Opt-in viafatigue.enabled: true; zero overhead when disabled. Thread-safe under parallel detector execution.
Five more techniques remain in development: stylometric discontinuity, honeypot tools, prediction market ensemble, perplexity spectral analysis, runtime taint tracking.
Empirical evaluation across five public datasets
| Dataset | Samples | d028 off F1 | d028 on F1 | Δ | Verdict |
|---|---|---|---|---|---|
| deepset/prompt-injections | 116 | 0.033 | 0.378 | +34.5 pp | Strong win |
| leolee99/NotInject | 339 benign | FPR 0.9% | FPR 3.8% | +2.95 pp FPR | Regression (tune) |
| microsoft/llmail-inject-challenge | 1 000 | 0.989 | 0.990 | +0.001 | Saturated |
| ai-safety-institute/AgentHarm | 352 | 0.319 | 0.319 | 0.0 | Orthogonal |
| ethz-spylab/agentdojo | 132 | 0.540 | 0.537 | −0.003 | Neutral |
Full narrative analysis and per-dataset honest framing in docs/papers/evaluation/ANALYSIS.md. Fatigue is validated end-to-end via a probing-campaign integration test — see fatigue_probing_campaign.md.
Also in this release
- Zenodo DOI + CITATION.cff for proper academic attribution.
- Regression harness
tests/regression_check.py+ locked v0.3.3 baseline that gates every future change. - CI green across Python 3.10–3.13 for the first time since 2026-03-29 (ruff/mypy debt cleared).
- Test suite grew 765 → 829 (+35 d028 tests, +29 fatigue tests).
Full changelog: CHANGELOG.md.
How to cite
Munirathinam, T. (2026). Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection (v1.0.0). Zenodo. https://doi.org/10.5281/zenodo.19644135