# [RFC] TealTiger v1.3 — Detection & Guardrails (OWASP Gap Closure, ML Classifier, Drift)

[nagasatish007]

[RFC] TealTiger v1.3 — Detection & Guardrails (OWASP Gap Closure, ML Classifier, Drift)

Status: OPEN FOR FEEDBACK
Covers: Requirements 9, 10
Target audience: Security engineers, red teamers, ML engineers, anyone building agent defenses

---

Summary

TealTiger v1.2 catches ~50% of prompt injection attacks via regex patterns. v1.3 targets 80%+ recall by adding an optional local ML classifier, closing 12 specific OWASP gaps, and introducing behavioral drift detection. All detection remains deterministic — no LLM in the governance path.

---

Proposed Capabilities

OWASP LLM 2026 Gap Closure (Req 9)

Unicode & encoding attacks:

• Strip/reject tag-block characters (U+E0000–U+E007F), variation selectors, zero-width characters
• Detect base64/hex/ROT13 encoded content in model outputs exceeding length thresholds

Memory attacks:

• Score memory entries for instruction-likeness (imperative verbs, conditional triggers, role references)
• Detect exfiltration patterns in stored memory (URLs with data-bearing params, markdown image links to non-allowlisted domains)
• Provenance tagging with transitive trust propagation (5 source classes: direct_user → untrusted_document)

Output attacks:

• Strip ANSI escape sequences, OSC 52, BEL, non-printable control characters
• Block markdown image exfiltration (image URLs, iframes, link-preview triggers to non-allowlisted domains)

Supply chain:

• MCP tool definition-drift monitoring (hash approved definitions, block on mismatch)
• Scan tool descriptions for instruction-injection patterns

Behavioral:

• Statistical baseline of agent response patterns per model/provider
• Alert on divergence beyond configurable threshold

Other:

• Reasoning-trace governance (PII/secret detection in chain-of-thought before log export)
• Multimodal input governance (OCR/transcription → apply text filters)
• Compositional adapter safety (approved combination allowlists)

TealClassifier — Local ML Detection (Req 10)

• ONNX model, local inference, no external API calls
• Four ensemble modes: regex_only, ml_only, ensemble_union, ensemble_intersection
• Inference under 20ms on CPU for inputs up to 512 tokens
• Deterministic outputs (no sampling, no temperature)
• Graceful fallback to regex-only if model fails to load
• Target: 80%+ recall, 85%+ precision on PINT benchmark
• Model updates without SDK version upgrade

---

Questions for the Community

1. Ensemble modes — Which mode would you default to? ensemble_union (catch more, higher false positives) or ensemble_intersection (fewer false positives, might miss some)? Is there a use case for switching modes per-environment?

2. Unicode attacks — Are you seeing Unicode-based prompt injection in the wild? Tag-block characters, variation selectors, zero-width joiners used as attack vectors?

3. MCP definition-drift — How often do your tool definitions change? Would blocking on hash mismatch be too aggressive, or is that the right default for production?

4. Memory provenance — The 5-tier trust model (direct_user → model_inference → tool_output_internal → tool_output_external → untrusted_document) with transitive propagation — does this match how you think about trust in your agent's memory? Too many tiers? Too few?

5. Behavioral drift — What baseline metrics would be most useful? Refusal rates? Response length? Topic distribution? Tool-call frequency? Something else?

6. Performance — Is 20ms inference acceptable for your latency budget? Would you trade accuracy for speed (faster model, lower recall)?

---

How to Give Feedback

• Comment below with thoughts, concerns, or use cases
• React with 👍 on capabilities you'd use
• React with 🤔 on capabilities that seem unclear
• React with 👎 on capabilities you think are wrong

---

Full Spec Reference

See Requirements 9 and 10 in the complete specification