Prompt Injection Detection

Prompt injection is an attack where a user crafts input designed to make the model ignore your system prompt and follow attacker-supplied instructions instead. OpenDunes screens incoming requests against a curated pattern set derived from the OWASP LLM Prompt Injection Prevention Cheat Sheet, evaluated locally at the gateway — detection is free and adds minimal latency.

Enabling#

Detection is on by default in flag mode — matches are recorded to your audit trail but nothing is blocked or rewritten until you opt into redact or block. Adjust it in Settings → Guardrails. (The dashboard persists it through the session-authenticated PUT /api/user/guardrails — a dashboard endpoint, not part of the key-authenticated /v1 API.)

When a pattern matches, the configured action is taken:

• Flag — the request passes through unmodified; the detection is recorded in the audit trail. Use this to measure match rates on real traffic before enforcing.
• Redact — matched spans are replaced with [PROMPT_INJECTION] and the sanitized request is forwarded to the model.
• Block — the request is rejected with a 403 before it reaches a model. No tokens are billed.

Blocked request response#

{
  "error": "prompt_injection_detected",
  "message": "Request blocked by the prompt-injection guardrail."
}

HTTP status 403. The model is never called.

Detection patterns#

All user-supplied message content is checked against these case-insensitive patterns, grouped by technique:

Evasion detection#

Beyond the regex patterns, three evasion detectors run on every scan:

• Typoglycemia — scrambled-middle keyword variants (ignroe for ignore) of the target words ignore, bypass, override, reveal, delete, system, prompt, instructions.
• Encoded payloads — Base64 and hex runs (including space-separated hex pairs) are decoded and scanned for injection keywords.
• Character spacing — text like i g n o r e p r e v i o u s is collapsed and re-scanned against all patterns.

Limitations#

• Regex-based detection is not exhaustive. Sophisticated or novel injection techniques may not be caught.
• Flag mode does not enforce — flagged requests are forwarded exactly as submitted; the detection is recorded for auditing only.
• False positives are possible. Legitimate prompts about security testing may match these patterns. Test in flag mode first, and exempt known-safe phrases with the Allowlist.

Audit trail#

Every detection is recorded with the matched detector names and the action taken. See Guardrails for details.