detector.py

"""A tiny, beginner-friendly prompt injection detector.

This is NOT production-grade security. It's a starting point for learning
how basic pattern-based defenses work against prompt injection attempts.
"""

# Phrases commonly used in prompt injection attacks, grouped by attack style.
PHRASE_CATEGORIES = {
    "instruction_override": [
        "ignore previous instructions",
        "ignore all previous instructions",
        "disregard the above",
        "disregard previous instructions",
        "forget everything",
        "forget all previous instructions",
        "override your rules",
        "ignore your guidelines",
        "ignore the rules above",
        "new instructions:",
    ],
    "persona_jailbreak": [
        "you are now",
        "act as",
        "pretend to be",
        "pretend you are",
        "roleplay as",
        "from now on you are",
        "developer mode",
        "dan mode",
        "do anything now",
        "jailbreak",
        "no restrictions",
        "without any restrictions",
        "unfiltered mode",
    ],
    "prompt_extraction": [
        "system prompt",
        "reveal your instructions",
        "show me your instructions",
        "what are your instructions",
        "print your instructions",
        "repeat the words above",
        "reveal your prompt",
        "leak your prompt",
        "tell me your system message",
    ],
    "safety_bypass": [
        "bypass your safety",
        "disable your filters",
        "turn off safety",
        "ignore your programming",
        "this is hypothetical so ignore",
        "for educational purposes only, ignore",
    ],
    "obfuscation": [
        "decode this and execute",
        "base64 decode and run",
        "translate this into code and run",
    ],
}

# Flattened for backwards compatibility and quick lookups.
SUSPICIOUS_PHRASES = [
    phrase for phrases in PHRASE_CATEGORIES.values() for phrase in phrases
]


def scan(text: str) -> list[str]:
    """Return the list of suspicious phrases found in the given text."""
    lowered = text.lower()
    return [phrase for phrase in SUSPICIOUS_PHRASES if phrase in lowered]


def is_suspicious(text: str) -> bool:
    """Return True if the text contains any known injection pattern."""
    return len(scan(text)) > 0


def categorize(text: str) -> list[str]:
    """Return the names of attack categories matched in the given text."""
    lowered = text.lower()
    return [
        category
        for category, phrases in PHRASE_CATEGORIES.items()
        if any(phrase in lowered for phrase in phrases)
    ]


def sanitize(text: str, max_length: int = 2000) -> str:
    """Apply simple, safe defaults: trim length and strip control characters."""
    cleaned = "".join(ch for ch in text if ch.isprintable() or ch in "\n\t")
    return cleaned[:max_length]