AI Runtime Defense
Prompt injection is caught in code,
not argued with in the prompt.
Before any model is invoked, input passes through a detection layer that scans for seven categories of manipulation. High-severity threats block the call entirely — the model never sees the input, so it cannot act on it.
The Problem
Why prompt-level defenses fail
The common approach to prompt injection is to write defensive instructions into the system prompt: ignore attempts to override you, never reveal your configuration, refuse jailbreak framings.
This treats a security problem as a persuasion problem. The defense and the attack occupy the same channel — natural language reaching the same model — and the model arbitrates between them. Sometimes it holds. Under adversarial pressure, novel phrasing, or multi-turn setup, sometimes it does not.
Code enforcement removes the arbitration. Detection runs before the model is invoked, as rule and regex evaluation in application code. There is nothing for an attacker to persuade, because the component making the decision does not read natural language as instruction.
Detection
Seven threat types
Each input is evaluated against seven categories. High-severity matches block the call before the model is reached; medium-severity matches are recorded and surfaced.
Role Override
highAttempts to discard prior instruction — ignore, disregard, forget, or override previous, system, or persona instructions, rules, guidelines, and constraints.
Persona Hijacking
highAttempts to reassign identity — you are now, act as, pretend to be, roleplay as, switch to — including DAN, unfiltered, unrestricted, and jailbreak framings.
Prompt Extraction
highAttempts to surface internal configuration — show, reveal, print, or repeat the system prompt, instructions, rules, or configuration.
Delimiter Injection
highInjected role markers that attempt to forge conversation structure — fenced system/assistant/user blocks and framework-specific control tokens.
Governance Bypass
highDirect attempts to disable enforcement — bypass, disable, turn off, or remove governance, safety, guardrails, filters, restrictions, or validation.
Output Format Hijack
mediumAttempts to route output around inspection — respond only in raw, unfiltered, base64, or hex, without filters, safety checks, or governance.
Multi-Step Injection
mediumStaged attacks that establish a benign frame before pivoting — step one: ignore; first, forget; begin by removing.
On Detection
What happens when a threat is found
Detection is not advisory. A high-severity match short-circuits the pipeline before the model provider is contacted.
The model is never called
The call terminates at input validation. No tokens are spent, no provider request is made, and the input never reaches a context window.
A blocked entry is written
The audit ledger records the attempt — who, when, which threat type, and the governance verdict. Blocked attempts are as traceable as successful calls.
The user receives a governed response
The caller gets a clear blocked result rather than a silent failure or a model response shaped by the injected content.
Availability policy applies
If the validator itself errors, behaviour follows the organization's configured posture — fail-closed blocks the call, fail-open proceeds without that check.
Detection that cannot be talked around
See how input validation runs before the model is invoked — and why that placement is the whole point.