[DRAFT/EXPERIMENTAL] feat: prompt-injection detector (rf-bmo, do not merge)#60
Draft
Rome-1 wants to merge 1 commit into
Draft
[DRAFT/EXPERIMENTAL] feat: prompt-injection detector (rf-bmo, do not merge)#60Rome-1 wants to merge 1 commit into
Rome-1 wants to merge 1 commit into
Conversation
Pattern-based PromptInjectionDetector with parity in Node and Python.
Hidden behind experimental flags pending APPROVE bead rf-i17 — do not
merge to main.
Surfaces:
- rafter scan injection <path> (hidden subcommand) for spot checks
- rafter hook posttool --experimental-prompt-injection flags injection
markers in tool responses to stderr (does NOT modify the response)
Detector covers role-override phrases, tool/exfil patterns, hidden
Unicode (tag chars / bidi / zero-width-in-word), HTML/markdown comment
imperatives, and base64-decoded payload re-scan. Returns score 0-100
and verdict ∈ {clean,suspicious,likely_injection}.
Documented threat model, prior-art survey, FP/FN tradeoffs, and known
bypasses in docs/research/prompt-injection-detector.md. Tests include
positive corpus, clean-baseline guards, and explicit known-bypass
fixtures so future improvements have a target.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This was referenced May 17, 2026
Rome-1
added a commit
that referenced
this pull request
May 18, 2026
…n parity, hidden behind --experimental flag (#118) Pattern-based PromptInjectionDetector with parity in Node and Python. Hidden behind experimental flags pending APPROVE bead rf-i17 — do not merge to main. Consolidated from drafts PR #60 (feat/prompt-injection-detector) and PR #82 (polecat/granite-mokqoiob); both PRs point at the same head commit, so baseline #82 was used and #60 contained no additional content. Surfaces: - rafter scan injection <path> (hidden subcommand) for spot checks - rafter hook posttool --experimental-prompt-injection flags injection markers in tool responses to stderr (does NOT modify the response) Detector categories: role-override (jailbreak phrases, "ignore previous instructions", DAN, role-confusion), tool/exfil (remote-pipe-shell, "send api keys to ...", "delete all files"), hidden Unicode (tag chars U+E0000–U+E007F, bidi override, zero-width-in-word), HTML/markdown comment imperatives, and base64-decoded payload re-scan (indirect/RAG-fetch injection). Output: structured finding with category (pattern name), severity (low|medium|high|critical → confidence), evidence and remediation hint; aggregate score 0-100 and verdict ∈ {clean,suspicious,likely_injection}. Default behavior: warn only (stderr). Block behavior requires explicit opt-in via .rafter.yml; no default surface changes for non-opted users. Documented threat model, prior-art survey, FP/FN tradeoffs, and known bypasses in docs/research/prompt-injection-detector.md. Tests include positive corpus, clean-baseline guards, and explicit known-bypass fixtures so future improvements have a target. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EXPERIMENTAL — pattern-based prompt-injection detector. Surfaced behind
hidden flags only.
PromptInjectionDetectorin Node + Python with parityrafter scan injection <path>rafter hook posttool --experimental-prompt-injection(flags markers in tool responses to stderr; does NOT modify response)
docs/research/prompt-injection-detector.mddocumented known-bypass fixtures)
Hard rule from bead rf-bmo
Do NOT merge to main until Rome explicitly approves (parallel APPROVE
bead
rf-i17). This is exploratory/research; we may abandon or rewrite.Threat model
Indirect prompt injection via tool responses (WebFetch, Read on
attacker-controlled docs, MCP web/email/issue surfaces). See research
doc §2 for the matrix.
Detection categories
role_override— "ignore previous instructions",<system>mimicry, DAN modetool_exfil— remote-pipe-shell, "send api keys to ...", "delete all files"hidden_unicode— tag chars (U+E0000–E007F), bidi override, zero-width-in-wordhtml_comment— imperative inside HTML/markdown commentsencoded_payload— base64 chunks decoded and re-scannedKnown limitations (loud)
Pattern-based, English-only, trivially bypassable by paraphrase.
Documented in research doc §6 and §9. Pair with a model-based judge
for production.
Test plan
npx vitest run tests/prompt-injection.test.tspytest tests/test_prompt_injection.pypytest tests/test_hook*.py: 76 passedrafter scan injection, posttool--experimental-prompt-injectionrafter secretsclean on all new filesrafter run --mode plus(no API key in this env)Open questions for APPROVE bead rf-i17
See research doc §10. tldr: ship a model-judge layer? add
blockmode?allowlist support? audit-log shape?
Generated with Claude Code