AI & SecurityMay 2026

InjectionGuard — Multilingual Prompt Injection Defence

Creator · Security Research

The problem

Indirect prompt injection: instructions hidden inside emails, documents and web pages that an LLM assistant reads as commands rather than as data. Nearly every available guardrail is English-only, so Arabic payloads pass straight through.

Constraints

Arabic and English coverage was the requirement, not an extension
Detection has to run before the model call, cheaply enough not to add meaningful latency
A guardrail that cannot explain a block is not usable in review

Key decisions

three independent layers — sanitiser, heuristics, spotlighting chosen over a single trained classifier

the layers fail differently. Invisible Unicode, adversarial phrasing and data/instruction confusion are separate problems; one model collapses them into a single opaque score.

deterministic regex heuristics chosen over an LLM-as-judge

the rules are auditable, free to run, and cannot themselves be injected — a judge model is exactly as vulnerable as the model it is protecting.

System flow

A simplified view of how the main parts work together.

Untrusted content
Emails, documents, and web content enter as data that may contain hidden instructions.
Sanitizer + bilingual heuristics
Invisible markup is removed and English/Arabic injection patterns are checked deterministically.
Spotlighted model input
The cleaned content is wrapped so the downstream model can distinguish data from instructions.

InjectionGuard is a security research prototype that detects and blocks indirect prompt injection attacks against LLM-powered applications — a threat class where hidden instructions embedded in emails or documents hijack an AI assistant's behaviour.

Built as a 3-layer guardrail: (1) a Unicode/HTML sanitiser that strips invisible characters and hidden tags, (2) a heuristic pattern engine with 30+ regex rules covering both English and Arabic injection phrases, and (3) a spotlighting layer that wraps untrusted content so the model treats it as data, not commands.

In an initial 20-payload English/Arabic prototype benchmark, the guardrail detected 19 payloads and produced no false positives. The corpus is too small to establish production accuracy, so the result is presented as an early benchmark rather than a general performance guarantee.

Grounded in research from Greshake et al. (ACM CCS 2023) and Microsoft's Spotlighting work (2024).