InjectionGuard — Multilingual Prompt Injection Defence
Creator · Security Research
The problem
Indirect prompt injection: instructions hidden inside emails, documents and web pages that an LLM assistant reads as commands rather than as data. Nearly every available guardrail is English-only, so Arabic payloads pass straight through.
Constraints
- Arabic and English coverage was the requirement, not an extension
- Detection has to run before the model call, cheaply enough not to add meaningful latency
- A guardrail that cannot explain a block is not usable in review
Key decisions
three independent layers — sanitiser, heuristics, spotlighting chosen over a single trained classifier
the layers fail differently. Invisible Unicode, adversarial phrasing and data/instruction confusion are separate problems; one model collapses them into a single opaque score.
deterministic regex heuristics chosen over an LLM-as-judge
the rules are auditable, free to run, and cannot themselves be injected — a judge model is exactly as vulnerable as the model it is protecting.
InjectionGuard is a security research tool that detects and blocks indirect prompt injection attacks against LLM-powered applications — a threat class where hidden instructions embedded in emails or documents hijack an AI assistant's behaviour.
Built as a 3-layer guardrail: (1) a Unicode/HTML sanitiser that strips invisible characters and hidden tags, (2) a heuristic pattern engine with 30+ regex rules covering both English and Arabic injection phrases, and (3) a spotlighting layer that wraps untrusted content so the model treats it as data, not commands.
Key result: 95% detection accuracy with 100% precision and zero false positives across a 20-payload benchmark spanning English and Arabic. The bilingual coverage addresses a real gap — most existing guardrails are English-only.
Grounded in research from Greshake et al. (ACM CCS 2023) and Microsoft's Spotlighting work (2024).
Outcome
- 95% detection accuracy and 100% precision across a 20-payload English/Arabic benchmark
Technologies
Want something like this for your business?
Let's talk