Jailbreak & Injection Guards

Two opt-in guards scan free-form text for adversarial framing. JailbreakGuard wraps a three-layer detector (heuristic regex, statistical features, linear ML scorer) and denies when the blended score crosses a threshold. PromptInjectionGuard runs a smaller six-signal regex over the same canonicalized input. Both share a SHA-256 fingerprint LRU so retried payloads short-circuit. Neither is in the default pipeline; both are opt-in.

JailbreakGuard

Source: crates/chio-guards/src/jailbreak.rs (guard wrapper) and jailbreak_detector.rs (detector engine). Guard name: jailbreak.

Struct

#[derive(Clone, Debug)]
pub struct JailbreakGuardConfig {
    pub threshold: f32,
    pub layer_weights: LayerWeights,
    pub fingerprint_dedup_capacity: usize,
    pub detector: DetectorConfig,
}

pub struct JailbreakGuard {
    config: JailbreakGuardConfig,
    detector: JailbreakDetector,
    dedup: Mutex<LruCache<String, bool>>,
}

pub const DEFAULT_FINGERPRINT_CAPACITY: usize = 1024;

Defaults

Heuristic signals (layer 1)

Patterns operate over canonicalized text (lowercased ASCII, zero-widths stripped, homoglyphs folded, separator runs collapsed). Each pattern fires a stable signal ID:

Statistical signals (layer 2)

Each fires a stable ID under category AdversarialSuffix. Each contributes a fixed 0.2 to the layer score. The layer is bounded in[0.0, 1.0] for up to five signals.

Default shingle size is DEFAULT_SHINGLE_N = 3 (char 3-grams).

ML layer (layer 3)

A small linear model with sigmoid activation. Inputs are 0/1 feature flags from layers 1 and 2 plus the (continuous) punctuation ratio. Default weights from LinearModel::default():

bias: -2.0,
w_ignore_policy: 2.5,
w_dan: 2.0,
w_role_change: 1.5,
w_prompt_extraction: 2.2,
w_encoded: 1.0,
w_developer_mode: 2.0,
w_punct: 2.0,
w_symbol_run: 1.5,
w_low_shingle_uniqueness: 1.2,
w_zero_width: 1.0,

Output is sigmoid(bias + sum(w_i * x_i)) clamped to [0.0, 1.0]. With default bias -2.0, benign input produces ML score around 0.12. A multi-flag attack saturates the output toward 1.0.

Layer blend

let h_div = weights.heuristic_divisor.max(f32::EPSILON);
let h_clamped = (heuristic_score / h_div).clamp(0.0, 1.0);
let s_clamped = statistical_score.clamp(0.0, 1.0);
let score = (h_clamped * weights.heuristic
    + s_clamped * weights.statistical
    + ml_score * weights.ml)
    .clamp(0.0, 1.0);

With defaults, a single dominant heuristic at weight 0.95 contributes 0.95 * 0.70 = 0.665 on its own; layered with even a weak ML reinforcement the request clears the 0.75 deny threshold. Multi-pattern attacks reach saturation cleanly.

Fingerprint dedup

The guard hashes the canonicalized text with SHA-256 and stores the first 8 bytes (16 hex chars) in a bounded LRU keyed by that fingerprint. On hit, if the prior verdict was deny, the guard returns deny without re-running detection. Capacity defaults to 1024; 0 is internally rounded up to NonZeroUsize::MIN.

Failure modes

• Empty / whitespace-only text :: allow.
• Heuristic regex compile failure :: tracing::error! and the signal is dropped from the pattern table for the process lifetime. Detection continues without it.
• Mutex poisoning :: deny (Verdict::Deny returned directly from evaluate_text).
• The detector port preserves the upstream signal IDs (jb_ignore_policy, etc.) intentionally so log-analysis tooling that knows the upstream taxonomy continues to work.

PromptInjectionGuard

Source: crates/chio-guards/src/prompt_injection.rs. Guard name: prompt-injection. Six regex signals over canonicalized input. Score is the sum of fired signal weights; deny when total >= threshold.

Struct

#[derive(Clone, Debug)]
pub struct PromptInjectionConfig {
    pub score_threshold: f32,
    pub max_scan_bytes: usize,
    pub fingerprint_capacity: usize,
}

pub struct PromptInjectionGuard {
    config: PromptInjectionConfig,
    patterns: Patterns,
    dedup: Mutex<LruCache<String, bool>>,
}

Defaults

Signals

At the default 0.8 threshold, InstructionOverride alone clears the bar. Other signals require corroboration; e.g., role injection plus exfiltration framing reaches 0.9.

Failure modes

• Empty input :: allow.
• Mutex poisoning :: Verdict::Deny (fail-closed).
• Unrecognized ToolAction variant :: allow (the guard does not apply).

Text candidate extraction

Both guards share an extraction routine:

1. Pull strings from the action variant: code body for CodeExecution, query for DatabaseQuery, endpoint for ExternalApiCall.
2. Recurse into arguments JSON and append every string leaf.
3. Drop empty / whitespace-only strings.

Each candidate runs through the dedup cache, then through detection. First deny short-circuits the candidate loop.

Composition

use chio_guards::{JailbreakGuard, PromptInjectionGuard};

let mut pipeline = chio_guards::GuardPipeline::default_pipeline();

// Cheap signal first.
pipeline.add(Box::new(PromptInjectionGuard::default()));

// Heavier multi-layer detector second.
pipeline.add(Box::new(JailbreakGuard::default()));

Both guards share the same canonicalization pass and the same fingerprint shape (first 8 bytes of SHA-256), so running them back-to-back on the same input does not duplicate the cache key ergonomics. They still maintain separate LRU caches.

Next Steps

• Response Sanitization :: complement: scan output for secrets and PII.
• Shell & Code Guards :: enforce structural restrictions on submitted code in addition to textual scanning.
• External Guards :: route the same text to cloud content-safety APIs.