Prompt Injection Detection Rules

instruction-override.previous-instructions

Instruction override · HIGH

Detects language asking an AI to ignore or discard earlier instructions.

Quoted security material can produce a false positive. Treat the passage as untrusted data.

role-hijack.identity-switch

Role hijacking · MEDIUM

Detects suspicious identity or authority reassignment.

Legitimate role-play can look similar; verify the context before acting.

prompt-exfiltration.system-prompt

Prompt extraction · HIGH

Detects requests to reveal hidden system prompts or internal instructions.

Do not disclose trusted control instructions.

data-exfiltration.sensitive-outbound-transfer

Data exfiltration · HIGH

Detects sensitive-data targets combined with an external transfer request.

Confirm destination and authorization independently.

delimiter-abuse.fake-control-marker

Delimiter abuse · MEDIUM

Detects fake system/developer control markers followed by instructions.

Source code and documentation often contain similar delimiters.

base64.encoded-blob

Encoding and obfuscation

Detects opaque Base64-like blocks; encoded data is not inherently malicious.

html.display-none

Hidden content

Detects inline HTML that visually hides text from a reader.

Legitimate accessibility or layout examples can contain hidden elements.

Unicode control signals

Invisible formatting signals are documented individually so findings remain traceable. These are review signals, not proof of malicious intent.

unicode.soft-hyphen, unicode.zero-width-space, unicode.zero-width-non-joiner, unicode.zero-width-joiner, unicode.word-joiner, and unicode.interior-byte-order-mark identify invisible characters embedded in or adjacent to ASCII words.

unicode.bidi-embedding, unicode.bidi-formatting-end, unicode.bidi-override, unicode.bidi-isolate, and unicode.bidi-isolate-end identify bidirectional controls that can change visual text order. Multilingual text can legitimately use some of these controls; inspect the source context.