Prompt Injection Detection Rules

instruction-override.previous-instructions

Instruction override · HIGH

Detects language asking an AI to ignore or discard earlier instructions.

Quoted security material can produce a false positive. Treat the passage as untrusted data.

role-hijack.identity-switch

Role hijacking · MEDIUM

Detects suspicious identity or authority reassignment.

Legitimate role-play can look similar; verify the context before acting.

prompt-exfiltration.system-prompt

Prompt extraction · HIGH

Detects requests to reveal hidden system prompts or internal instructions.

Do not disclose trusted control instructions.

data-exfiltration.sensitive-outbound-transfer

Data exfiltration · HIGH

Detects sensitive-data targets combined with an external transfer request.

Confirm destination and authorization independently.

delimiter-abuse.fake-control-marker

Delimiter abuse · MEDIUM

Detects fake system/developer control markers followed by instructions.

Source code and documentation often contain similar delimiters.

base64.encoded-blob

Encoding and obfuscation

Soft-decodes up to 100 bytes and flags the blob only when that preview matches a reviewed prompt-attack pattern.

html.display-none

Hidden content

Detects inline HTML that visually hides text from a reader.

Legitimate accessibility or layout examples can contain hidden elements.

html.visibility-hidden

Hidden content · MEDIUM

Detects inline HTML that keeps text in the document while making it invisible with visibility: hidden.

Accessibility patterns and layout examples can use this deliberately; inspect the surrounding source before treating it as suspicious.

html.zero-font-size

Hidden content · MEDIUM

Detects inline HTML that reduces enclosed text to zero-size glyphs with font-size: 0.

Some UI techniques use zero-sized elements for layout; confirm whether the hidden text contains instructions.

html.zero-opacity

Hidden content · MEDIUM

Detects inline HTML that makes text fully transparent with opacity: 0 while retaining it in the pasted source.

Transparent interface elements can be legitimate, so review the element and its context.

html.white-on-white

Hidden content · MEDIUM

Detects inline white text on a white background that can conceal content from visual review.

Theme demos and styling tests may intentionally use this combination; it is a review signal, not proof of an attack.

Unicode control signals

Invisible formatting signals are documented individually so findings remain traceable. These are review signals, not proof of malicious intent.

unicode.soft-hyphen, unicode.zero-width-space, unicode.zero-width-non-joiner, unicode.zero-width-joiner, unicode.word-joiner, and unicode.interior-byte-order-mark identify invisible characters embedded in or adjacent to ASCII words.

unicode.bidi-embedding, unicode.bidi-formatting-end, unicode.bidi-override, unicode.bidi-isolate, and unicode.bidi-isolate-end identify bidirectional controls that can change visual text order. Multilingual text can legitimately use some of these controls; inspect the source context.

unicode.soft-hyphen

Invisible Unicode · LOW

Flags a soft hyphen embedded in an ASCII word or identifier.

Soft hyphens are common formatting artifacts; inspect the normalized text before acting.

unicode.zero-width-space

Invisible Unicode · MEDIUM

Flags a zero-width space adjacent to an ASCII token that may split or obscure an instruction.

Line-breaking and multilingual text can use this character legitimately.

unicode.zero-width-non-joiner

Invisible Unicode · MEDIUM

Flags a zero-width non-joiner inside an ASCII token.

It has valid shaping uses in some scripts, so verify the language and source context.

unicode.zero-width-joiner

Invisible Unicode · MEDIUM

Flags a zero-width joiner inside an ASCII token that may obscure its spelling.

Emoji sequences and complex-script shaping can use this character legitimately.

unicode.word-joiner

Invisible Unicode · MEDIUM

Flags an invisible word joiner adjacent to an ASCII token.

Typography and line-breaking controls can be legitimate; compare the visible and normalized forms.

unicode.interior-byte-order-mark

Invisible Unicode · MEDIUM

Flags a byte-order-mark character occurring inside text rather than at the beginning.

Accidental encoding artifacts are possible; remove or normalize it only after reviewing the source.

unicode.bidi-embedding

Bidirectional control · MEDIUM

Flags a left-to-right or right-to-left embedding control that can change visual text order.

Bidirectional languages may use embeddings correctly; compare logical text order with its display.

unicode.bidi-formatting-end

Bidirectional control · MEDIUM

Flags a control that ends a bidirectional embedding or override.

It is often paired with legitimate bidirectional formatting; evaluate the complete span.

unicode.bidi-override

Bidirectional control · HIGH

Flags a directional override that can force displayed order to differ from stored character order.

Legitimate right-to-left content exists, but overrides deserve careful source verification.

unicode.bidi-isolate

Bidirectional control · MEDIUM

Flags a bidirectional isolate control that changes how a section is ordered visually.

Internationalized interfaces may use isolates by design; inspect the surrounding language and markup.

unicode.bidi-isolate-end

Bidirectional control · MEDIUM

Flags the control that ends a bidirectional isolate.

It can be valid formatting, so interpret it together with its opening isolate and nearby text.