open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

feat(lexicon): publish a commons-owned pattern id with per-runtime aliases

Browse source 
A conformance fixture has to name a finding. The two runtimes that seed this
repository do not name the same pattern the same way -- llm-security says
"override: ignore previous instructions", the guard says
"override:ignore-previous" -- so until now no expected.json could be written
at all, including for the 64 patterns whose regex is byte-identical in both.

Each pattern now carries `id` plus an `aliases` object naming what each
seeding runtime calls it, and a top-level pattern_id_space block explains the
field, its provenance and its stability contract.

The id is adopted verbatim from the guard's port rather than invented here:
that port already carries both names, so the mapping is read from source data.
Matched by label <-> desc with em-dash normalised to hyphen, 83/83 one-to-one,
83 unique ids.

No detection data moved, and that is proven rather than asserted: labels,
patterns and flags are byte-identical in sequence, no flags key was invented
(78 before, 78 after), and stripping id + aliases + pattern_id_space
reproduces the previous committed file byte for byte -- 23566 bytes. All 83
patterns still compile in Node bare and under u (166/166) and in Python re
(83/83).

Neither consumer has ratified this id space; both were asked by coord today,
and the file records it as a proposal rather than implying agreement.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3
This commit is contained in:
Kjell Tore Guttormsen 2026-08-09 21:46:48 +02:00
commit 7b70f5b52f
4 changed files with 552 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

30
CHANGELOG.md
View file

@ -51,17 +51,37 @@ checks that were not run instead of attaching a caveat to a pass.
changed** — behaviour preservation holds and the finding is reported to the owning
repositories.
### Changed
- `lexicon/injection-lexicon.json` **0.1.0 → 0.2.0** — every pattern gains a commons-owned
`id` and an `aliases` object naming what each seeding runtime calls it, plus a top-level
`pattern_id_space` block explaining the field. This exists because a `conformance/`
fixture has to name a finding and the two runtimes do not name the same pattern the same
way.
The id was **adopted verbatim from the guard's port**, which already carried both names,
rather than invented here. Matching was by `label` ↔ `desc` with em-dash normalised to
hyphen: 83/83, one-to-one, ids unique.
**No detection data moved.** Labels, patterns and flags are byte-identical in sequence,
no `flags` key was invented (78 before, 78 after), and stripping the three new fields
reproduces the previous committed file byte for byte — 23 566 bytes, identical. All 83
patterns still compile in Node bare and under `u` (166/166) and in Python `re` (83/83).
Neither `llm-security` nor the guard has ratified this id space yet; both were asked by
coord on 2026-08-09, and the file says so rather than implying agreement.
### Not included
- `signatures/malware-signatures.json` — seed data not yet delivered.
- `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred
from a data dump would be worse than an absent one.
- `conformance/` — blocked, and the blocker is now identified. 105 of the guard's 134
- `conformance/` — still absent, with half the blocker cleared. 105 of the guard's 134
coverage cases are convertible to static `input.txt`/`expected.json`; the other 29 assert
a runtime's API surface, which this repository does not own. But no fixture can be written
yet at all: an `expected.json` names findings, and the two runtimes have no shared name for
the same pattern (`override:ignore-previous` vs `override: ignore previous instructions`).
A commons-owned pattern id is a prerequisite for the corpus, not a parallel task.
a runtime's API surface, which this repository does not own. Findings can now be **named**
(see `pattern_id_space` above), but 13 patterns still have no agreed **expected
behaviour** — the two ports genuinely differ on them — so those fixtures cannot be
authored until the owning repositories answer.
These are named in the README as planned rather than linked, so nothing in the repository
points at a file that does not exist.

7
docs/extraction-plan.md
View file

@ -291,6 +291,13 @@ directions. They also disagree about pattern identity itself (`override:ignore-p
file as a result — behaviour preservation holds, and the divergence is reported to the two
owning repositories instead.
**Half of it is now cleared (operator decision, 2026-08-09).**
`lexicon/injection-lexicon.json` 0.2.0 publishes a commons-owned `id` per pattern with an
`aliases` object per runtime, adopted verbatim from the guard's port rather than invented.
Findings can therefore be named. What still blocks the corpus is the other half: the 13
divergent patterns have no agreed expected behaviour, and a fixture for them would have to
pick a winner.
## Definition of done for v0.1.0
1. Repository initialized, Forgejo remote `open/llm-security-commons`, MIT, `STATE.md`

12
docs/lexicon-port-divergence.md
View file

@ -137,3 +137,15 @@ So the id question is a **prerequisite** for the corpus, not a parallel task: un
owns a pattern id both ports map to, no fixture can be written, including for the 64 patterns
that are byte-identical. And for the 13 divergent patterns a fixture cannot be authored at all
without first deciding whose recall cost is the contract.
**Resolved for the first half, 2026-08-09 (operator decision).** `lexicon/injection-lexicon.json`
0.2.0 now carries a commons-owned `id` per pattern, plus an `aliases` object naming what each
seeding runtime calls it. The id was **adopted verbatim from the guard's port**, not invented
here — that port already carried both names, so the mapping came from source data. The
detection data is provably unmoved: stripping `id`, `aliases` and the new `pattern_id_space`
block reproduces the previous committed file **byte for byte** (23 566 bytes, identical).
Neither runtime has agreed to it yet — both were asked by coord the same day — so the file
records it as this repository's proposal rather than a ratified contract. The second half of
the blocker stands: the 13 divergent patterns still have no agreed expected behaviour, so
their fixtures cannot be authored even now that they can be named.

592
lexicon/injection-lexicon.json
View file

@ -1,9 +1,18 @@
{
"version": "0.1.0",
"version": "0.2.0",
"id": "injection-lexicon",
"description": "Prompt-injection pattern lexicon: the four pattern families a detector matches against untrusted text, and the severity family each belongs to. Data only. The variant building that feeds these patterns (normalisation, homoglyph folding, rot13, unicode-tag escalation) and the buried-payload heuristic are engine behaviour and are deliberately NOT described here.",
"owasp": "LLM01",
"label_format": "{class}: {detail}",
"pattern_id_space": {
"$comment": "Stable, commons-owned identifier for each pattern. It exists because an expected.json in conformance/ has to name a finding, and the two runtimes that seed this repository do not name the same pattern the same way: llm-security calls it `override: ignore previous instructions`, the Python guard calls it `override:ignore-previous`. Without a shared key no fixture can be written at all, including for the patterns whose regex is byte-identical in both.",
"field": "families[].patterns[].id",
"adopted_from": "llm-ingestion-pipeline-security src/llm_ingestion_guard/injection_lexicon.json (lexicon version 1.0, repo v0.3.4, commit 0bf0729) — the `id` field of its port of the same source table. Adopted verbatim rather than invented: the guard's port already carries both names (`id` and `desc`), so the mapping is read from verified source data rather than constructed here.",
"matching_method": "Each commons pattern was matched to a guard pattern by comparing this file's `label` to the guard's `desc`, with em-dash normalised to hyphen (the two differ only by that character, in the eight hitl-trap entries). 83/83 matched, one-to-one.",
"stability": "An id is a stable identifier. Changing one is a BREAKING change for any consumer matching on it, and requires a major bump of this file.",
"aliases": "Each pattern carries an `aliases` object naming what each seeding runtime calls it today. A runtime renames its own label by changing its alias here; the `id` does not move.",
"not_yet_confirmed": "Neither llm-security nor the guard has yet agreed to this id space — both were asked via coord on 2026-08-09. Until they answer, `id` is this repository's proposal, not a ratified cross-runtime contract."
},
"$comment": "Extracted without behaviour change from llm-security/scanners/lib/injection-patterns.mjs, delivered as operator dump 2/2 through the local coord mailbox on 2026-08-09. Only the four pattern arrays are data. The dump states explicitly that checkCognitiveLoadTrap (the buried-after-2000-chars logic) and scanForInjection's variant building are ENGINE logic that never moves here; they are absent by intent, not by omission. Array order is preserved exactly as delivered.",
"provenance": {
"source_repo": "llm-security",
@ -86,106 +95,211 @@
"count": 21,
"patterns": [
{
"id": "override:ignore-previous",
"label": "override: ignore previous instructions",
"pattern": "ignore\\s+(?:all\\s+)?previous",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: ignore previous instructions",
"llm_ingestion_guard": "override:ignore-previous"
}
},
{
"id": "override:forget-instructions",
"label": "override: forget instructions",
"pattern": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: forget instructions",
"llm_ingestion_guard": "override:forget-instructions"
}
},
{
"id": "override:disregard",
"label": "override: disregard instructions",
"pattern": "disregard\\s+your",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: disregard instructions",
"llm_ingestion_guard": "override:disregard"
}
},
{
"id": "override:override-instructions",
"label": "override: override instructions",
"pattern": "override\\s+your",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: override instructions",
"llm_ingestion_guard": "override:override-instructions"
}
},
{
"id": "override:suspend-constraints",
"label": "override: suspend constraints",
"pattern": "suspend\\s+all\\s+constraints",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: suspend constraints",
"llm_ingestion_guard": "override:suspend-constraints"
}
},
{
"id": "override:prior-constraints",
"label": "override: prior constraints",
"pattern": "all\\s+prior\\s+constraints",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "override: prior constraints",
"llm_ingestion_guard": "override:prior-constraints"
}
},
{
"id": "spoofed-header:hash-system",
"label": "spoofed header: # SYSTEM:",
"pattern": "^#+\\s*SYSTEM\\s*:",
"flags": "m"
"flags": "m",
"aliases": {
"llm_security": "spoofed header: # SYSTEM:",
"llm_ingestion_guard": "spoofed-header:hash-system"
}
},
{
"id": "spoofed-header:inst",
"label": "spoofed header: [INST]",
"pattern": "^\\[INST\\]",
"flags": "m"
"flags": "m",
"aliases": {
"llm_security": "spoofed header: [INST]",
"llm_ingestion_guard": "spoofed-header:inst"
}
},
{
"id": "spoofed-header:pipe-system",
"label": "spoofed header: <|system|>",
"pattern": "<\\|system\\|>"
"pattern": "<\\|system\\|>",
"aliases": {
"llm_security": "spoofed header: <|system|>",
"llm_ingestion_guard": "spoofed-header:pipe-system"
}
},
{
"id": "spoofed-tag:system-open",
"label": "spoofed tag: <system>",
"pattern": "<system>"
"pattern": "<system>",
"aliases": {
"llm_security": "spoofed tag: <system>",
"llm_ingestion_guard": "spoofed-tag:system-open"
}
},
{
"id": "spoofed-tag:system-close",
"label": "spoofed tag: </system>",
"pattern": "<\\/system>"
"pattern": "<\\/system>",
"aliases": {
"llm_security": "spoofed tag: </system>",
"llm_ingestion_guard": "spoofed-tag:system-close"
}
},
{
"id": "spoofed-header:instructions",
"label": "spoofed header: ### Instructions:",
"pattern": "^###\\s*Instructions\\s*:",
"flags": "m"
"flags": "m",
"aliases": {
"llm_security": "spoofed header: ### Instructions:",
"llm_ingestion_guard": "spoofed-header:instructions"
}
},
{
"id": "identity:no-longer",
"label": "identity: you are no longer",
"pattern": "you\\s+are\\s+no\\s+longer",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "identity: you are no longer",
"llm_ingestion_guard": "identity:no-longer"
}
},
{
"id": "identity:you-are-now",
"label": "identity: you are now [name]",
"pattern": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "identity: you are now [name]",
"llm_ingestion_guard": "identity:you-are-now"
}
},
{
"id": "identity:new-role",
"label": "identity: your new role",
"pattern": "your\\s+new\\s+role\\s+is",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "identity: your new role",
"llm_ingestion_guard": "identity:new-role"
}
},
{
"id": "identity:new-directive",
"label": "identity: new primary directive",
"pattern": "your\\s+new\\s+primary\\s+directive",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "identity: new primary directive",
"llm_ingestion_guard": "identity:new-directive"
}
},
{
"id": "identity:pretend",
"label": "identity: pretend you are",
"pattern": "pretend\\s+you\\s+are",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "identity: pretend you are",
"llm_ingestion_guard": "identity:pretend"
}
},
{
"id": "config:ignore-claudemd",
"label": "config: ignore CLAUDE.md",
"pattern": "ignore\\s+your\\s+CLAUDE\\.md",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "config: ignore CLAUDE.md",
"llm_ingestion_guard": "config:ignore-claudemd"
}
},
{
"id": "config:override-system-prompt",
"label": "config: override system prompt",
"pattern": "override\\s+your\\s+system\\s+prompt",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "config: override system prompt",
"llm_ingestion_guard": "config:override-system-prompt"
}
},
{
"id": "config:bypass-safety",
"label": "config: bypass safety",
"pattern": "bypass\\s+your\\s+safety",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "config: bypass safety",
"llm_ingestion_guard": "config:bypass-safety"
}
},
{
"id": "config:disable-filtering",
"label": "config: disable output filtering",
"pattern": "disable\\s+output\\s+filtering",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "config: disable output filtering",
"llm_ingestion_guard": "config:disable-filtering"
}
}
]
},
@ -196,164 +310,324 @@
"count": 32,
"patterns": [
{
"id": "normalization:prioritize-user",
"label": "normalization: prioritize user over rules",
"pattern": "always\\s+prioritize\\s+user\\s+requests?\\s+over",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "normalization: prioritize user over rules",
"llm_ingestion_guard": "normalization:prioritize-user"
}
},
{
"id": "normalization:user-precedence",
"label": "normalization: user intent precedence",
"pattern": "user\\s+intent\\s+takes?\\s+precedence\\s+over",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "normalization: user intent precedence",
"llm_ingestion_guard": "normalization:user-precedence"
}
},
{
"id": "normalization:claudemd-conflict",
"label": "normalization: CLAUDE.md conflict override",
"pattern": "if\\s+CLAUDE\\.md\\s+conflicts",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "normalization: CLAUDE.md conflict override",
"llm_ingestion_guard": "normalization:claudemd-conflict"
}
},
{
"id": "normalization:skip-confirmation",
"label": "normalization: skip confirmation",
"pattern": "skip\\s+confirmation\\s+for",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "normalization: skip confirmation",
"llm_ingestion_guard": "normalization:skip-confirmation"
}
},
{
"id": "reframing:actual-task",
"label": "reframing: your actual task",
"pattern": "your\\s+actual\\s+task\\s+is",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "reframing: your actual task",
"llm_ingestion_guard": "reframing:actual-task"
}
},
{
"id": "reframing:real-purpose",
"label": "reframing: your real purpose",
"pattern": "your\\s+real\\s+purpose\\s+is",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "reframing: your real purpose",
"llm_ingestion_guard": "reframing:real-purpose"
}
},
{
"id": "reframing:should-actually-do",
"label": "reframing: what you should actually do",
"pattern": "what\\s+you\\s+should\\s+actually\\s+do",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "reframing: what you should actually do",
"llm_ingestion_guard": "reframing:should-actually-do"
}
},
{
"id": "hidden-comment:agent-directed",
"label": "hidden comment: agent-directed HTML comment",
"pattern": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hidden comment: agent-directed HTML comment",
"llm_ingestion_guard": "hidden-comment:agent-directed"
}
},
{
"id": "html-obfuscation:display-none",
"label": "html-obfuscation: display:none element with content",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}display\\s*:\\s*none[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: display:none element with content",
"llm_ingestion_guard": "html-obfuscation:display-none"
}
},
{
"id": "html-obfuscation:visibility-hidden",
"label": "html-obfuscation: visibility:hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}visibility\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: visibility:hidden element",
"llm_ingestion_guard": "html-obfuscation:visibility-hidden"
}
},
{
"id": "html-obfuscation:offscreen",
"label": "html-obfuscation: off-screen positioned element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}position\\s*:\\s*absolute[^\"]{0,256}-\\d{3,}px[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: off-screen positioned element",
"llm_ingestion_guard": "html-obfuscation:offscreen"
}
},
{
"id": "html-obfuscation:zero-font",
"label": "html-obfuscation: zero font-size element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}font-size\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero font-size element",
"llm_ingestion_guard": "html-obfuscation:zero-font"
}
},
{
"id": "html-obfuscation:zero-opacity",
"label": "html-obfuscation: zero opacity element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}opacity\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero opacity element",
"llm_ingestion_guard": "html-obfuscation:zero-opacity"
}
},
{
"id": "html-obfuscation:zero-size-overflow",
"label": "html-obfuscation: zero-size overflow-hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}(?:height|width)\\s*:\\s*0[^\"]{0,256}overflow\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero-size overflow-hidden element",
"llm_ingestion_guard": "html-obfuscation:zero-size-overflow"
}
},
{
"id": "html-obfuscation:aria-label",
"label": "html-obfuscation: injection in aria-label attribute",
"pattern": "aria-label\\s*=\\s*\"[^\"]{0,256}(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]{0,256}\"",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: injection in aria-label attribute",
"llm_ingestion_guard": "html-obfuscation:aria-label"
}
},
{
"id": "evasion:educational",
"label": "evasion: educational purpose framing",
"pattern": "for\\s+educational\\s+purposes?\\s+only",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: educational purpose framing",
"llm_ingestion_guard": "evasion:educational"
}
},
{
"id": "evasion:hypothetical",
"label": "evasion: hypothetical scenario framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: hypothetical scenario framing",
"llm_ingestion_guard": "evasion:hypothetical"
}
},
{
"id": "evasion:fictional",
"label": "evasion: fictional setting framing",
"pattern": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: fictional setting framing",
"llm_ingestion_guard": "evasion:fictional"
}
},
{
"id": "evasion:red-team",
"label": "evasion: red-team exercise framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: red-team exercise framing",
"llm_ingestion_guard": "evasion:red-team"
}
},
{
"id": "evasion:security-audit-sim",
"label": "evasion: security audit simulation framing",
"pattern": "security\\s+audit\\s+simulation",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: security audit simulation framing",
"llm_ingestion_guard": "evasion:security-audit-sim"
}
},
{
"id": "evasion:test-pretense",
"label": "evasion: test/lab/sandbox pretense",
"pattern": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: test/lab/sandbox pretense",
"llm_ingestion_guard": "evasion:test-pretense"
}
},
{
"id": "evasion:thought-experiment",
"label": "evasion: thought experiment framing",
"pattern": "as\\s+a\\s+thought\\s+experiment",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: thought experiment framing",
"llm_ingestion_guard": "evasion:thought-experiment"
}
},
{
"id": "evasion:research-purpose",
"label": "evasion: research purpose framing",
"pattern": "for\\s+(?:research|academic|scientific)\\s+purposes",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: research purpose framing",
"llm_ingestion_guard": "evasion:research-purpose"
}
},
{
"id": "evasion:academic-context",
"label": "evasion: academic context framing",
"pattern": "in\\s+an?\\s+(?:academic|research|educational)\\s+context",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "evasion: academic context framing",
"llm_ingestion_guard": "evasion:academic-context"
}
},
{
"id": "hitl-trap:approve-immediately",
"label": "hitl-trap: approval urgency — approve immediately",
"pattern": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — approve immediately",
"llm_ingestion_guard": "hitl-trap:approve-immediately"
}
},
{
"id": "hitl-trap:no-need-review",
"label": "hitl-trap: approval urgency — no need to review",
"pattern": "no\\s+need\\s+to\\s+review",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — no need to review",
"llm_ingestion_guard": "hitl-trap:no-need-review"
}
},
{
"id": "hitl-trap:just-approve",
"label": "hitl-trap: approval urgency — just approve",
"pattern": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — just approve",
"llm_ingestion_guard": "hitl-trap:just-approve"
}
},
{
"id": "hitl-trap:suppress-review",
"label": "hitl-trap: approval urgency — suppress review",
"pattern": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — suppress review",
"llm_ingestion_guard": "hitl-trap:suppress-review"
}
},
{
"id": "hitl-trap:brevity-skip",
"label": "hitl-trap: summary suppression — for brevity, skipping",
"pattern": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — for brevity, skipping",
"llm_ingestion_guard": "hitl-trap:brevity-skip"
}
},
{
"id": "hitl-trap:too-long",
"label": "hitl-trap: summary suppression — too long to show",
"pattern": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — too long to show",
"llm_ingestion_guard": "hitl-trap:too-long"
}
},
{
"id": "hitl-trap:details-omitted",
"label": "hitl-trap: summary suppression — details omitted",
"pattern": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — details omitted",
"llm_ingestion_guard": "hitl-trap:details-omitted"
}
},
{
"id": "hitl-trap:scope-minimization",
"label": "hitl-trap: scope minimization — minor change + destructive action",
"pattern": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: scope minimization — minor change + destructive action",
"llm_ingestion_guard": "hitl-trap:scope-minimization"
}
}
]
},
@ -364,112 +638,222 @@
"count": 22,
"patterns": [
{
"id": "leetspeak:ignore-previous",
"label": "leetspeak: ignore previous (obfuscated)",
"pattern": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "leetspeak: ignore previous (obfuscated)",
"llm_ingestion_guard": "leetspeak:ignore-previous"
}
},
{
"id": "leetspeak:forget-instructions",
"label": "leetspeak: forget instructions (obfuscated)",
"pattern": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "leetspeak: forget instructions (obfuscated)",
"llm_ingestion_guard": "leetspeak:forget-instructions"
}
},
{
"id": "leetspeak:disregard",
"label": "leetspeak: disregard your (obfuscated)",
"pattern": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "leetspeak: disregard your (obfuscated)",
"llm_ingestion_guard": "leetspeak:disregard"
}
},
{
"id": "leetspeak:override",
"label": "leetspeak: override your (obfuscated)",
"pattern": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "leetspeak: override your (obfuscated)",
"llm_ingestion_guard": "leetspeak:override"
}
},
{
"id": "homoglyph:cyrillic-latin-mix",
"label": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"pattern": "[a-zA-Z][\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443]|[\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443][a-zA-Z]"
"pattern": "[a-zA-Z][\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443]|[\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443][a-zA-Z]",
"aliases": {
"llm_security": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"llm_ingestion_guard": "homoglyph:cyrillic-latin-mix"
}
},
{
"id": "unicode:zero-width-in-word",
"label": "unicode: zero-width character inside word (keyword splitting)",
"pattern": "\\w[\\u200B\\u200C\\u200D\\uFEFF]\\w"
"pattern": "\\w[\\u200B\\u200C\\u200D\\uFEFF]\\w",
"aliases": {
"llm_security": "unicode: zero-width character inside word (keyword splitting)",
"llm_ingestion_guard": "unicode:zero-width-in-word"
}
},
{
"id": "indirect:instruction-to-ai",
"label": "indirect: instruction addressed to AI/assistant",
"pattern": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "indirect: instruction addressed to AI/assistant",
"llm_ingestion_guard": "indirect:instruction-to-ai"
}
},
{
"id": "indirect:direct-address",
"label": "indirect: direct address to AI/assistant",
"pattern": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "indirect: direct address to AI/assistant",
"llm_ingestion_guard": "indirect:direct-address"
}
},
{
"id": "indirect:trigger-based",
"label": "indirect: trigger-based instruction for AI",
"pattern": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "indirect: trigger-based instruction for AI",
"llm_ingestion_guard": "indirect:trigger-based"
}
},
{
"id": "multi-lang:french",
"label": "multi-lang: French \"ignore previous instructions\"",
"pattern": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[eé]c[eé]dentes?",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "multi-lang: French \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:french"
}
},
{
"id": "multi-lang:spanish",
"label": "multi-lang: Spanish \"ignore previous instructions\"",
"pattern": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "multi-lang: Spanish \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:spanish"
}
},
{
"id": "multi-lang:german",
"label": "multi-lang: German \"ignore previous instructions\"",
"pattern": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "multi-lang: German \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:german"
}
},
{
"id": "markdown:link-ref-comment",
"label": "markdown: suspicious instruction in link-reference comment",
"pattern": "\\[\\/\\/\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "markdown: suspicious instruction in link-reference comment",
"llm_ingestion_guard": "markdown:link-ref-comment"
}
},
{
"id": "data-uri:executable",
"label": "data-uri: executable content type",
"pattern": "data:(?:text\\/html|application\\/javascript|text\\/javascript)[;,]",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "data-uri: executable content type",
"llm_ingestion_guard": "data-uri:executable"
}
},
{
"id": "markdown:link-anchor-injection",
"label": "markdown: injection payload in link anchor text",
"pattern": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "markdown: injection payload in link anchor text",
"llm_ingestion_guard": "markdown:link-anchor-injection"
}
},
{
"id": "sub-agent:spawn-dangerous",
"label": "sub-agent: spawn instruction with dangerous capability keywords",
"pattern": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:.*?\\s+)?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:.*?\\s+)?(?:secret|credential|key|token|\\.env|\\.ssh))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "sub-agent: spawn instruction with dangerous capability keywords",
"llm_ingestion_guard": "sub-agent:spawn-dangerous"
}
},
{
"id": "sub-agent:delegate-bypass",
"label": "sub-agent: delegation with safety bypass instruction",
"pattern": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.*?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "sub-agent: delegation with safety bypass instruction",
"llm_ingestion_guard": "sub-agent:delegate-bypass"
}
},
{
"id": "nl-indirection:fetch-execute",
"label": "nl-indirection: fetch URL and execute",
"pattern": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: fetch URL and execute",
"llm_ingestion_guard": "nl-indirection:fetch-execute"
}
},
{
"id": "nl-indirection:send-external",
"label": "nl-indirection: send data to external destination",
"pattern": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?:\\/\\/|ftp:\\/\\/|\\S+@\\S+)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: send data to external destination",
"llm_ingestion_guard": "nl-indirection:send-external"
}
},
{
"id": "nl-indirection:read-dotfile",
"label": "nl-indirection: read sensitive dotfile path",
"pattern": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~\\/)?\\.(?:ssh|aws|gnupg|env)\\b",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: read sensitive dotfile path",
"llm_ingestion_guard": "nl-indirection:read-dotfile"
}
},
{
"id": "nl-indirection:extract-exfiltrate",
"label": "nl-indirection: extract credentials and exfiltrate",
"pattern": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: extract credentials and exfiltrate",
"llm_ingestion_guard": "nl-indirection:extract-exfiltrate"
}
},
{
"id": "nl-indirection:download-execute",
"label": "nl-indirection: download and execute",
"pattern": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: download and execute",
"llm_ingestion_guard": "nl-indirection:download-execute"
}
}
]
},
@ -481,44 +865,84 @@
"count": 8,
"patterns": [
{
"id": "hybrid-p2sql:inject-sql",
"label": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"pattern": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"llm_ingestion_guard": "hybrid-p2sql:inject-sql"
}
},
{
"id": "hybrid-p2sql:sql-inject",
"label": "hybrid-p2sql: SQL operation + injection override keywords",
"pattern": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: SQL operation + injection override keywords",
"llm_ingestion_guard": "hybrid-p2sql:sql-inject"
}
},
{
"id": "hybrid-recursive:inject-output",
"label": "hybrid-recursive: instruction to inject into model output",
"pattern": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: instruction to inject into model output",
"llm_ingestion_guard": "hybrid-recursive:inject-output"
}
},
{
"id": "hybrid-recursive:conditional-response",
"label": "hybrid-recursive: conditional response injection (recursive payload)",
"pattern": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: conditional response injection (recursive payload)",
"llm_ingestion_guard": "hybrid-recursive:conditional-response"
}
},
{
"id": "hybrid-xss:script-tag",
"label": "hybrid-xss: <script> tag in content (agent context XSS)",
"pattern": "<script\\b[^>]*>[\\s\\S]*?<\\/script>",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: <script> tag in content (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:script-tag"
}
},
{
"id": "hybrid-xss:javascript-uri",
"label": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"pattern": "javascript\\s*:",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:javascript-uri"
}
},
{
"id": "hybrid-xss:event-handler",
"label": "hybrid-xss: inline event handler attribute (agent context XSS)",
"pattern": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: inline event handler attribute (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:event-handler"
}
},
{
"id": "hybrid-xss:iframe-src",
"label": "hybrid-xss: iframe with executable src (agent context XSS)",
"pattern": "<iframe\\b[^>]*src\\s*=\\s*[\"'][^\"']*(?:javascript:|data:text\\/html)",
"flags": "i"
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: iframe with executable src (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:iframe-src"
}
}
]
}