open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

feat(lexicon): publish a commons-owned pattern id with per-runtime aliases

Browse source 
A conformance fixture has to name a finding. The two runtimes that seed this
repository do not name the same pattern the same way -- llm-security says
"override: ignore previous instructions", the guard says
"override:ignore-previous" -- so until now no expected.json could be written
at all, including for the 64 patterns whose regex is byte-identical in both.

Each pattern now carries `id` plus an `aliases` object naming what each
seeding runtime calls it, and a top-level pattern_id_space block explains the
field, its provenance and its stability contract.

The id is adopted verbatim from the guard's port rather than invented here:
that port already carries both names, so the mapping is read from source data.
Matched by label <-> desc with em-dash normalised to hyphen, 83/83 one-to-one,
83 unique ids.

No detection data moved, and that is proven rather than asserted: labels,
patterns and flags are byte-identical in sequence, no flags key was invented
(78 before, 78 after), and stripping id + aliases + pattern_id_space
reproduces the previous committed file byte for byte -- 23566 bytes. All 83
patterns still compile in Node bare and under u (166/166) and in Python re
(83/83).

Neither consumer has ratified this id space; both were asked by coord today,
and the file records it as a proposal rather than implying agreement.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3
This commit is contained in:
Kjell Tore Guttormsen 2026-08-09 21:46:48 +02:00
commit 7b70f5b52f
4 changed files with 552 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

30
CHANGELOG.md
View file

@ -51,17 +51,37 @@ checks that were not run instead of attaching a caveat to a pass.
changed** — behaviour preservation holds and the finding is reported to the owning changed** — behaviour preservation holds and the finding is reported to the owning
repositories. repositories.
### Changed
- `lexicon/injection-lexicon.json` **0.1.0 → 0.2.0** — every pattern gains a commons-owned
`id` and an `aliases` object naming what each seeding runtime calls it, plus a top-level
`pattern_id_space` block explaining the field. This exists because a `conformance/`
fixture has to name a finding and the two runtimes do not name the same pattern the same
way.
The id was **adopted verbatim from the guard's port**, which already carried both names,
rather than invented here. Matching was by `label` ↔ `desc` with em-dash normalised to
hyphen: 83/83, one-to-one, ids unique.
**No detection data moved.** Labels, patterns and flags are byte-identical in sequence,
no `flags` key was invented (78 before, 78 after), and stripping the three new fields
reproduces the previous committed file byte for byte — 23 566 bytes, identical. All 83
patterns still compile in Node bare and under `u` (166/166) and in Python `re` (83/83).
Neither `llm-security` nor the guard has ratified this id space yet; both were asked by
coord on 2026-08-09, and the file says so rather than implying agreement.
### Not included ### Not included
- `signatures/malware-signatures.json` — seed data not yet delivered. - `signatures/malware-signatures.json` — seed data not yet delivered.
- `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred - `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred
from a data dump would be worse than an absent one. from a data dump would be worse than an absent one.
- `conformance/` — blocked, and the blocker is now identified. 105 of the guard's 134 - `conformance/` — still absent, with half the blocker cleared. 105 of the guard's 134
coverage cases are convertible to static `input.txt`/`expected.json`; the other 29 assert coverage cases are convertible to static `input.txt`/`expected.json`; the other 29 assert
a runtime's API surface, which this repository does not own. But no fixture can be written a runtime's API surface, which this repository does not own. Findings can now be **named**
yet at all: an `expected.json` names findings, and the two runtimes have no shared name for (see `pattern_id_space` above), but 13 patterns still have no agreed **expected
the same pattern (`override:ignore-previous` vs `override: ignore previous instructions`). behaviour** — the two ports genuinely differ on them — so those fixtures cannot be
A commons-owned pattern id is a prerequisite for the corpus, not a parallel task. authored until the owning repositories answer.
These are named in the README as planned rather than linked, so nothing in the repository These are named in the README as planned rather than linked, so nothing in the repository
points at a file that does not exist. points at a file that does not exist.

7
docs/extraction-plan.md
View file

@ -291,6 +291,13 @@ directions. They also disagree about pattern identity itself (`override:ignore-p
file as a result — behaviour preservation holds, and the divergence is reported to the two file as a result — behaviour preservation holds, and the divergence is reported to the two
owning repositories instead. owning repositories instead.
**Half of it is now cleared (operator decision, 2026-08-09).**
`lexicon/injection-lexicon.json` 0.2.0 publishes a commons-owned `id` per pattern with an
`aliases` object per runtime, adopted verbatim from the guard's port rather than invented.
Findings can therefore be named. What still blocks the corpus is the other half: the 13
divergent patterns have no agreed expected behaviour, and a fixture for them would have to
pick a winner.
## Definition of done for v0.1.0 ## Definition of done for v0.1.0
1. Repository initialized, Forgejo remote `open/llm-security-commons`, MIT, `STATE.md` 1. Repository initialized, Forgejo remote `open/llm-security-commons`, MIT, `STATE.md`

12
docs/lexicon-port-divergence.md
View file

@ -137,3 +137,15 @@ So the id question is a **prerequisite** for the corpus, not a parallel task: un
owns a pattern id both ports map to, no fixture can be written, including for the 64 patterns owns a pattern id both ports map to, no fixture can be written, including for the 64 patterns
that are byte-identical. And for the 13 divergent patterns a fixture cannot be authored at all that are byte-identical. And for the 13 divergent patterns a fixture cannot be authored at all
without first deciding whose recall cost is the contract. without first deciding whose recall cost is the contract.
**Resolved for the first half, 2026-08-09 (operator decision).** `lexicon/injection-lexicon.json`
0.2.0 now carries a commons-owned `id` per pattern, plus an `aliases` object naming what each
seeding runtime calls it. The id was **adopted verbatim from the guard's port**, not invented
here — that port already carried both names, so the mapping came from source data. The
detection data is provably unmoved: stripping `id`, `aliases` and the new `pattern_id_space`
block reproduces the previous committed file **byte for byte** (23 566 bytes, identical).
Neither runtime has agreed to it yet — both were asked by coord the same day — so the file
records it as this repository's proposal rather than a ratified contract. The second half of
the blocker stands: the 13 divergent patterns still have no agreed expected behaviour, so
their fixtures cannot be authored even now that they can be named.

592
lexicon/injection-lexicon.json
View file

@ -1,9 +1,18 @@
{ {
"version": "0.1.0", "version": "0.2.0",
"id": "injection-lexicon", "id": "injection-lexicon",
"description": "Prompt-injection pattern lexicon: the four pattern families a detector matches against untrusted text, and the severity family each belongs to. Data only. The variant building that feeds these patterns (normalisation, homoglyph folding, rot13, unicode-tag escalation) and the buried-payload heuristic are engine behaviour and are deliberately NOT described here.", "description": "Prompt-injection pattern lexicon: the four pattern families a detector matches against untrusted text, and the severity family each belongs to. Data only. The variant building that feeds these patterns (normalisation, homoglyph folding, rot13, unicode-tag escalation) and the buried-payload heuristic are engine behaviour and are deliberately NOT described here.",
"owasp": "LLM01", "owasp": "LLM01",
"label_format": "{class}: {detail}", "label_format": "{class}: {detail}",
"pattern_id_space": {
"$comment": "Stable, commons-owned identifier for each pattern. It exists because an expected.json in conformance/ has to name a finding, and the two runtimes that seed this repository do not name the same pattern the same way: llm-security calls it `override: ignore previous instructions`, the Python guard calls it `override:ignore-previous`. Without a shared key no fixture can be written at all, including for the patterns whose regex is byte-identical in both.",
"field": "families[].patterns[].id",
"adopted_from": "llm-ingestion-pipeline-security src/llm_ingestion_guard/injection_lexicon.json (lexicon version 1.0, repo v0.3.4, commit 0bf0729) — the `id` field of its port of the same source table. Adopted verbatim rather than invented: the guard's port already carries both names (`id` and `desc`), so the mapping is read from verified source data rather than constructed here.",
"matching_method": "Each commons pattern was matched to a guard pattern by comparing this file's `label` to the guard's `desc`, with em-dash normalised to hyphen (the two differ only by that character, in the eight hitl-trap entries). 83/83 matched, one-to-one.",
"stability": "An id is a stable identifier. Changing one is a BREAKING change for any consumer matching on it, and requires a major bump of this file.",
"aliases": "Each pattern carries an `aliases` object naming what each seeding runtime calls it today. A runtime renames its own label by changing its alias here; the `id` does not move.",
"not_yet_confirmed": "Neither llm-security nor the guard has yet agreed to this id space — both were asked via coord on 2026-08-09. Until they answer, `id` is this repository's proposal, not a ratified cross-runtime contract."
},
"$comment": "Extracted without behaviour change from llm-security/scanners/lib/injection-patterns.mjs, delivered as operator dump 2/2 through the local coord mailbox on 2026-08-09. Only the four pattern arrays are data. The dump states explicitly that checkCognitiveLoadTrap (the buried-after-2000-chars logic) and scanForInjection's variant building are ENGINE logic that never moves here; they are absent by intent, not by omission. Array order is preserved exactly as delivered.", "$comment": "Extracted without behaviour change from llm-security/scanners/lib/injection-patterns.mjs, delivered as operator dump 2/2 through the local coord mailbox on 2026-08-09. Only the four pattern arrays are data. The dump states explicitly that checkCognitiveLoadTrap (the buried-after-2000-chars logic) and scanForInjection's variant building are ENGINE logic that never moves here; they are absent by intent, not by omission. Array order is preserved exactly as delivered.",
"provenance": { "provenance": {
"source_repo": "llm-security", "source_repo": "llm-security",
@ -86,106 +95,211 @@
"count": 21, "count": 21,
"patterns": [ "patterns": [
{ {
"id": "override:ignore-previous",
"label": "override: ignore previous instructions", "label": "override: ignore previous instructions",
"pattern": "ignore\\s+(?:all\\s+)?previous", "pattern": "ignore\\s+(?:all\\s+)?previous",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: ignore previous instructions",
"llm_ingestion_guard": "override:ignore-previous"
}
}, },
{ {
"id": "override:forget-instructions",
"label": "override: forget instructions", "label": "override: forget instructions",
"pattern": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)", "pattern": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: forget instructions",
"llm_ingestion_guard": "override:forget-instructions"
}
}, },
{ {
"id": "override:disregard",
"label": "override: disregard instructions", "label": "override: disregard instructions",
"pattern": "disregard\\s+your", "pattern": "disregard\\s+your",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: disregard instructions",
"llm_ingestion_guard": "override:disregard"
}
}, },
{ {
"id": "override:override-instructions",
"label": "override: override instructions", "label": "override: override instructions",
"pattern": "override\\s+your", "pattern": "override\\s+your",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: override instructions",
"llm_ingestion_guard": "override:override-instructions"
}
}, },
{ {
"id": "override:suspend-constraints",
"label": "override: suspend constraints", "label": "override: suspend constraints",
"pattern": "suspend\\s+all\\s+constraints", "pattern": "suspend\\s+all\\s+constraints",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: suspend constraints",
"llm_ingestion_guard": "override:suspend-constraints"
}
}, },
{ {
"id": "override:prior-constraints",
"label": "override: prior constraints", "label": "override: prior constraints",
"pattern": "all\\s+prior\\s+constraints", "pattern": "all\\s+prior\\s+constraints",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "override: prior constraints",
"llm_ingestion_guard": "override:prior-constraints"
}
}, },
{ {
"id": "spoofed-header:hash-system",
"label": "spoofed header: # SYSTEM:", "label": "spoofed header: # SYSTEM:",
"pattern": "^#+\\s*SYSTEM\\s*:", "pattern": "^#+\\s*SYSTEM\\s*:",
"flags": "m" "flags": "m",
"aliases": {
"llm_security": "spoofed header: # SYSTEM:",
"llm_ingestion_guard": "spoofed-header:hash-system"
}
}, },
{ {
"id": "spoofed-header:inst",
"label": "spoofed header: [INST]", "label": "spoofed header: [INST]",
"pattern": "^\\[INST\\]", "pattern": "^\\[INST\\]",
"flags": "m" "flags": "m",
"aliases": {
"llm_security": "spoofed header: [INST]",
"llm_ingestion_guard": "spoofed-header:inst"
}
}, },
{ {
"id": "spoofed-header:pipe-system",
"label": "spoofed header: <|system|>", "label": "spoofed header: <|system|>",
"pattern": "<\\|system\\|>" "pattern": "<\\|system\\|>",
"aliases": {
"llm_security": "spoofed header: <|system|>",
"llm_ingestion_guard": "spoofed-header:pipe-system"
}
}, },
{ {
"id": "spoofed-tag:system-open",
"label": "spoofed tag: <system>", "label": "spoofed tag: <system>",
"pattern": "<system>" "pattern": "<system>",
"aliases": {
"llm_security": "spoofed tag: <system>",
"llm_ingestion_guard": "spoofed-tag:system-open"
}
}, },
{ {
"id": "spoofed-tag:system-close",
"label": "spoofed tag: </system>", "label": "spoofed tag: </system>",
"pattern": "<\\/system>" "pattern": "<\\/system>",
"aliases": {
"llm_security": "spoofed tag: </system>",
"llm_ingestion_guard": "spoofed-tag:system-close"
}
}, },
{ {
"id": "spoofed-header:instructions",
"label": "spoofed header: ### Instructions:", "label": "spoofed header: ### Instructions:",
"pattern": "^###\\s*Instructions\\s*:", "pattern": "^###\\s*Instructions\\s*:",
"flags": "m" "flags": "m",
"aliases": {
"llm_security": "spoofed header: ### Instructions:",
"llm_ingestion_guard": "spoofed-header:instructions"
}
}, },
{ {
"id": "identity:no-longer",
"label": "identity: you are no longer", "label": "identity: you are no longer",
"pattern": "you\\s+are\\s+no\\s+longer", "pattern": "you\\s+are\\s+no\\s+longer",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "identity: you are no longer",
"llm_ingestion_guard": "identity:no-longer"
}
}, },
{ {
"id": "identity:you-are-now",
"label": "identity: you are now [name]", "label": "identity: you are now [name]",
"pattern": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)", "pattern": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "identity: you are now [name]",
"llm_ingestion_guard": "identity:you-are-now"
}
}, },
{ {
"id": "identity:new-role",
"label": "identity: your new role", "label": "identity: your new role",
"pattern": "your\\s+new\\s+role\\s+is", "pattern": "your\\s+new\\s+role\\s+is",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "identity: your new role",
"llm_ingestion_guard": "identity:new-role"
}
}, },
{ {
"id": "identity:new-directive",
"label": "identity: new primary directive", "label": "identity: new primary directive",
"pattern": "your\\s+new\\s+primary\\s+directive", "pattern": "your\\s+new\\s+primary\\s+directive",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "identity: new primary directive",
"llm_ingestion_guard": "identity:new-directive"
}
}, },
{ {
"id": "identity:pretend",
"label": "identity: pretend you are", "label": "identity: pretend you are",
"pattern": "pretend\\s+you\\s+are", "pattern": "pretend\\s+you\\s+are",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "identity: pretend you are",
"llm_ingestion_guard": "identity:pretend"
}
}, },
{ {
"id": "config:ignore-claudemd",
"label": "config: ignore CLAUDE.md", "label": "config: ignore CLAUDE.md",
"pattern": "ignore\\s+your\\s+CLAUDE\\.md", "pattern": "ignore\\s+your\\s+CLAUDE\\.md",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "config: ignore CLAUDE.md",
"llm_ingestion_guard": "config:ignore-claudemd"
}
}, },
{ {
"id": "config:override-system-prompt",
"label": "config: override system prompt", "label": "config: override system prompt",
"pattern": "override\\s+your\\s+system\\s+prompt", "pattern": "override\\s+your\\s+system\\s+prompt",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "config: override system prompt",
"llm_ingestion_guard": "config:override-system-prompt"
}
}, },
{ {
"id": "config:bypass-safety",
"label": "config: bypass safety", "label": "config: bypass safety",
"pattern": "bypass\\s+your\\s+safety", "pattern": "bypass\\s+your\\s+safety",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "config: bypass safety",
"llm_ingestion_guard": "config:bypass-safety"
}
}, },
{ {
"id": "config:disable-filtering",
"label": "config: disable output filtering", "label": "config: disable output filtering",
"pattern": "disable\\s+output\\s+filtering", "pattern": "disable\\s+output\\s+filtering",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "config: disable output filtering",
"llm_ingestion_guard": "config:disable-filtering"
}
} }
] ]
}, },
@ -196,164 +310,324 @@
"count": 32, "count": 32,
"patterns": [ "patterns": [
{ {
"id": "normalization:prioritize-user",
"label": "normalization: prioritize user over rules", "label": "normalization: prioritize user over rules",
"pattern": "always\\s+prioritize\\s+user\\s+requests?\\s+over", "pattern": "always\\s+prioritize\\s+user\\s+requests?\\s+over",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "normalization: prioritize user over rules",
"llm_ingestion_guard": "normalization:prioritize-user"
}
}, },
{ {
"id": "normalization:user-precedence",
"label": "normalization: user intent precedence", "label": "normalization: user intent precedence",
"pattern": "user\\s+intent\\s+takes?\\s+precedence\\s+over", "pattern": "user\\s+intent\\s+takes?\\s+precedence\\s+over",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "normalization: user intent precedence",
"llm_ingestion_guard": "normalization:user-precedence"
}
}, },
{ {
"id": "normalization:claudemd-conflict",
"label": "normalization: CLAUDE.md conflict override", "label": "normalization: CLAUDE.md conflict override",
"pattern": "if\\s+CLAUDE\\.md\\s+conflicts", "pattern": "if\\s+CLAUDE\\.md\\s+conflicts",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "normalization: CLAUDE.md conflict override",
"llm_ingestion_guard": "normalization:claudemd-conflict"
}
}, },
{ {
"id": "normalization:skip-confirmation",
"label": "normalization: skip confirmation", "label": "normalization: skip confirmation",
"pattern": "skip\\s+confirmation\\s+for", "pattern": "skip\\s+confirmation\\s+for",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "normalization: skip confirmation",
"llm_ingestion_guard": "normalization:skip-confirmation"
}
}, },
{ {
"id": "reframing:actual-task",
"label": "reframing: your actual task", "label": "reframing: your actual task",
"pattern": "your\\s+actual\\s+task\\s+is", "pattern": "your\\s+actual\\s+task\\s+is",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "reframing: your actual task",
"llm_ingestion_guard": "reframing:actual-task"
}
}, },
{ {
"id": "reframing:real-purpose",
"label": "reframing: your real purpose", "label": "reframing: your real purpose",
"pattern": "your\\s+real\\s+purpose\\s+is", "pattern": "your\\s+real\\s+purpose\\s+is",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "reframing: your real purpose",
"llm_ingestion_guard": "reframing:real-purpose"
}
}, },
{ {
"id": "reframing:should-actually-do",
"label": "reframing: what you should actually do", "label": "reframing: what you should actually do",
"pattern": "what\\s+you\\s+should\\s+actually\\s+do", "pattern": "what\\s+you\\s+should\\s+actually\\s+do",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "reframing: what you should actually do",
"llm_ingestion_guard": "reframing:should-actually-do"
}
}, },
{ {
"id": "hidden-comment:agent-directed",
"label": "hidden comment: agent-directed HTML comment", "label": "hidden comment: agent-directed HTML comment",
"pattern": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:", "pattern": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hidden comment: agent-directed HTML comment",
"llm_ingestion_guard": "hidden-comment:agent-directed"
}
}, },
{ {
"id": "html-obfuscation:display-none",
"label": "html-obfuscation: display:none element with content", "label": "html-obfuscation: display:none element with content",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}display\\s*:\\s*none[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}display\\s*:\\s*none[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: display:none element with content",
"llm_ingestion_guard": "html-obfuscation:display-none"
}
}, },
{ {
"id": "html-obfuscation:visibility-hidden",
"label": "html-obfuscation: visibility:hidden element", "label": "html-obfuscation: visibility:hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}visibility\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}visibility\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: visibility:hidden element",
"llm_ingestion_guard": "html-obfuscation:visibility-hidden"
}
}, },
{ {
"id": "html-obfuscation:offscreen",
"label": "html-obfuscation: off-screen positioned element", "label": "html-obfuscation: off-screen positioned element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}position\\s*:\\s*absolute[^\"]{0,256}-\\d{3,}px[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}position\\s*:\\s*absolute[^\"]{0,256}-\\d{3,}px[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: off-screen positioned element",
"llm_ingestion_guard": "html-obfuscation:offscreen"
}
}, },
{ {
"id": "html-obfuscation:zero-font",
"label": "html-obfuscation: zero font-size element", "label": "html-obfuscation: zero font-size element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}font-size\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}font-size\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero font-size element",
"llm_ingestion_guard": "html-obfuscation:zero-font"
}
}, },
{ {
"id": "html-obfuscation:zero-opacity",
"label": "html-obfuscation: zero opacity element", "label": "html-obfuscation: zero opacity element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}opacity\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}opacity\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero opacity element",
"llm_ingestion_guard": "html-obfuscation:zero-opacity"
}
}, },
{ {
"id": "html-obfuscation:zero-size-overflow",
"label": "html-obfuscation: zero-size overflow-hidden element", "label": "html-obfuscation: zero-size overflow-hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}(?:height|width)\\s*:\\s*0[^\"]{0,256}overflow\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>", "pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}(?:height|width)\\s*:\\s*0[^\"]{0,256}overflow\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero-size overflow-hidden element",
"llm_ingestion_guard": "html-obfuscation:zero-size-overflow"
}
}, },
{ {
"id": "html-obfuscation:aria-label",
"label": "html-obfuscation: injection in aria-label attribute", "label": "html-obfuscation: injection in aria-label attribute",
"pattern": "aria-label\\s*=\\s*\"[^\"]{0,256}(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]{0,256}\"", "pattern": "aria-label\\s*=\\s*\"[^\"]{0,256}(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]{0,256}\"",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "html-obfuscation: injection in aria-label attribute",
"llm_ingestion_guard": "html-obfuscation:aria-label"
}
}, },
{ {
"id": "evasion:educational",
"label": "evasion: educational purpose framing", "label": "evasion: educational purpose framing",
"pattern": "for\\s+educational\\s+purposes?\\s+only", "pattern": "for\\s+educational\\s+purposes?\\s+only",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: educational purpose framing",
"llm_ingestion_guard": "evasion:educational"
}
}, },
{ {
"id": "evasion:hypothetical",
"label": "evasion: hypothetical scenario framing", "label": "evasion: hypothetical scenario framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario", "pattern": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: hypothetical scenario framing",
"llm_ingestion_guard": "evasion:hypothetical"
}
}, },
{ {
"id": "evasion:fictional",
"label": "evasion: fictional setting framing", "label": "evasion: fictional setting framing",
"pattern": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where", "pattern": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: fictional setting framing",
"llm_ingestion_guard": "evasion:fictional"
}
}, },
{ {
"id": "evasion:red-team",
"label": "evasion: red-team exercise framing", "label": "evasion: red-team exercise framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)", "pattern": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: red-team exercise framing",
"llm_ingestion_guard": "evasion:red-team"
}
}, },
{ {
"id": "evasion:security-audit-sim",
"label": "evasion: security audit simulation framing", "label": "evasion: security audit simulation framing",
"pattern": "security\\s+audit\\s+simulation", "pattern": "security\\s+audit\\s+simulation",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: security audit simulation framing",
"llm_ingestion_guard": "evasion:security-audit-sim"
}
}, },
{ {
"id": "evasion:test-pretense",
"label": "evasion: test/lab/sandbox pretense", "label": "evasion: test/lab/sandbox pretense",
"pattern": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)", "pattern": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: test/lab/sandbox pretense",
"llm_ingestion_guard": "evasion:test-pretense"
}
}, },
{ {
"id": "evasion:thought-experiment",
"label": "evasion: thought experiment framing", "label": "evasion: thought experiment framing",
"pattern": "as\\s+a\\s+thought\\s+experiment", "pattern": "as\\s+a\\s+thought\\s+experiment",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: thought experiment framing",
"llm_ingestion_guard": "evasion:thought-experiment"
}
}, },
{ {
"id": "evasion:research-purpose",
"label": "evasion: research purpose framing", "label": "evasion: research purpose framing",
"pattern": "for\\s+(?:research|academic|scientific)\\s+purposes", "pattern": "for\\s+(?:research|academic|scientific)\\s+purposes",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: research purpose framing",
"llm_ingestion_guard": "evasion:research-purpose"
}
}, },
{ {
"id": "evasion:academic-context",
"label": "evasion: academic context framing", "label": "evasion: academic context framing",
"pattern": "in\\s+an?\\s+(?:academic|research|educational)\\s+context", "pattern": "in\\s+an?\\s+(?:academic|research|educational)\\s+context",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "evasion: academic context framing",
"llm_ingestion_guard": "evasion:academic-context"
}
}, },
{ {
"id": "hitl-trap:approve-immediately",
"label": "hitl-trap: approval urgency — approve immediately", "label": "hitl-trap: approval urgency — approve immediately",
"pattern": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately", "pattern": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — approve immediately",
"llm_ingestion_guard": "hitl-trap:approve-immediately"
}
}, },
{ {
"id": "hitl-trap:no-need-review",
"label": "hitl-trap: approval urgency — no need to review", "label": "hitl-trap: approval urgency — no need to review",
"pattern": "no\\s+need\\s+to\\s+review", "pattern": "no\\s+need\\s+to\\s+review",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — no need to review",
"llm_ingestion_guard": "hitl-trap:no-need-review"
}
}, },
{ {
"id": "hitl-trap:just-approve",
"label": "hitl-trap: approval urgency — just approve", "label": "hitl-trap: approval urgency — just approve",
"pattern": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)", "pattern": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — just approve",
"llm_ingestion_guard": "hitl-trap:just-approve"
}
}, },
{ {
"id": "hitl-trap:suppress-review",
"label": "hitl-trap: approval urgency — suppress review", "label": "hitl-trap: approval urgency — suppress review",
"pattern": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)", "pattern": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — suppress review",
"llm_ingestion_guard": "hitl-trap:suppress-review"
}
}, },
{ {
"id": "hitl-trap:brevity-skip",
"label": "hitl-trap: summary suppression — for brevity, skipping", "label": "hitl-trap: summary suppression — for brevity, skipping",
"pattern": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)", "pattern": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — for brevity, skipping",
"llm_ingestion_guard": "hitl-trap:brevity-skip"
}
}, },
{ {
"id": "hitl-trap:too-long",
"label": "hitl-trap: summary suppression — too long to show", "label": "hitl-trap: summary suppression — too long to show",
"pattern": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))", "pattern": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — too long to show",
"llm_ingestion_guard": "hitl-trap:too-long"
}
}, },
{ {
"id": "hitl-trap:details-omitted",
"label": "hitl-trap: summary suppression — details omitted", "label": "hitl-trap: summary suppression — details omitted",
"pattern": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))", "pattern": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — details omitted",
"llm_ingestion_guard": "hitl-trap:details-omitted"
}
}, },
{ {
"id": "hitl-trap:scope-minimization",
"label": "hitl-trap: scope minimization — minor change + destructive action", "label": "hitl-trap: scope minimization — minor change + destructive action",
"pattern": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)", "pattern": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hitl-trap: scope minimization — minor change + destructive action",
"llm_ingestion_guard": "hitl-trap:scope-minimization"
}
} }
] ]
}, },
@ -364,112 +638,222 @@
"count": 22, "count": 22,
"patterns": [ "patterns": [
{ {
"id": "leetspeak:ignore-previous",
"label": "leetspeak: ignore previous (obfuscated)", "label": "leetspeak: ignore previous (obfuscated)",
"pattern": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us", "pattern": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "leetspeak: ignore previous (obfuscated)",
"llm_ingestion_guard": "leetspeak:ignore-previous"
}
}, },
{ {
"id": "leetspeak:forget-instructions",
"label": "leetspeak: forget instructions (obfuscated)", "label": "leetspeak: forget instructions (obfuscated)",
"pattern": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns", "pattern": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "leetspeak: forget instructions (obfuscated)",
"llm_ingestion_guard": "leetspeak:forget-instructions"
}
}, },
{ {
"id": "leetspeak:disregard",
"label": "leetspeak: disregard your (obfuscated)", "label": "leetspeak: disregard your (obfuscated)",
"pattern": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur", "pattern": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "leetspeak: disregard your (obfuscated)",
"llm_ingestion_guard": "leetspeak:disregard"
}
}, },
{ {
"id": "leetspeak:override",
"label": "leetspeak: override your (obfuscated)", "label": "leetspeak: override your (obfuscated)",
"pattern": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur", "pattern": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "leetspeak: override your (obfuscated)",
"llm_ingestion_guard": "leetspeak:override"
}
}, },
{ {
"id": "homoglyph:cyrillic-latin-mix",
"label": "homoglyph: Cyrillic-Latin mixing in adjacent characters", "label": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"pattern": "[a-zA-Z][\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443]|[\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443][a-zA-Z]" "pattern": "[a-zA-Z][\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443]|[\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443][a-zA-Z]",
"aliases": {
"llm_security": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"llm_ingestion_guard": "homoglyph:cyrillic-latin-mix"
}
}, },
{ {
"id": "unicode:zero-width-in-word",
"label": "unicode: zero-width character inside word (keyword splitting)", "label": "unicode: zero-width character inside word (keyword splitting)",
"pattern": "\\w[\\u200B\\u200C\\u200D\\uFEFF]\\w" "pattern": "\\w[\\u200B\\u200C\\u200D\\uFEFF]\\w",
"aliases": {
"llm_security": "unicode: zero-width character inside word (keyword splitting)",
"llm_ingestion_guard": "unicode:zero-width-in-word"
}
}, },
{ {
"id": "indirect:instruction-to-ai",
"label": "indirect: instruction addressed to AI/assistant", "label": "indirect: instruction addressed to AI/assistant",
"pattern": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b", "pattern": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "indirect: instruction addressed to AI/assistant",
"llm_ingestion_guard": "indirect:instruction-to-ai"
}
}, },
{ {
"id": "indirect:direct-address",
"label": "indirect: direct address to AI/assistant", "label": "indirect: direct address to AI/assistant",
"pattern": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b", "pattern": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "indirect: direct address to AI/assistant",
"llm_ingestion_guard": "indirect:direct-address"
}
}, },
{ {
"id": "indirect:trigger-based",
"label": "indirect: trigger-based instruction for AI", "label": "indirect: trigger-based instruction for AI",
"pattern": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this", "pattern": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "indirect: trigger-based instruction for AI",
"llm_ingestion_guard": "indirect:trigger-based"
}
}, },
{ {
"id": "multi-lang:french",
"label": "multi-lang: French \"ignore previous instructions\"", "label": "multi-lang: French \"ignore previous instructions\"",
"pattern": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[eé]c[eé]dentes?", "pattern": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[eé]c[eé]dentes?",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "multi-lang: French \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:french"
}
}, },
{ {
"id": "multi-lang:spanish",
"label": "multi-lang: Spanish \"ignore previous instructions\"", "label": "multi-lang: Spanish \"ignore previous instructions\"",
"pattern": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?", "pattern": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "multi-lang: Spanish \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:spanish"
}
}, },
{ {
"id": "multi-lang:german",
"label": "multi-lang: German \"ignore previous instructions\"", "label": "multi-lang: German \"ignore previous instructions\"",
"pattern": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)", "pattern": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "multi-lang: German \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:german"
}
}, },
{ {
"id": "markdown:link-ref-comment",
"label": "markdown: suspicious instruction in link-reference comment", "label": "markdown: suspicious instruction in link-reference comment",
"pattern": "\\[\\/\\/\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)", "pattern": "\\[\\/\\/\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "markdown: suspicious instruction in link-reference comment",
"llm_ingestion_guard": "markdown:link-ref-comment"
}
}, },
{ {
"id": "data-uri:executable",
"label": "data-uri: executable content type", "label": "data-uri: executable content type",
"pattern": "data:(?:text\\/html|application\\/javascript|text\\/javascript)[;,]", "pattern": "data:(?:text\\/html|application\\/javascript|text\\/javascript)[;,]",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "data-uri: executable content type",
"llm_ingestion_guard": "data-uri:executable"
}
}, },
{ {
"id": "markdown:link-anchor-injection",
"label": "markdown: injection payload in link anchor text", "label": "markdown: injection payload in link anchor text",
"pattern": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)", "pattern": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "markdown: injection payload in link anchor text",
"llm_ingestion_guard": "markdown:link-anchor-injection"
}
}, },
{ {
"id": "sub-agent:spawn-dangerous",
"label": "sub-agent: spawn instruction with dangerous capability keywords", "label": "sub-agent: spawn instruction with dangerous capability keywords",
"pattern": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:.*?\\s+)?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:.*?\\s+)?(?:secret|credential|key|token|\\.env|\\.ssh))", "pattern": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:.*?\\s+)?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:.*?\\s+)?(?:secret|credential|key|token|\\.env|\\.ssh))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "sub-agent: spawn instruction with dangerous capability keywords",
"llm_ingestion_guard": "sub-agent:spawn-dangerous"
}
}, },
{ {
"id": "sub-agent:delegate-bypass",
"label": "sub-agent: delegation with safety bypass instruction", "label": "sub-agent: delegation with safety bypass instruction",
"pattern": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.*?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))", "pattern": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.*?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "sub-agent: delegation with safety bypass instruction",
"llm_ingestion_guard": "sub-agent:delegate-bypass"
}
}, },
{ {
"id": "nl-indirection:fetch-execute",
"label": "nl-indirection: fetch URL and execute", "label": "nl-indirection: fetch URL and execute",
"pattern": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)", "pattern": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "nl-indirection: fetch URL and execute",
"llm_ingestion_guard": "nl-indirection:fetch-execute"
}
}, },
{ {
"id": "nl-indirection:send-external",
"label": "nl-indirection: send data to external destination", "label": "nl-indirection: send data to external destination",
"pattern": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?:\\/\\/|ftp:\\/\\/|\\S+@\\S+)", "pattern": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?:\\/\\/|ftp:\\/\\/|\\S+@\\S+)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "nl-indirection: send data to external destination",
"llm_ingestion_guard": "nl-indirection:send-external"
}
}, },
{ {
"id": "nl-indirection:read-dotfile",
"label": "nl-indirection: read sensitive dotfile path", "label": "nl-indirection: read sensitive dotfile path",
"pattern": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~\\/)?\\.(?:ssh|aws|gnupg|env)\\b", "pattern": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~\\/)?\\.(?:ssh|aws|gnupg|env)\\b",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "nl-indirection: read sensitive dotfile path",
"llm_ingestion_guard": "nl-indirection:read-dotfile"
}
}, },
{ {
"id": "nl-indirection:extract-exfiltrate",
"label": "nl-indirection: extract credentials and exfiltrate", "label": "nl-indirection: extract credentials and exfiltrate",
"pattern": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)", "pattern": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "nl-indirection: extract credentials and exfiltrate",
"llm_ingestion_guard": "nl-indirection:extract-exfiltrate"
}
}, },
{ {
"id": "nl-indirection:download-execute",
"label": "nl-indirection: download and execute", "label": "nl-indirection: download and execute",
"pattern": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))", "pattern": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "nl-indirection: download and execute",
"llm_ingestion_guard": "nl-indirection:download-execute"
}
} }
] ]
}, },
@ -481,44 +865,84 @@
"count": 8, "count": 8,
"patterns": [ "patterns": [
{ {
"id": "hybrid-p2sql:inject-sql",
"label": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)", "label": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"pattern": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))", "pattern": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"llm_ingestion_guard": "hybrid-p2sql:inject-sql"
}
}, },
{ {
"id": "hybrid-p2sql:sql-inject",
"label": "hybrid-p2sql: SQL operation + injection override keywords", "label": "hybrid-p2sql: SQL operation + injection override keywords",
"pattern": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)", "pattern": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: SQL operation + injection override keywords",
"llm_ingestion_guard": "hybrid-p2sql:sql-inject"
}
}, },
{ {
"id": "hybrid-recursive:inject-output",
"label": "hybrid-recursive: instruction to inject into model output", "label": "hybrid-recursive: instruction to inject into model output",
"pattern": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)", "pattern": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: instruction to inject into model output",
"llm_ingestion_guard": "hybrid-recursive:inject-output"
}
}, },
{ {
"id": "hybrid-recursive:conditional-response",
"label": "hybrid-recursive: conditional response injection (recursive payload)", "label": "hybrid-recursive: conditional response injection (recursive payload)",
"pattern": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)", "pattern": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: conditional response injection (recursive payload)",
"llm_ingestion_guard": "hybrid-recursive:conditional-response"
}
}, },
{ {
"id": "hybrid-xss:script-tag",
"label": "hybrid-xss: <script> tag in content (agent context XSS)", "label": "hybrid-xss: <script> tag in content (agent context XSS)",
"pattern": "<script\\b[^>]*>[\\s\\S]*?<\\/script>", "pattern": "<script\\b[^>]*>[\\s\\S]*?<\\/script>",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-xss: <script> tag in content (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:script-tag"
}
}, },
{ {
"id": "hybrid-xss:javascript-uri",
"label": "hybrid-xss: javascript: URI scheme (agent context XSS)", "label": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"pattern": "javascript\\s*:", "pattern": "javascript\\s*:",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:javascript-uri"
}
}, },
{ {
"id": "hybrid-xss:event-handler",
"label": "hybrid-xss: inline event handler attribute (agent context XSS)", "label": "hybrid-xss: inline event handler attribute (agent context XSS)",
"pattern": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=", "pattern": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-xss: inline event handler attribute (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:event-handler"
}
}, },
{ {
"id": "hybrid-xss:iframe-src",
"label": "hybrid-xss: iframe with executable src (agent context XSS)", "label": "hybrid-xss: iframe with executable src (agent context XSS)",
"pattern": "<iframe\\b[^>]*src\\s*=\\s*[\"'][^\"']*(?:javascript:|data:text\\/html)", "pattern": "<iframe\\b[^>]*src\\s*=\\s*[\"'][^\"']*(?:javascript:|data:text\\/html)",
"flags": "i" "flags": "i",
"aliases": {
"llm_security": "hybrid-xss: iframe with executable src (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:iframe-src"
}
} }
] ]
} }