open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity
llm-security-commons/lexicon/injection-lexicon.json
Kjell Tore Guttormsen f68f1e19d5 docs(lexicon): split the alias evidence, correct a false absence claim 
Advisor review found six gaps the session's own checks did not cover. The one
that mattered was outward-facing: the divergence report told the guard repo
that two sub-agent bounds were undocumented. That was wrong. lexicon.py's
module docstring documents them explicitly under "Bounded token gaps", and
git log -S dates {0,12} to the original port commit f397cd9 and [^><] to the
ReDoS fix cff0437. Every divergence on the guard's side is documented and
traceable. The claim rested on two sed slices of one file; an absence claim
needs a search over the whole repository. Corrected here and by coord.

lexicon/injection-lexicon.json 0.2.0 -> 0.3.0:

- pattern_id_space.alias_evidence records the two aliases separately instead
  of averaging them. llm_ingestion_guard is verified — coverage.py asserts on
  that exact string, so it is demonstrably what a guard finding carries.
  llm_security is not: it is the pattern table's name, the finding producer
  was never supplied, and the known Node finding shape uses title, not label.
- normalisations[].affects now keys on id, with the prose names kept beside it
  as affects_labels. An internal cross-reference on label was a second
  identity space inside the file the id exists to unify.

Detection data unmoved again: labels, patterns, flags and the ids and aliases
added in 7b70f5b are all byte-identical in sequence; 166/166 Node compiles.

Also: the README lexicon row described thematic families the file does not
have (they are severity families; the theme is the id prefix), and the
conformance convertibility table gained its missing second condition — a case
is buildable only if the label it asserts maps to data this repository
publishes. Eleven cases fail that test (entropy, decoded, the sanitize rows,
the OKF scans), so the buildable set is ~94, not 105.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3
2026-08-09 21:56:45 +02:00

968 lines
44 KiB
JSON
Raw Blame History

{
"version": "0.3.0",
"id": "injection-lexicon",
"description": "Prompt-injection pattern lexicon: the four pattern families a detector matches against untrusted text, and the severity family each belongs to. Data only. The variant building that feeds these patterns (normalisation, homoglyph folding, rot13, unicode-tag escalation) and the buried-payload heuristic are engine behaviour and are deliberately NOT described here.",
"owasp": "LLM01",
"label_format": "{class}: {detail}",
"pattern_id_space": {
"$comment": "Stable, commons-owned identifier for each pattern. It exists because an expected.json in conformance/ has to name a finding, and the two runtimes that seed this repository do not name the same pattern the same way: llm-security calls it `override: ignore previous instructions`, the Python guard calls it `override:ignore-previous`. Without a shared key no fixture can be written at all, including for the patterns whose regex is byte-identical in both.",
"field": "families[].patterns[].id",
"adopted_from": "llm-ingestion-pipeline-security src/llm_ingestion_guard/injection_lexicon.json (lexicon version 1.0, repo v0.3.4, commit 0bf0729) — the `id` field of its port of the same source table. Adopted verbatim rather than invented: the guard's port already carries both names (`id` and `desc`), so the mapping is read from verified source data rather than constructed here.",
"matching_method": "Each commons pattern was matched to a guard pattern by comparing this file's `label` to the guard's `desc`, with em-dash normalised to hyphen (the two differ only by that character, in the eight hitl-trap entries). 83/83 matched, one-to-one.",
"stability": "An id is a stable identifier. Changing one is a BREAKING change for any consumer matching on it, and requires a major bump of this file.",
"aliases": "Each pattern carries an `aliases` object naming what each seeding runtime calls it today. A runtime renames its own label by changing its alias here; the `id` does not move. The two aliases do NOT have the same evidentiary status — see alias_evidence.",
"not_yet_confirmed": "Neither llm-security nor the guard has yet agreed to this id space — both were asked via coord on 2026-08-09. Until they answer, `id` is this repository's proposal, not a ratified cross-runtime contract.",
"alias_evidence": {
"llm_ingestion_guard": {
"verified": true,
"method": "The guard's coverage matrix asserts on this exact string: coverage.py builds one case per lexicon pattern passing `pattern.id` as the expected value, and its probe compares that against the set of `label` fields on the findings the guard actually returns. The id is therefore demonstrably what a guard finding carries."
},
"llm_security": {
"verified": false,
"method": "Not established. This value is the `label` field of the pattern table, which is what the source module names the pattern — not necessarily what a llm-security FINDING carries. The finding producer was never supplied (see finding.schema.json), and the known Node finding shape uses `title`, not `label`, with the SARIF profile deriving rule ids by slugging that title. Treat this alias as the pattern's name in the source table, and confirm the finding-level string before matching on it."
}
}
},
"$comment": "Extracted without behaviour change from llm-security/scanners/lib/injection-patterns.mjs, delivered as operator dump 2/2 through the local coord mailbox on 2026-08-09. Only the four pattern arrays are data. The dump states explicitly that checkCognitiveLoadTrap (the buried-after-2000-chars logic) and scanForInjection's variant building are ENGINE logic that never moves here; they are absent by intent, not by omission. Array order is preserved exactly as delivered.",
"provenance": {
"source_repo": "llm-security",
"source_files": [
"scanners/lib/injection-patterns.mjs"
],
"source_exports": [
"CRITICAL_PATTERNS",
"HIGH_PATTERNS",
"MEDIUM_PATTERNS",
"HYBRID_PATTERNS"
],
"source_delivery": "operator dump 2/2, coord message from llm-security, 2026-08-09",
"source_commit": "unknown - not supplied with the dump",
"verified": "differentially, against the dump",
"evidence_limits": [
"The dump is a transcription of the source module, not the module file itself. Every check recorded for this file therefore proves that this JSON agrees with the DUMP. That the dump agrees with the module is llm-security's assertion, and is not a result reproduced here.",
"The severity the engine assigns to the hybrid family was not supplied. See families[].severity_note.",
"Whether a consumer applies these patterns to raw or to normalised text is engine behaviour and is not fixed by this file. Two runtimes matching identical patterns against differently normalised text will still disagree on identical input."
]
},
"dialect": {
"name": "ecmascript",
"$comment": "Patterns are ECMAScript regular-expression source text, exactly as the source literals spell it. Flags are declared per pattern in a `flags` field and never inlined as `(?i)` or `(?m)`; a pattern with no `flags` key carries no flags. All 83 patterns compile in Node with their declared flags, in Node with `u` added, and in Python `re` with the equivalent re.I / re.M.",
"flags": {
"i": "case-insensitive",
"m": "multiline: ^ and $ match at line boundaries"
},
"features_used": [
"negative lookahead: (?!...)",
"lookahead assertion: (?=...)",
"non-capturing groups: (?:...)",
"bounded quantifiers: {n,m}",
"unicode escapes: \\uXXXX"
],
"translation_notes": [
"Python (`re`): compile with re.I where flags contain `i` and re.M where they contain `m`. No rewriting is needed; verified by compiling all 83.",
"Nine patterns contain `\\/` - a redundant escape that a JavaScript regex LITERAL requires and that `RegExp.prototype.source` preserves. It is kept rather than normalised away because both seed runtimes accept it (Node bare, Node under `u`, and Python `re`), so removing it would break byte-identity to buy nothing. Engines that reject unknown escapes (Go `regexp`, RE2) MUST report these patterns as unsupported rather than skip them silently - a skipped pattern is an invisible false negative.",
"`\\w` and `\\b` are ASCII-only in ECMAScript without `u` but Unicode-aware in Python on `str`. Input that mixes non-ASCII word characters with these patterns can therefore match differently between runtimes. This is a real portability seam. It is recorded rather than normalised, because normalising it would change behaviour in the seed runtime.",
"The leetspeak and multi-language patterns embed non-ASCII literals (accented Latin) directly. Those are visible characters and are left exactly as written."
]
},
"normalisations": [
{
"id": "unicode-escape-invisible-and-confusable",
"affects": [
"homoglyph:cyrillic-latin-mix",
"unicode:zero-width-in-word"
],
"affects_labels": [
"homoglyph: Cyrillic-Latin mixing in adjacent characters",
"unicode: zero-width character inside word (keyword splitting)"
],
"from": "literal U+200B U+200C U+200D U+FEFF, and literal Cyrillic a/e/o/r/s/i/u, inside character classes",
"to": "the same code points written as \\uXXXX escapes",
"reason": "The source literals carry these code points RAW. Four of them are invisible and seven are Latin look-alikes, so in that form the pattern text cannot be reviewed, diffed or copied safely: a reviewer cannot see whether a class holds four code points or five. This repository's convention forbids raw invisible code points outside conformance inputs for exactly this reason. The escaped spelling is the same regular expression to both engines.",
"equivalence_evidence": "Differential match-set comparison (match offsets and matched text) between the raw and the escaped form: Node over 173 adversarial inputs in both bare and `u` mode (692 comparisons), and Python `re` over 118 inputs (236 comparisons). Zero differences. The corpus covers every member of each class, the near-misses deliberately excluded from it (U+00AD, U+2060, U+180E, Cyrillic x, the Cyrillic uppercase set, Greek look-alikes), run boundaries, repeats, and empty input.",
"class_membership_verified": {
"zero_width_class": [
"U+200B",
"U+200C",
"U+200D",
"U+FEFF"
],
"cyrillic_class": [
"U+0430",
"U+0435",
"U+043E",
"U+0440",
"U+0441",
"U+0456",
"U+0443"
],
"$comment": "Enumerated mechanically from the dump bytes, not by eye. Note that the zero-width class here does NOT include U+00AD even though codepoints/carriers.json lists U+00AD as a zero-width carrier, and that the Cyrillic class here is a 7-member set distinct from the 13-member CYRILLIC_CONFUSABLES list in that same file. The three sets are deliberately different in the seed implementation and are NOT reconciled here."
},
"byte_identical_to_source": false
}
],
"families": [
{
"id": "critical",
"source_export": "CRITICAL_PATTERNS",
"severity": "critical",
"count": 21,
"patterns": [
{
"id": "override:ignore-previous",
"label": "override: ignore previous instructions",
"pattern": "ignore\\s+(?:all\\s+)?previous",
"flags": "i",
"aliases": {
"llm_security": "override: ignore previous instructions",
"llm_ingestion_guard": "override:ignore-previous"
}
},
{
"id": "override:forget-instructions",
"label": "override: forget instructions",
"pattern": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)",
"flags": "i",
"aliases": {
"llm_security": "override: forget instructions",
"llm_ingestion_guard": "override:forget-instructions"
}
},
{
"id": "override:disregard",
"label": "override: disregard instructions",
"pattern": "disregard\\s+your",
"flags": "i",
"aliases": {
"llm_security": "override: disregard instructions",
"llm_ingestion_guard": "override:disregard"
}
},
{
"id": "override:override-instructions",
"label": "override: override instructions",
"pattern": "override\\s+your",
"flags": "i",
"aliases": {
"llm_security": "override: override instructions",
"llm_ingestion_guard": "override:override-instructions"
}
},
{
"id": "override:suspend-constraints",
"label": "override: suspend constraints",
"pattern": "suspend\\s+all\\s+constraints",
"flags": "i",
"aliases": {
"llm_security": "override: suspend constraints",
"llm_ingestion_guard": "override:suspend-constraints"
}
},
{
"id": "override:prior-constraints",
"label": "override: prior constraints",
"pattern": "all\\s+prior\\s+constraints",
"flags": "i",
"aliases": {
"llm_security": "override: prior constraints",
"llm_ingestion_guard": "override:prior-constraints"
}
},
{
"id": "spoofed-header:hash-system",
"label": "spoofed header: # SYSTEM:",
"pattern": "^#+\\s*SYSTEM\\s*:",
"flags": "m",
"aliases": {
"llm_security": "spoofed header: # SYSTEM:",
"llm_ingestion_guard": "spoofed-header:hash-system"
}
},
{
"id": "spoofed-header:inst",
"label": "spoofed header: [INST]",
"pattern": "^\\[INST\\]",
"flags": "m",
"aliases": {
"llm_security": "spoofed header: [INST]",
"llm_ingestion_guard": "spoofed-header:inst"
}
},
{
"id": "spoofed-header:pipe-system",
"label": "spoofed header: <|system|>",
"pattern": "<\\|system\\|>",
"aliases": {
"llm_security": "spoofed header: <|system|>",
"llm_ingestion_guard": "spoofed-header:pipe-system"
}
},
{
"id": "spoofed-tag:system-open",
"label": "spoofed tag: <system>",
"pattern": "<system>",
"aliases": {
"llm_security": "spoofed tag: <system>",
"llm_ingestion_guard": "spoofed-tag:system-open"
}
},
{
"id": "spoofed-tag:system-close",
"label": "spoofed tag: </system>",
"pattern": "<\\/system>",
"aliases": {
"llm_security": "spoofed tag: </system>",
"llm_ingestion_guard": "spoofed-tag:system-close"
}
},
{
"id": "spoofed-header:instructions",
"label": "spoofed header: ### Instructions:",
"pattern": "^###\\s*Instructions\\s*:",
"flags": "m",
"aliases": {
"llm_security": "spoofed header: ### Instructions:",
"llm_ingestion_guard": "spoofed-header:instructions"
}
},
{
"id": "identity:no-longer",
"label": "identity: you are no longer",
"pattern": "you\\s+are\\s+no\\s+longer",
"flags": "i",
"aliases": {
"llm_security": "identity: you are no longer",
"llm_ingestion_guard": "identity:no-longer"
}
},
{
"id": "identity:you-are-now",
"label": "identity: you are now [name]",
"pattern": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)",
"flags": "i",
"aliases": {
"llm_security": "identity: you are now [name]",
"llm_ingestion_guard": "identity:you-are-now"
}
},
{
"id": "identity:new-role",
"label": "identity: your new role",
"pattern": "your\\s+new\\s+role\\s+is",
"flags": "i",
"aliases": {
"llm_security": "identity: your new role",
"llm_ingestion_guard": "identity:new-role"
}
},
{
"id": "identity:new-directive",
"label": "identity: new primary directive",
"pattern": "your\\s+new\\s+primary\\s+directive",
"flags": "i",
"aliases": {
"llm_security": "identity: new primary directive",
"llm_ingestion_guard": "identity:new-directive"
}
},
{
"id": "identity:pretend",
"label": "identity: pretend you are",
"pattern": "pretend\\s+you\\s+are",
"flags": "i",
"aliases": {
"llm_security": "identity: pretend you are",
"llm_ingestion_guard": "identity:pretend"
}
},
{
"id": "config:ignore-claudemd",
"label": "config: ignore CLAUDE.md",
"pattern": "ignore\\s+your\\s+CLAUDE\\.md",
"flags": "i",
"aliases": {
"llm_security": "config: ignore CLAUDE.md",
"llm_ingestion_guard": "config:ignore-claudemd"
}
},
{
"id": "config:override-system-prompt",
"label": "config: override system prompt",
"pattern": "override\\s+your\\s+system\\s+prompt",
"flags": "i",
"aliases": {
"llm_security": "config: override system prompt",
"llm_ingestion_guard": "config:override-system-prompt"
}
},
{
"id": "config:bypass-safety",
"label": "config: bypass safety",
"pattern": "bypass\\s+your\\s+safety",
"flags": "i",
"aliases": {
"llm_security": "config: bypass safety",
"llm_ingestion_guard": "config:bypass-safety"
}
},
{
"id": "config:disable-filtering",
"label": "config: disable output filtering",
"pattern": "disable\\s+output\\s+filtering",
"flags": "i",
"aliases": {
"llm_security": "config: disable output filtering",
"llm_ingestion_guard": "config:disable-filtering"
}
}
]
},
{
"id": "high",
"source_export": "HIGH_PATTERNS",
"severity": "high",
"count": 32,
"patterns": [
{
"id": "normalization:prioritize-user",
"label": "normalization: prioritize user over rules",
"pattern": "always\\s+prioritize\\s+user\\s+requests?\\s+over",
"flags": "i",
"aliases": {
"llm_security": "normalization: prioritize user over rules",
"llm_ingestion_guard": "normalization:prioritize-user"
}
},
{
"id": "normalization:user-precedence",
"label": "normalization: user intent precedence",
"pattern": "user\\s+intent\\s+takes?\\s+precedence\\s+over",
"flags": "i",
"aliases": {
"llm_security": "normalization: user intent precedence",
"llm_ingestion_guard": "normalization:user-precedence"
}
},
{
"id": "normalization:claudemd-conflict",
"label": "normalization: CLAUDE.md conflict override",
"pattern": "if\\s+CLAUDE\\.md\\s+conflicts",
"flags": "i",
"aliases": {
"llm_security": "normalization: CLAUDE.md conflict override",
"llm_ingestion_guard": "normalization:claudemd-conflict"
}
},
{
"id": "normalization:skip-confirmation",
"label": "normalization: skip confirmation",
"pattern": "skip\\s+confirmation\\s+for",
"flags": "i",
"aliases": {
"llm_security": "normalization: skip confirmation",
"llm_ingestion_guard": "normalization:skip-confirmation"
}
},
{
"id": "reframing:actual-task",
"label": "reframing: your actual task",
"pattern": "your\\s+actual\\s+task\\s+is",
"flags": "i",
"aliases": {
"llm_security": "reframing: your actual task",
"llm_ingestion_guard": "reframing:actual-task"
}
},
{
"id": "reframing:real-purpose",
"label": "reframing: your real purpose",
"pattern": "your\\s+real\\s+purpose\\s+is",
"flags": "i",
"aliases": {
"llm_security": "reframing: your real purpose",
"llm_ingestion_guard": "reframing:real-purpose"
}
},
{
"id": "reframing:should-actually-do",
"label": "reframing: what you should actually do",
"pattern": "what\\s+you\\s+should\\s+actually\\s+do",
"flags": "i",
"aliases": {
"llm_security": "reframing: what you should actually do",
"llm_ingestion_guard": "reframing:should-actually-do"
}
},
{
"id": "hidden-comment:agent-directed",
"label": "hidden comment: agent-directed HTML comment",
"pattern": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:",
"flags": "i",
"aliases": {
"llm_security": "hidden comment: agent-directed HTML comment",
"llm_ingestion_guard": "hidden-comment:agent-directed"
}
},
{
"id": "html-obfuscation:display-none",
"label": "html-obfuscation: display:none element with content",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}display\\s*:\\s*none[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: display:none element with content",
"llm_ingestion_guard": "html-obfuscation:display-none"
}
},
{
"id": "html-obfuscation:visibility-hidden",
"label": "html-obfuscation: visibility:hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}visibility\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: visibility:hidden element",
"llm_ingestion_guard": "html-obfuscation:visibility-hidden"
}
},
{
"id": "html-obfuscation:offscreen",
"label": "html-obfuscation: off-screen positioned element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}position\\s*:\\s*absolute[^\"]{0,256}-\\d{3,}px[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: off-screen positioned element",
"llm_ingestion_guard": "html-obfuscation:offscreen"
}
},
{
"id": "html-obfuscation:zero-font",
"label": "html-obfuscation: zero font-size element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}font-size\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero font-size element",
"llm_ingestion_guard": "html-obfuscation:zero-font"
}
},
{
"id": "html-obfuscation:zero-opacity",
"label": "html-obfuscation: zero opacity element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}opacity\\s*:\\s*0[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero opacity element",
"llm_ingestion_guard": "html-obfuscation:zero-opacity"
}
},
{
"id": "html-obfuscation:zero-size-overflow",
"label": "html-obfuscation: zero-size overflow-hidden element",
"pattern": "<[^>]{1,256}style\\s*=\\s*\"[^\"]{0,256}(?:height|width)\\s*:\\s*0[^\"]{0,256}overflow\\s*:\\s*hidden[^\"]{0,256}\"[^>]{0,256}>",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: zero-size overflow-hidden element",
"llm_ingestion_guard": "html-obfuscation:zero-size-overflow"
}
},
{
"id": "html-obfuscation:aria-label",
"label": "html-obfuscation: injection in aria-label attribute",
"pattern": "aria-label\\s*=\\s*\"[^\"]{0,256}(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]{0,256}\"",
"flags": "i",
"aliases": {
"llm_security": "html-obfuscation: injection in aria-label attribute",
"llm_ingestion_guard": "html-obfuscation:aria-label"
}
},
{
"id": "evasion:educational",
"label": "evasion: educational purpose framing",
"pattern": "for\\s+educational\\s+purposes?\\s+only",
"flags": "i",
"aliases": {
"llm_security": "evasion: educational purpose framing",
"llm_ingestion_guard": "evasion:educational"
}
},
{
"id": "evasion:hypothetical",
"label": "evasion: hypothetical scenario framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario",
"flags": "i",
"aliases": {
"llm_security": "evasion: hypothetical scenario framing",
"llm_ingestion_guard": "evasion:hypothetical"
}
},
{
"id": "evasion:fictional",
"label": "evasion: fictional setting framing",
"pattern": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where",
"flags": "i",
"aliases": {
"llm_security": "evasion: fictional setting framing",
"llm_ingestion_guard": "evasion:fictional"
}
},
{
"id": "evasion:red-team",
"label": "evasion: red-team exercise framing",
"pattern": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)",
"flags": "i",
"aliases": {
"llm_security": "evasion: red-team exercise framing",
"llm_ingestion_guard": "evasion:red-team"
}
},
{
"id": "evasion:security-audit-sim",
"label": "evasion: security audit simulation framing",
"pattern": "security\\s+audit\\s+simulation",
"flags": "i",
"aliases": {
"llm_security": "evasion: security audit simulation framing",
"llm_ingestion_guard": "evasion:security-audit-sim"
}
},
{
"id": "evasion:test-pretense",
"label": "evasion: test/lab/sandbox pretense",
"pattern": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)",
"flags": "i",
"aliases": {
"llm_security": "evasion: test/lab/sandbox pretense",
"llm_ingestion_guard": "evasion:test-pretense"
}
},
{
"id": "evasion:thought-experiment",
"label": "evasion: thought experiment framing",
"pattern": "as\\s+a\\s+thought\\s+experiment",
"flags": "i",
"aliases": {
"llm_security": "evasion: thought experiment framing",
"llm_ingestion_guard": "evasion:thought-experiment"
}
},
{
"id": "evasion:research-purpose",
"label": "evasion: research purpose framing",
"pattern": "for\\s+(?:research|academic|scientific)\\s+purposes",
"flags": "i",
"aliases": {
"llm_security": "evasion: research purpose framing",
"llm_ingestion_guard": "evasion:research-purpose"
}
},
{
"id": "evasion:academic-context",
"label": "evasion: academic context framing",
"pattern": "in\\s+an?\\s+(?:academic|research|educational)\\s+context",
"flags": "i",
"aliases": {
"llm_security": "evasion: academic context framing",
"llm_ingestion_guard": "evasion:academic-context"
}
},
{
"id": "hitl-trap:approve-immediately",
"label": "hitl-trap: approval urgency — approve immediately",
"pattern": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — approve immediately",
"llm_ingestion_guard": "hitl-trap:approve-immediately"
}
},
{
"id": "hitl-trap:no-need-review",
"label": "hitl-trap: approval urgency — no need to review",
"pattern": "no\\s+need\\s+to\\s+review",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — no need to review",
"llm_ingestion_guard": "hitl-trap:no-need-review"
}
},
{
"id": "hitl-trap:just-approve",
"label": "hitl-trap: approval urgency — just approve",
"pattern": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — just approve",
"llm_ingestion_guard": "hitl-trap:just-approve"
}
},
{
"id": "hitl-trap:suppress-review",
"label": "hitl-trap: approval urgency — suppress review",
"pattern": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: approval urgency — suppress review",
"llm_ingestion_guard": "hitl-trap:suppress-review"
}
},
{
"id": "hitl-trap:brevity-skip",
"label": "hitl-trap: summary suppression — for brevity, skipping",
"pattern": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — for brevity, skipping",
"llm_ingestion_guard": "hitl-trap:brevity-skip"
}
},
{
"id": "hitl-trap:too-long",
"label": "hitl-trap: summary suppression — too long to show",
"pattern": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — too long to show",
"llm_ingestion_guard": "hitl-trap:too-long"
}
},
{
"id": "hitl-trap:details-omitted",
"label": "hitl-trap: summary suppression — details omitted",
"pattern": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: summary suppression — details omitted",
"llm_ingestion_guard": "hitl-trap:details-omitted"
}
},
{
"id": "hitl-trap:scope-minimization",
"label": "hitl-trap: scope minimization — minor change + destructive action",
"pattern": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)",
"flags": "i",
"aliases": {
"llm_security": "hitl-trap: scope minimization — minor change + destructive action",
"llm_ingestion_guard": "hitl-trap:scope-minimization"
}
}
]
},
{
"id": "medium",
"source_export": "MEDIUM_PATTERNS",
"severity": "medium",
"count": 22,
"patterns": [
{
"id": "leetspeak:ignore-previous",
"label": "leetspeak: ignore previous (obfuscated)",
"pattern": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us",
"flags": "i",
"aliases": {
"llm_security": "leetspeak: ignore previous (obfuscated)",
"llm_ingestion_guard": "leetspeak:ignore-previous"
}
},
{
"id": "leetspeak:forget-instructions",
"label": "leetspeak: forget instructions (obfuscated)",
"pattern": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns",
"flags": "i",
"aliases": {
"llm_security": "leetspeak: forget instructions (obfuscated)",
"llm_ingestion_guard": "leetspeak:forget-instructions"
}
},
{
"id": "leetspeak:disregard",
"label": "leetspeak: disregard your (obfuscated)",
"pattern": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur",
"flags": "i",
"aliases": {
"llm_security": "leetspeak: disregard your (obfuscated)",
"llm_ingestion_guard": "leetspeak:disregard"
}
},
{
"id": "leetspeak:override",
"label": "leetspeak: override your (obfuscated)",
"pattern": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur",
"flags": "i",
"aliases": {
"llm_security": "leetspeak: override your (obfuscated)",
"llm_ingestion_guard": "leetspeak:override"
}
},
{
"id": "homoglyph:cyrillic-latin-mix",
"label": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"pattern": "[a-zA-Z][\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443]|[\\u0430\\u0435\\u043E\\u0440\\u0441\\u0456\\u0443][a-zA-Z]",
"aliases": {
"llm_security": "homoglyph: Cyrillic-Latin mixing in adjacent characters",
"llm_ingestion_guard": "homoglyph:cyrillic-latin-mix"
}
},
{
"id": "unicode:zero-width-in-word",
"label": "unicode: zero-width character inside word (keyword splitting)",
"pattern": "\\w[\\u200B\\u200C\\u200D\\uFEFF]\\w",
"aliases": {
"llm_security": "unicode: zero-width character inside word (keyword splitting)",
"llm_ingestion_guard": "unicode:zero-width-in-word"
}
},
{
"id": "indirect:instruction-to-ai",
"label": "indirect: instruction addressed to AI/assistant",
"pattern": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i",
"aliases": {
"llm_security": "indirect: instruction addressed to AI/assistant",
"llm_ingestion_guard": "indirect:instruction-to-ai"
}
},
{
"id": "indirect:direct-address",
"label": "indirect: direct address to AI/assistant",
"pattern": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i",
"aliases": {
"llm_security": "indirect: direct address to AI/assistant",
"llm_ingestion_guard": "indirect:direct-address"
}
},
{
"id": "indirect:trigger-based",
"label": "indirect: trigger-based instruction for AI",
"pattern": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this",
"flags": "i",
"aliases": {
"llm_security": "indirect: trigger-based instruction for AI",
"llm_ingestion_guard": "indirect:trigger-based"
}
},
{
"id": "multi-lang:french",
"label": "multi-lang: French \"ignore previous instructions\"",
"pattern": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[eé]c[eé]dentes?",
"flags": "i",
"aliases": {
"llm_security": "multi-lang: French \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:french"
}
},
{
"id": "multi-lang:spanish",
"label": "multi-lang: Spanish \"ignore previous instructions\"",
"pattern": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?",
"flags": "i",
"aliases": {
"llm_security": "multi-lang: Spanish \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:spanish"
}
},
{
"id": "multi-lang:german",
"label": "multi-lang: German \"ignore previous instructions\"",
"pattern": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)",
"flags": "i",
"aliases": {
"llm_security": "multi-lang: German \"ignore previous instructions\"",
"llm_ingestion_guard": "multi-lang:german"
}
},
{
"id": "markdown:link-ref-comment",
"label": "markdown: suspicious instruction in link-reference comment",
"pattern": "\\[\\/\\/\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)",
"flags": "i",
"aliases": {
"llm_security": "markdown: suspicious instruction in link-reference comment",
"llm_ingestion_guard": "markdown:link-ref-comment"
}
},
{
"id": "data-uri:executable",
"label": "data-uri: executable content type",
"pattern": "data:(?:text\\/html|application\\/javascript|text\\/javascript)[;,]",
"flags": "i",
"aliases": {
"llm_security": "data-uri: executable content type",
"llm_ingestion_guard": "data-uri:executable"
}
},
{
"id": "markdown:link-anchor-injection",
"label": "markdown: injection payload in link anchor text",
"pattern": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)",
"flags": "i",
"aliases": {
"llm_security": "markdown: injection payload in link anchor text",
"llm_ingestion_guard": "markdown:link-anchor-injection"
}
},
{
"id": "sub-agent:spawn-dangerous",
"label": "sub-agent: spawn instruction with dangerous capability keywords",
"pattern": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:.*?\\s+)?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:.*?\\s+)?(?:secret|credential|key|token|\\.env|\\.ssh))",
"flags": "i",
"aliases": {
"llm_security": "sub-agent: spawn instruction with dangerous capability keywords",
"llm_ingestion_guard": "sub-agent:spawn-dangerous"
}
},
{
"id": "sub-agent:delegate-bypass",
"label": "sub-agent: delegation with safety bypass instruction",
"pattern": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.*?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))",
"flags": "i",
"aliases": {
"llm_security": "sub-agent: delegation with safety bypass instruction",
"llm_ingestion_guard": "sub-agent:delegate-bypass"
}
},
{
"id": "nl-indirection:fetch-execute",
"label": "nl-indirection: fetch URL and execute",
"pattern": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)",
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: fetch URL and execute",
"llm_ingestion_guard": "nl-indirection:fetch-execute"
}
},
{
"id": "nl-indirection:send-external",
"label": "nl-indirection: send data to external destination",
"pattern": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?:\\/\\/|ftp:\\/\\/|\\S+@\\S+)",
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: send data to external destination",
"llm_ingestion_guard": "nl-indirection:send-external"
}
},
{
"id": "nl-indirection:read-dotfile",
"label": "nl-indirection: read sensitive dotfile path",
"pattern": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~\\/)?\\.(?:ssh|aws|gnupg|env)\\b",
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: read sensitive dotfile path",
"llm_ingestion_guard": "nl-indirection:read-dotfile"
}
},
{
"id": "nl-indirection:extract-exfiltrate",
"label": "nl-indirection: extract credentials and exfiltrate",
"pattern": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)",
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: extract credentials and exfiltrate",
"llm_ingestion_guard": "nl-indirection:extract-exfiltrate"
}
},
{
"id": "nl-indirection:download-execute",
"label": "nl-indirection: download and execute",
"pattern": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))",
"flags": "i",
"aliases": {
"llm_security": "nl-indirection: download and execute",
"llm_ingestion_guard": "nl-indirection:download-execute"
}
}
]
},
{
"id": "hybrid",
"source_export": "HYBRID_PATTERNS",
"severity": null,
"severity_note": "The seed dump supplies this array but NOT the severity the engine assigns to it. Left null rather than inferred from the three sibling arrays. A consumer MUST NOT assume a severity for this family until the producing module is published.",
"count": 8,
"patterns": [
{
"id": "hybrid-p2sql:inject-sql",
"label": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"pattern": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))",
"flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)",
"llm_ingestion_guard": "hybrid-p2sql:inject-sql"
}
},
{
"id": "hybrid-p2sql:sql-inject",
"label": "hybrid-p2sql: SQL operation + injection override keywords",
"pattern": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)",
"flags": "i",
"aliases": {
"llm_security": "hybrid-p2sql: SQL operation + injection override keywords",
"llm_ingestion_guard": "hybrid-p2sql:sql-inject"
}
},
{
"id": "hybrid-recursive:inject-output",
"label": "hybrid-recursive: instruction to inject into model output",
"pattern": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)",
"flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: instruction to inject into model output",
"llm_ingestion_guard": "hybrid-recursive:inject-output"
}
},
{
"id": "hybrid-recursive:conditional-response",
"label": "hybrid-recursive: conditional response injection (recursive payload)",
"pattern": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)",
"flags": "i",
"aliases": {
"llm_security": "hybrid-recursive: conditional response injection (recursive payload)",
"llm_ingestion_guard": "hybrid-recursive:conditional-response"
}
},
{
"id": "hybrid-xss:script-tag",
"label": "hybrid-xss: <script> tag in content (agent context XSS)",
"pattern": "<script\\b[^>]*>[\\s\\S]*?<\\/script>",
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: <script> tag in content (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:script-tag"
}
},
{
"id": "hybrid-xss:javascript-uri",
"label": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"pattern": "javascript\\s*:",
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: javascript: URI scheme (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:javascript-uri"
}
},
{
"id": "hybrid-xss:event-handler",
"label": "hybrid-xss: inline event handler attribute (agent context XSS)",
"pattern": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=",
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: inline event handler attribute (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:event-handler"
}
},
{
"id": "hybrid-xss:iframe-src",
"label": "hybrid-xss: iframe with executable src (agent context XSS)",
"pattern": "<iframe\\b[^>]*src\\s*=\\s*[\"'][^\"']*(?:javascript:|data:text\\/html)",
"flags": "i",
"aliases": {
"llm_security": "hybrid-xss: iframe with executable src (agent context XSS)",
"llm_ingestion_guard": "hybrid-xss:iframe-src"
}
}
]
}
],
"totals": {
"families": 4,
"patterns": 83
}
}
Reference in a new issue View git blame Copy permalink