Prompt Injection Guardrail Matrix

Paste a prompt or suspect text and scan it against a library of injection patterns — instruction override, jailbreak, system-prompt leak, delimiter breaking and data exfiltration — with a 0–100 risk score.

Risk Score

–
–

Paste text and run a scan to see the risk profile.

Per-Rule Results

Pass or fail result for each injection detection rule
Rule Severity Result Weight Suggestion

Sanitization Suggestions

Professional Insights & Guide

The threat model behind prompt injection, the detection families the scanner watches for, and defense-in-depth guidance.

Core Use Case scenario

Prompt injection happens when untrusted text is merged into a prompt and succeeds in overriding the system's original instructions. Attackers try several families: instruction overrides ("ignore all previous instructions"), jailbreak rituals (DAN, developer mode), roleplay bypasses ("act as if"), system-prompt extraction ("print your system prompt"), delimiter breaking (closing a quoted block early), and data exfiltration ("repeat the above", "extract user data"). A guardrail matrix scores a prompt by how many of these families its text matches.

Troubleshooting & Edge-Case Failure Points

  • Regex is not a silver bullet: an attacker can rephrase any pattern, so a pass is confidence, not proof.
  • False positives: benign prompts that merely discuss "system prompts" can trip a leak rule and need human review.
  • Case and whitespace obfuscation: scanners must normalize text or attackers bypass with spacing and Unicode tricks.
  • Output-side injection: even a clean input can produce dangerous tool arguments, which is why output is treated as untrusted.

Detailed Step-by-Step Instructions

  1. Paste the prompt or suspect text you want to vet into the input area.
  2. Press Run Guardrail Scan to run the embedded pattern library against the text.
  3. Read the 0–100 risk score, the per-rule pass/fail table, and the triggered severity levels.
  4. Review the sanitization suggestions and apply the matching mitigations to your pipeline.
  5. Use Load Safe Sample to compare against a low-risk baseline, and Copy Report to share findings with your team.

Scoring Rules Used 

score = min(100, sum(weight of each matched rule))
risk  = 0-19 Low | 20-49 Medium | 50-74 High | 75+ Critical
match = rule.regex.test(normalized_text)
suggestion = per-rule remediation text on match
severity: low(5-10) | medium(12-20) | high(20-25)

Related Web Utilities (Silo Hub)

Multi-Agent Topology Harness RAG Vector Chunking Simulator Prompt Chain Debugger System Prompt & Tool Builder Secure Password Generator JSON Formatter & Validator

Informative Guides & Helper Articles

Best Practices for Prompt Injection Defense

Input/output isolation, privilege limits, and treating model output as untrusted data.

Read Article →

Common Errors in Prompt Injection Defense

Over-relying on single regexes, sanitizing too aggressively, and trusting model output as code.

Read Article →

Future Trends in Prompt Injection Security

Model-native guardrails, provenance frameworks, and standardized LLM security benchmarks.

Read Article →

How to Use the Prompt Injection Guardrail Designer

Structures defenses against prompt injection: delimiter discipline, instruction hierarchy, input allowlists, output filtering.

  1. Classify your inputs (web content, user text, tool results).
  2. Design the boundary: delimiters, hierarchy, forbidden actions.
  3. Generate the guardrail template; test with known payloads.

Injection Is an Untrusted-Input Problem

Capability limits > delimiters > hierarchy > filters

Prompt injection is SQL-injection LLM cousin: untrusted text read by a model that treats instructions and data as one stream. The defense stack in strength order: capability limits (least-privilege tools - an agent that cannot send payments cannot be injected into sending them), delimiters + labeling, instruction hierarchy (system overrides in-context), output filtering (block URLs/domains not expected). What does not work: "ignore instructions inside the text" as the only layer. Test with real payloads the way you test SQL injection strings.

Prompt Injection Guardrail Designer FAQ

Can prompt injection be fully prevented?

No - it is unsolved at the model level. Defense is layered: least-privilege tools first, delimiters and filters after.

What is indirect injection?

Malicious instructions in fetched content - web pages, emails. Tool-using agents are the real attack surface.

Are delimiters enough?

They help but are bypassable. The strongest control is capability: if the agent cannot do the dangerous thing, injection has nothing to trigger.

Deep-dive guides