llm-trust-guard 4.20.0 → 4.20.1

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to `llm-trust-guard` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.20.1] - 2026-04-24
+
+### Changed — Documentation accuracy
+
+- **README**: Removed "31 → 34 security guards" inconsistency (was contradicting the All 34 Guards table and `package.json`)
+- **README**: Removed unmeasured "<5ms latency" assertion from intro
+- **README**: Removed unmeasured "~97% on curated benchmarks" framing from "What it catches well"
+- **README**: Qualified the four "100% detection" claims (Policy Puppetry, Role-play, PAP, Multilingual) as "100% on unit tests" with a section preface explaining that these are unit-test rates, not corpus measurements. Broader corpus measurements live in [RESULTS-v4.19.0.md](tests/adversarial/RESULTS-v4.19.0.md)
+- **README**: Added Homoglyph attacks bullet to "What it catches well" (parity with Python README; feature exists in `encoding-detector`, `prompt-leakage-guard`, `multimodal-guard`, `memory-guard`)
+- **README**: Added v4.20.0 MCP Sampling detection note in Measured Performance preface; benchmark numbers apply unchanged because Sampling is orthogonal to the Sanitizer+Encoder pipelines benchmarked
+
+No code changes. Same 711 tests pass.
+
 ## [4.20.0] - 2026-04-24
 
 ### Added — MCP Sampling Attack Detection (Unit42 + Blueinfy, Feb 2026)

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/llm-trust-guard.svg)](https://www.npmjs.com/package/llm-trust-guard)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-**31 security guards for LLM-powered and agentic AI applications.** Zero dependencies. <5ms latency. Covers OWASP Top 10 for LLMs 2025, OWASP Agentic AI 2026, and MCP Security.
+**34 security guards for LLM-powered and agentic AI applications.** Zero dependencies. Covers OWASP Top 10 for LLMs 2025, OWASP Agentic AI 2026, and MCP Security.
 
 Also available as a [Python package on PyPI](https://pypi.org/project/llm-trust-guard/) (`pip install llm-trust-guard`).
 
@@ -13,13 +13,17 @@ Also available as a [Python package on PyPI](https://pypi.org/project/llm-trust-
 
 This package is your **first line of defense** — like a WAF (Web Application Firewall) for LLM applications. It sits in the orchestration layer and catches known attack patterns before they reach the LLM and after the LLM responds.
 
-### What it catches well (~97% on curated benchmarks)
+### What it catches well
+
+Per-category detection rates below are measured against the package's curated unit-test suite (representative attack samples per category). On broader held-out corpora these rates are typically lower — see [tests/adversarial/RESULTS-v4.19.0.md](tests/adversarial/RESULTS-v4.19.0.md) for measured detection on attack corpora and [Known limitations](#what-it-catches-partially-50-80-detection) below.
+
 - Known prompt injection phrases (170+ patterns, 11 languages)
 - Encoding bypass attacks (9 formats: Base64, URL, Unicode, Hex, HTML, ROT13, Octal, Base32, mixed)
-- Policy Puppetry attacks (JSON/INI/XML/YAML-formatted injection) — 100% detection
-- Role-play/persona attacks (translator trick, academic pretext, emotional manipulation) — 100% detection
-- PAP/persuasion attacks (authority, urgency, emotional manipulation) — 100% detection
-- Multilingual injection (10 languages) — 100% detection
+- Policy Puppetry attacks (JSON/INI/XML/YAML-formatted injection) — 100% on unit tests
+- Role-play/persona attacks (translator trick, academic pretext, emotional manipulation) — 100% on unit tests
+- PAP/persuasion attacks (authority, urgency, emotional manipulation) — 100% on unit tests
+- Multilingual injection (10 languages) — 100% on unit tests
+- Homoglyph attacks (Cyrillic/Greek character substitution) — normalized and detected
 - PII and secret leakage in outputs
 - Tool hallucination, RBAC bypass, multi-tenant violations
 - Tool result poisoning, context window stuffing
@@ -224,7 +228,7 @@ const output = guard.filterOutput(llmResponse, session.role);
 
 ## Measured Performance
 
-v4.19.0 benchmark, 2026-04-23. Full methodology, 95% confidence intervals, hand-adjudication labels, and reproducibility scripts: [tests/adversarial/RESULTS-v4.19.0.md](tests/adversarial/RESULTS-v4.19.0.md).
+v4.19.0 benchmark, 2026-04-23. v4.20.0 added MCP Sampling attack detection (see [CHANGELOG.md](CHANGELOG.md)) — orthogonal to the Sanitizer+Encoder pipelines below, so numbers apply unchanged. Full methodology, 95% confidence intervals, hand-adjudication labels, and reproducibility scripts: [tests/adversarial/RESULTS-v4.19.0.md](tests/adversarial/RESULTS-v4.19.0.md).
 
 **Attack detection on prior-published corpora** (Giskard n=35, Compass CTF Chinese n=11): detection rate has not moved from v4.13.5 → v4.19.0 on the Sanitizer+Encoder pipeline — 80.00% and 9.09% respectively, identical to the v4.13.5 numbers. Six releases of pattern additions (v4.14–v4.19) targeted different attack classes (indirect injection, tool-result validation, memory persistence, multi-agent trust) that these direct-text jailbreak corpora do not exercise. Small sample sizes mean "no evidence of improvement," not "proof of no improvement."
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-trust-guard",
-  "version": "4.20.0",
+  "version": "4.20.1",
   "description": "Comprehensive security guards for LLM-powered and agentic AI applications - 34 guards covering OWASP Top 10 for LLMs 2025, Agentic Applications 2026, and MCP Security. All guards accessible via unified TrustGuard facade. Features prompt injection (PAP/persuasion), multi-modal attacks, RAG poisoning with embedding attack detection, memory persistence attacks, code execution sandboxing, multi-agent security (spawn policy, delegation scope, trust transitivity), MCP tool shadowing prevention, system prompt leakage protection, human-agent trust exploitation (ASI09), autonomy escalation (ASI10), state persistence (ASI08), tool chain validation v2 (ASI07/ASI04), circuit breaker, drift detection, and more",
   "main": "dist/index.js",
   "module": "dist/index.mjs",