guardkit 0.2.0__tar.gz → 0.3.0__tar.gz

{guardkit-0.2.0 → guardkit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guardkit
-Version: 0.2.0
+Version: 0.3.0
 Summary: Offline guardrails for LLM apps: PII (incl. Aadhaar/PAN), secrets, prompt-injection classifier + rules, policy YAML, CLI
 Author: Ashish Dhillon
 License: MIT
@@ -96,6 +96,30 @@ at roughly 6% false alarms among flagged items, and it was trained on synthetic
 adversarial traffic. Use it as one cheap layer, not as your only defence. Retrain with your
 own labelled data via `scripts/train_injection.py`.
 
+## External evaluation (in-the-wild jailbreaks)
+
+The author-written sets above flatter the detector. On the public in-the-wild jailbreak
+dataset (Shen et al., CCS 2024; 1,405 jailbreak and 13,735 regular prompts) results are much
+weaker. `InjectionGuard(model="jailbreak")` is a second classifier trained on the earlier
+~65% of that data (temporal split, near-duplicates removed) and tested on the later part
+(5,497 prompts, 398 jailbreaks):
+
+| Detector | Recall | False-positive rate | Precision (7% prevalence) |
+|---|---|---|---|
+| regex rules | 0.05 | 0.026 | 0.13 |
+| jailbreak classifier, threshold 0.5 | 0.42 | 0.126 | 0.21 |
+| jailbreak classifier, threshold at 1% FPR on training negatives | 0.20 | 0.033 | 0.33 |
+
+Classifier AUC is 0.74. The default `model="injection"` classifier (synthetic training) is
+weaker still on this data (recall 0.31, FPR 0.12 zero-shot). Do not rely on guardkit's
+injection detection as a primary defence for user prompts. A full write-up is in
+`docs/technical-report.md`. Reproduce with `scripts/train_jailbreak.py` and
+`scripts/eval_external.py` (download the two CSVs from github.com/verazuo/jailbreak_llms).
+
+PII checksums: random 12-digit strings pass Verhoeff 9.9% of the time and random 16-digit strings
+pass Luhn 10.0% of the time, so checksum validation removes about 90% of numeric false
+positives. On 15,140 real prompts, 166 card-shaped digit strings shrank to 9 after Luhn.
+
 ## Honest limitations
 
 - Injection detection is statistical plus rules; a determined attacker can paraphrase around
@@ -106,6 +130,13 @@ own labelled data via `scripts/train_injection.py`.
 - The classifier was trained on synthetic data and evaluated on author-written examples.
 - The bundled HTTP service has no authentication or TLS. Run it behind your own gateway.
 
+## Related projects
+
+- [injection-bench](https://github.com/ashishdhillon/injection-bench): leakage-controlled benchmark that scored this
+  detector (`guardkit:rules`, `guardkit:model`) against baselines on real data.
+- [bharatid](https://github.com/ashishdhillon/bharatid): deeper Indian-ID validators (GSTIN, TAN, vehicle plates and more)
+  than the PII guard here.
+
 ## Develop
 
 ```bash

{guardkit-0.2.0 → guardkit-0.3.0}/README.md

@@ -77,6 +77,30 @@ at roughly 6% false alarms among flagged items, and it was trained on synthetic
 adversarial traffic. Use it as one cheap layer, not as your only defence. Retrain with your
 own labelled data via `scripts/train_injection.py`.
 
+## External evaluation (in-the-wild jailbreaks)
+
+The author-written sets above flatter the detector. On the public in-the-wild jailbreak
+dataset (Shen et al., CCS 2024; 1,405 jailbreak and 13,735 regular prompts) results are much
+weaker. `InjectionGuard(model="jailbreak")` is a second classifier trained on the earlier
+~65% of that data (temporal split, near-duplicates removed) and tested on the later part
+(5,497 prompts, 398 jailbreaks):
+
+| Detector | Recall | False-positive rate | Precision (7% prevalence) |
+|---|---|---|---|
+| regex rules | 0.05 | 0.026 | 0.13 |
+| jailbreak classifier, threshold 0.5 | 0.42 | 0.126 | 0.21 |
+| jailbreak classifier, threshold at 1% FPR on training negatives | 0.20 | 0.033 | 0.33 |
+
+Classifier AUC is 0.74. The default `model="injection"` classifier (synthetic training) is
+weaker still on this data (recall 0.31, FPR 0.12 zero-shot). Do not rely on guardkit's
+injection detection as a primary defence for user prompts. A full write-up is in
+`docs/technical-report.md`. Reproduce with `scripts/train_jailbreak.py` and
+`scripts/eval_external.py` (download the two CSVs from github.com/verazuo/jailbreak_llms).
+
+PII checksums: random 12-digit strings pass Verhoeff 9.9% of the time and random 16-digit strings
+pass Luhn 10.0% of the time, so checksum validation removes about 90% of numeric false
+positives. On 15,140 real prompts, 166 card-shaped digit strings shrank to 9 after Luhn.
+
 ## Honest limitations
 
 - Injection detection is statistical plus rules; a determined attacker can paraphrase around
@@ -87,6 +111,13 @@ own labelled data via `scripts/train_injection.py`.
 - The classifier was trained on synthetic data and evaluated on author-written examples.
 - The bundled HTTP service has no authentication or TLS. Run it behind your own gateway.
 
+## Related projects
+
+- [injection-bench](https://github.com/ashishdhillon/injection-bench): leakage-controlled benchmark that scored this
+  detector (`guardkit:rules`, `guardkit:model`) against baselines on real data.
+- [bharatid](https://github.com/ashishdhillon/bharatid): deeper Indian-ID validators (GSTIN, TAN, vehicle plates and more)
+  than the PII guard here.
+
 ## Develop
 
 ```bash

{guardkit-0.2.0 → guardkit-0.3.0}/guardkit/__init__.py

@@ -7,6 +7,6 @@ from .secrets import SecretsGuard
 from .injection import InjectionGuard
 from .content import TopicGuard, JSONGuard
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 __all__ = ["Finding", "Guard", "Result", "Pipeline", "Stage", "from_dict", "load",
            "PIIGuard", "SecretsGuard", "InjectionGuard", "TopicGuard", "JSONGuard"]

{guardkit-0.2.0 → guardkit-0.3.0}/guardkit/classifier.py

@@ -9,11 +9,12 @@ import zlib
 from .injection import normalise
 
 DIM = 1 << 16
+MAX_CHARS = 4000
 _TOK = re.compile(r"[^\W_]+(?:'[a-z]+)?", re.U)
 
 
 def featurize(text: str):
-    toks = _TOK.findall(normalise(text))
+    toks = _TOK.findall(normalise(text[:MAX_CHARS]))
     feats = {}
     grams = toks + [a + " " + b for a, b in zip(toks, toks[1:])]
     for g in grams:
@@ -37,8 +38,8 @@ class LogReg:
             json.dump({"dim": DIM, "b": self.b, "w": {str(k): round(v, 5) for k, v in self.w.items() if abs(v) > 1e-4}}, fh)
 
     @classmethod
-    def load(cls, path=None):
-        path = path or os.path.join(os.path.dirname(__file__), "data", "injection_lr.json")
+    def load(cls, path=None, name="injection"):
+        path = path or os.path.join(os.path.dirname(__file__), "data", f"{name}_lr.json")
         with open(path) as fh:
             d = json.load(fh)
         assert d["dim"] == DIM