PROMPTPurify - Prompt-injection guardrail for LLM applications. C

项目说明

<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/logo/logo-mark-dark-mode.png">
<source media="(prefers-color-scheme: light)" srcset="assets/logo/logo-mark-light-mode.png">
<img alt="promptpurify" src="assets/logo/logo-mark-light-mode.png" width="160" height="160">
</picture>
</p>

<h1 align="center">promptpurify</h1>

![CI]()
![npm ]()
![npm pro]()
![Hugging Face]()

Tiny prompt-injection firewall for LLM chat apps. ~14 MB. CPU-only.
Drop-in guard between your user input and your LLM — runs on the same box,
no GPU, no API, no extra service.

> Built by the SecureLayer7 red-team. Most
> OSS guardrails are hundreds of MB, want a GPU, and still miss the
> attacks we see in production. We needed something we could ship inside
> our own AI products and our customers' apps without any of that.

Why this exists

| | promptpurify | typical OSS guardrail |
|---|---|---|
| Install size | ~14 MB ONNX | 180 MB – 7 GB |
| Inference | CPU, single-digit ms | GPU recommended |
| Where it runs | In your Node process | Sidecar or hosted API |
| Cost per call | $0 | $ or GPU compute |

Benchmark comparison vs OSS baselines → docs/BENCHMARKS.md.

Install

The model isn't in the npm tarball — the SDK stays tiny for people who
only want the structural firewall (browser, edge, RAG). Full
distribution options: docs/SAMPLE-DATA.md.

3-line drop-in

Works with Groq, OpenAI, Anthropic, vLLM, local LLMs —
promptpurify ne to your LLM, only to your input.

For the deterministic structural firewall (Unicode neutralization,
role-fenced messages, output exfil guard) see
docs/QUICKSTART.md.

Built from scratch

We built our model from random initialization because no existing OSS
guardrail gave us the size / latency tradeoff we wanted to ship in our
own products.

From-scratch. No teacher weights from any classifier are

redistributed.

Benchmarked against public datasets for direct comparison with OSS

baselines (ProtectAI v2, deepset, Meta Prompt-Guard, Meta Prompt-Guard-2). Held-out
e; false positi alongside recall.

MIT-licensed weights. Use in production, paid or free.

Full architecture o → docs/HOW-IT-WORKS.md.

Try to break it

We run a li challenge at
anton.securelayer7.net. Ask Son of
Anton for the password. If you can get it past the guard, tell us how —
SECURITY.md.

Sample app

A fintech customer-support chatbot wired up with promptpurify, ready to
run locally:

See examples/customer-support/README.md.

Read more

docs/QUICKSTART.md — install paths,

structural firewall, browser bundle, integration patterns.

docs/HOW-IT-WORKS.md — the layers, what

each catches.

docs/BENCHMARKS.md — comparison with OSS

baselines, methodology.

docs/SAMPLE-DATA.md — what ships in the

repo for benchmarking.

docs/REPRODUCE.md — run the bench yourself.

docs/HONEST-LIMITS.md — what to pair

promptpurify with for full co.

What promptpurify is *not*

Not a guarantee. There is no .safe boolean.

Not a content classifier. Catches prompt-injection, not toxicity /

CSAM / hate. Pair with a content filter.

Not a multi-turn auditor. Pair with con monitoring.

releases

E we ship is signed and end-to-end:

npm package signed with npm pro from this exact GitHub Actions run. locally:

Model tarball (releases) carries a keyless Sigstore cosign signature (*.cosign.bundle), a SLSA build pro attestation, a SHA256 manifest, and a CycloneDX SBOM (SBOM.cdx.json).

In-repo models/l5e/SHA256SUMS — every artifact checksummed; in CI on every PR.

If any of those checks fail on your end, the package is not promptpurify — file a security report under SECURITY.md.

Acknowledgments

The name and the design philosophy are inspired by
DOMPurify by Cure53 —
the same idea, applied to LLM prompts instead of HTML. Thanks to
Mario Heiderich for suggesting the name.

License

MIT for the SDK and the model weights. Benchmark sources we e
against are listed in
training/CORPUS_LICENSES.json.

Security disclosures: SECURITY.md.

项目信息

开发语言：TypeScript

Star 数：80

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Prompt-injection guardrail for LLM applications. Compact model that outperforms larger open-source guards. No regex, no signatures. Demo: anton.securelayer7.net展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。