Use codemap find "SymbolName" to locate any symbol before reading.

Input Sanitization for Prompt Injection Defense

Built-in: PromptInjectionFilter

Lauren-AI ships PromptInjectionFilter in lauren_ai._guardrails._builtin. It detects the most common injection patterns with compiled regexes:

# NOTE: future annotations are allowed, but tool signature types must resolve at import time.
from lauren_ai import agent, use_guardrails, PromptInjectionFilter

@agent(model="claude-opus-4-6", system="You are a helpful assistant.")
@use_guardrails(input=[PromptInjectionFilter()])
class SafeAgent: ...

Built-in patterns cover: ignore previous instructions, jailbreak, DAN, [system], ###instruction, <|im_start|>, system: you are, and more.

Custom injection guard with extended patterns

import re
from lauren_ai import guardrail
from lauren_ai._guardrails._base import GuardrailContext, GuardrailDecision

INJECTION_PATTERNS = [
    r"ignore\s+(previous|above|all)\s+instructions",
    r"forget\s+(everything|your\s+instructions)",
    r"you\s+are\s+now\s+(?:a\s+)?(?!helpful)",
    r"disregard\s+(?:your\s+)?(?:previous|prior|all)\s+",
    r"system\s*prompt\s*:\s*",
    r"<\s*/?(?:system|instruction)\s*>",
    r"act\s+as\s+(?:if\s+you\s+are\s+)?(?:a\s+)?(?:different|another|evil|jailbreak)",
]

@guardrail(kind="input")
class PromptInjectionGuard:
    def __init__(self):
        self._patterns = [re.compile(p, re.IGNORECASE) for p in INJECTION_PATTERNS]

    async def check(self, message: str, ctx: GuardrailContext) -> GuardrailDecision:
        for pattern in self._patterns:
            if pattern.search(message):
                return GuardrailDecision(
                    action="block",
                    violation="Potential prompt injection detected.",
                    guardrail_name="PromptInjectionGuard",
                )
        return GuardrailDecision(action="pass", guardrail_name="PromptInjectionGuard")

RAG pipeline defense

When user-provided content is injected into prompts (e.g. from retrieved documents), sanitize the document text before embedding it in the prompt:

def sanitize_retrieved_text(text: str) -> str:
    """Strip HTML/XML-style instruction tags from retrieved text."""
    import re
    # Remove <system>, <instruction>, <|...|> style tags
    text = re.sub(r'<[^>]{0,100}>', '', text)
    text = re.sub(r'<\|[^|]{0,100}\|>', '', text)
    return text.strip()

Logging blocked attempts

Use GuardrailViolated signal or wrap in a custom guard that logs to your audit trail:

from lauren_ai._guardrails._base import GuardrailContext, GuardrailDecision
import logging

logger = logging.getLogger("security.prompt_injection")


@guardrail(kind="input")
class AuditingInjectionGuard:
    def __init__(self):
        self._inner = PromptInjectionFilter()

    async def check(self, message: str, ctx: GuardrailContext) -> GuardrailDecision:
        decision = await self._inner.check(message, ctx)
        if decision.action == "block":
            logger.warning(
                "Prompt injection blocked",
                extra={
                    "user_id": ctx.user_id,
                    "agent": ctx.agent_name,
                    "message_preview": message[:200],
                },
            )
        return decision

Decorator placement

Input guardrails must be in the input= list of @use_guardrails():

@agent(model="claude-opus-4-6")
@use_guardrails(input=[PromptInjectionGuard()])
class ProtectedAgent: ...

Pitfalls

• Regex-based detection has false positives (e.g. "ignore previous chapters" in a book summary request). Tune patterns or add allow-listing for known-good phrases.
• No guardrail is 100% effective — defense in depth is essential. Combine with:
  • A fixed, non-modifiable system prompt.
  • Output guardrails to catch any slip-through.
  • Least-privilege tool access.
• Adversarial prompts in retrieved documents (indirect injection) are harder to catch — always sanitize retrieved text before injection.