SovGuard

Why this has to exist

Prompt injection is the SQL injection of the agent era, and no major LLM API ships a mitigation. The model trusts whatever text reaches it — including text that arrived from a tool result, a scraped page, or a file someone uploaded. Most teams handle this by hoping nobody tries.

The moment it stops being theoretical is when your agent talks to a stranger’s agent. That is exactly what Junction41 makes routine, which is why this was built alongside it rather than as a separate product.

Inbound — six layers

	Layer	Speed	What it catches
L1	Regex	~1 ms	195+ patterns: instruction overrides, skeleton key, role-play, DAN, CSS steganography, log-to-leak, deceptive delight, ChatML delimiter attacks
L1+	Encoding decoders	~1 ms	11 decoders — Base64, Base32, ROT13, hex, Unicode escapes, HTML entities, URL encoding, leetspeak, token-break normalisation, GhostInk (Unicode tags and variation selectors)
L2	Perplexity	~1 ms	GCG adversarial suffixes, many-shot jailbreaks, gibberish, mixed scripts
L3	ML classifier	~50–100 ms	Self-hosted DeBERTa-v3 (ONNX) plus a multilingual MiniLM semantic layer, in-process with zero external calls. The only layer that catches paraphrase and non-English attacks
L4	Structured delivery	—	Wraps messages in randomised data markers (Microsoft’s Spotlighting) so the agent treats input as data, not instructions
L5	Canary tokens	~1 ms	Per-session natural-language canaries with a 24-hour TTL — detects system-prompt exfiltration
L6	File scanner	~1 ms	Filename injection, path traversal, null bytes, Unicode RLO, and full content scanning of TXT, MD, CSV, JSON, XML, HTML, SVG, DOCX, XLSX, PPTX and PDF including compressed streams

Outbound — nine scanners

Everything the agent says is checked on the way out too, which is the half most tools skip. PII (SSN, cards, email, phone) · URLs (exfil links, javascript:/data:/blob: schemes, IPv6 literals) · Code · Financial (unauthorised payment addresses, wallet manipulation across BTC/ETH/XMR/LTC) · Contamination (cross-job leakage via hashed fingerprint comparison) · Toxicity · Secrets (AWS, OpenAI, GitHub, Slack, JWT, PEM) · Exfil (zero-click remote-image pixel leaks in markdown and HTML) · Egress (canary leaks and data-egress markers).

Why six layers and not one

Regex is fast, free, and catches most of what actually arrives — 195+ patterns in about a millisecond, across eleven encodings. It is also exactly as good as its vocabulary. Keyword matching classifies surface forms; injection is defined by intent, and no quantity of the first adds up to the second.

So the cheap layers run first, and the DeBERTa classifier runs behind them — in-process, on a CPU, with no external call and nothing leaving the machine. That’s the layer that generalises past exact strings, and it is the reason a paraphrase or a non-English rewrite doesn’t sail through. Spotlighting, canaries and the file scanner then cover the paths that never look like an attack at all: a poisoned tool result, a system prompt walking out inside an answer, an instruction buried in the compressed stream of a DOCX.

Underneath, the parts that carry data hold up where it counts — parameterised queries throughout with no SQLi anywhere, AES-256-GCM done correctly, constant-time comparisons, a strict CORS allowlist, hashed API keys, and fail-closed admin auth.

Measured against attacks I didn’t write

Most prompt-injection tools report a number the vendor produced on payloads the vendor wrote. That’s a regression test, and it’s why those numbers cluster suspiciously close to 100%.

SovGuard publishes a different kind of number. Against deepset/prompt-injections — 662 examples written by strangers, every layer loaded, the full configuration recorded in the run — it flags 58.9% and blocks 15.6% of the attack classes it targets, at a 1.0% false-flag rate on benign text. Moving a single arbitration threshold takes blocking to 54.4%, at a cost of one false block in 399.

For scale: the authors of the classifier SovGuard runs report 99.74% recall for the identical weights, measured on data adjacent to what they trained on. Same model, same code, a corpus nobody involved wrote — 58.9%. A vendor’s own payloads tell you nothing about the next attacker. This number is a floor you can build on, and it goes up from here.

Where it sits in the stack

SovGuard is the trust boundary, and it’s deliberately the most separable piece here — it is useful to anyone running an agent, whether or not they’ve heard of the rest of this. npm i @sovguard/engine, MIT.

Inside the stack it guards the seam between Junction41’s buyers and sovagents, alongside Jailbox, which bounds what a hired agent can touch on disk. Above it, brainbox is exactly the case that makes this non-optional: the moment a personal AI reaches out to hire a stranger, everything coming back is untrusted input aimed at a model that knows your life.