prompt-dictator 0.1.0

Offline, zero-dependency indirect prompt injection scanner for LLM applications.

prompt-dictator 🛡️

Offline, zero-dependency indirect prompt injection scanner for LLM applications.

Install

pip install prompt-dictator

The Problem

When your AI app reads external content (PDFs, emails, web pages), attackers can hide instructions inside that content to hijack your LLM’s behavior. This is called indirect prompt injection — and it’s the #1 security risk for LLM apps (OWASP LLM01:2025).

Every existing solution either:

• Requires cloud APIs (sends your private data to a third party)
• Needs heavy dependencies (OpenAI key + Pinecone + vector DB)
• Only works pre-deployment (not runtime protection)

prompt-dictator is different. It is:

• ✅ Fully offline — zero network calls
• ✅ Zero required dependencies — Python stdlib only
• ✅ Runtime protection — scans live in your pipeline
• ✅ Structural separation — the parameterized query pattern for LLMs

Quick Start

from prompt_dictator import Scanner

scanner = Scanner()
result = scanner.scan(pdf_text)

if result.is_injection:
    print(f"Attack detected! Risk: {result.risk_score:.2f}")
    print(f"Reason: {result.reason}")
    print(f"Layer: {result.detected_by}")

SafeCall API — The Parameterized Query for LLMs

from prompt_dictator import SafeCall, SafeData

# OLD WAY (dangerous — mixes trusted + untrusted content):
response = llm(f"Summarize this: {pdf_text}")

# prompt-dictator WAY (structural separation):
response = SafeCall(
    task="Summarize this document",
    data=SafeData(pdf_text, source="user_pdf", trust="untrusted"),
    model=my_llm_function
)
# Raises UnsafeOutputWarning if LLM behavior drifts from original task

Canary Tokens

from prompt_dictator import Scanner

scanner = Scanner()

# Inject a hidden canary marker into content before sending to LLM
marked_content, token = scanner.inject_canary(pdf_text)

# After LLM responds, check if canary was leaked (exfiltration attack)
if scanner.check_canary(llm_response, token):
    print("WARNING: Canary token leaked — exfiltration attack detected!")

Detection Layers

Layer	Method	Speed	Bypassed by
1 — Heuristic	500+ real attack patterns (OWASP + HackAPrompt)	~0ms	Encoding, rephrasing
2 — Structural	Imperative verb + context mismatch analysis	~2ms	Very sophisticated attacks
3 — Canary	Hidden token injection + leak detection	~0ms	Nothing — post-hoc detection
4 — Intent Monitor	Output drift from original task scope	~1ms	Nothing — catches post-execution

Architecture Philosophy

prompt-dictator does NOT try to detect every possible attack string — that is an arms race you always lose.

Instead it:

1. Tags provenance — tracks where every piece of content came from (trusted vs untrusted)
2. Separates structurally — wraps untrusted content so it cannot escape into the instruction layer
3. Monitors output — catches behavioral drift even when input scanning fails

This is the same paradigm shift that parameterized queries brought to SQL injection — not scanning for bad SQL, but structurally separating code from data.

License

MIT — see LICENSE