The problem

The buried-injections benchmark ran 10 open-source prompt-injection detectors against 629 real AgentDojo attacks, each embedded inside ordinary tool output — the way an agent firewall actually sees them.

The best detector caught 51%. Meta's Prompt Guard 2 caught 1%. A regex baseline caught 0%.

The reason is context dilution: the same attack that a classifier catches with 100% accuracy on its own drops to 23% when surrounded by benign text. Whole-sequence transformers see one big input and the injection signal gets washed out.

Source: rudratoshs/buried-injections — a reproducible benchmark with raw results in bench/results/agentdojo.json.

The approach

Subcanopy Guard attacks the problem from a different angle. Instead of classifying the whole text at once, it slides a window across the input and measures local instruction density — the concentration of imperative verbs and jailbreak phrases within that window. It then layers on two more signals:

• 🧠 Density — imperative-verb and phrase concentration in a sliding window
• 📐 Discontinuity — style breaks between adjacent sentences
• 🎯 Provenance — risk multiplier by source (tool output, retrieved doc, user input, system prompt)

Optional decoding pass for base64, Morse, and Unicode homoglyphs (--decode, off by default).

No ML models. No external API calls. Pure Python standard library. Sub-millisecond scans.

Results

AgentDojo v1 — 629 attacks buried in tool output, 97 benign

Comparison to published baselines on the same corpus

_{Baselines from rudratoshs/buried-injections. All detectors evaluated on CPU. At --block-at CRITICAL we beat the paper's leader by 35 points at comparable false-positive rate and ~125× lower latency.}

PromptWall — 430 attacks, 8 categories, 70 safe prompts

The generalization test: 8 different attack families with distinct templates, not one. Direct user input, source=user_input, with --decode enabled.

False positives: 0/70 (0%). p50 latency: 0.15 ms.

Without --decode, encoded_attack drops to 20.5% and overall to 45.1%.

_{Dataset: cyberec/promptwall-injection-dataset. Overall recall has more than tripled from v0.2.0 (14.7% → 47.0%) with zero false positives. Remaining gap is encoded attacks that use double encoding, non-standard alphabets, or chained obfuscation — see docs/normalize.md.}

Install

pip install subcanopy-guard

Quick start

CLI

scg scan tool_output.json          # scan a file
scg scan -                         # read from stdin
cat response.txt | scg scan -      # pipe from another tool
scg scan --json suspicious.txt     # structured output for CI
scg scan --source retrieved_doc doc.txt
scg scan --block-at MEDIUM file.txt
scg scan --decode encoded.txt      # decode base64, Morse, and homoglyphs

Exit codes: 0 clean · 1 blocked · 2 usage/file error. Drop-in for CI pipelines and pre-tool-call gates.

Python

from subcanopy_guard import ContextScanner, ScannerConfig

scanner = ContextScanner(source="tool_output")
result = scanner.scan(tool_response)

if result.severity in ("HIGH", "CRITICAL"):
    log.warning("blocked: %s at %s", result.matches, result.hotspots)

With the decoding pass enabled:

scanner = ContextScanner(
    source="tool_output",
    config=ScannerConfig(decode_encoded=True),
)

Or as a decorator:

@scanner.protect(arg_name="tool_result")
def process(tool_result: str) -> str:
    ...  # raises InjectionRiskError if the scan blocks

How it works

Three signals, combined.

1. Density — sliding window over imperatives and phrases

Two scoring layers feed a sliding 25-token window with 10-token stride:

• Token layer. A ~60-verb lexicon with two tiers. STRONG verbs (ignore, disregard, jailbreak, override, repeat) weigh 1.5; REGULAR verbs (print, execute, act, send) weigh 0.5.
• Phrase layer. Multi-word patterns (developer mode, system prompt, no restrictions, DAN, ignore all previous, act as, pretend you are, word for word) contribute their weight once per occurrence to the first overlapping token.

Window score is min(weighted / 2.0, 1.0). The highest window score is the density risk. A single STRONG verb or a single jailbreak phrase pushes a window to HIGH on its own.

Why it defeats context dilution: the window measures local concentration, not global presence. An injection buried in 500 tokens of benign JSON still produces a localized spike that the window catches.

2. Discontinuity — adjacent-sentence style delta

Split on sentence-ending punctuation, JSON structural characters, and commas. Extract two features per sentence: second-person pronoun density and imperative verb density. Compute the L1 distance between adjacent sentences. The maximum delta is the discontinuity risk.

Why it works: benign tool output is declarative and third-person. Injection voice is imperative and second-person. The transition between them is the signal, even when either sentence alone looks benign.

3. Provenance — source-aware multiplier

Combination

if both signals available:
    base = 0.6 * density + 0.4 * discontinuity
    if both > 0.3:
        base *= 1.15                # agreement bonus
elif only density available:
    base = density
elif only discontinuity available:
    base = discontinuity
else:
    base = 0.0

final    = min(base * provenance_multiplier, 1.0)
severity = classify(final)

Availability rule: a signal that cannot be computed (input too short) does not vote against a signal that can. This matters for single-sentence injections where discontinuity has no adjacent sentences to compare against.

Severity bands: CLEAN < 0.15 · LOW < 0.35 · MEDIUM < 0.55 · HIGH < 0.75 · CRITICAL ≥ 0.75.

Optional decoding pass

When --decode is enabled (or ScannerConfig(decode_encoded=True)), the scanner runs a second pass on normalized text. Homoglyphs are folded via NFKC plus a Cyrillic/Greek/Turkish mapping, and base64 and Morse segments are decoded and rescanned. The pass with the higher risk wins, and ScanResult.decoded is set to True when the decoded pass produced the result. Default is off. See docs/normalize.md for the techniques and their known limitations.

Validation

Real-world test results, methodology, and known gaps are documented in docs/validation.md. The test battery is reproducible:

uv run python scripts/real_world_test.py
uv run python scripts/real_world_test.py --decode

Limitations

This is a heuristic detector, not a classifier. It is deliberately complementary to transformer-based scanners, not a replacement.

Good at:

• ✅ Template-based indirect injection buried in tool output (AgentDojo)
• ✅ Distinguishing injection register from tool-output register
• ✅ Recognising jailbreak, persona-hijack, and prompt-exfiltration vocabulary
• ✅ Detecting base64, Morse, and Cyrillic/Greek homoglyph obfuscation when --decode is enabled
• ✅ Running fast enough for per-tool-call scanning in production

Weak at:

• ❌ Advanced obfuscation — double encoding, non-standard base64 alphabets, and chained obfuscation are not decoded
• ❌ Paraphrased attacks that don't change register or use known verbs
• ❌ Sophisticated social engineering — polite, embedded, indistinguishable from benign requests
• ❌ Attacks relying on procedural knowledge rather than vocabulary

Known false positives on AgentDojo v1: 5/97 (5.2%) at --block-at CRITICAL. The v0.3.0 phrase layer introduced 2 additional false positives (3/97 → 5/97) in exchange for a large recall gain on the PromptWall generalization benchmark. The validation battery also produces one false positive on benign sentences that mention developer mode as a UI reference. Tradeoffs documented; tracked for a future tuning pass.

⚠️ Do not use Subcanopy Guard as your only defense. It is a fast pre-filter. Pair it with a transformer classifier for direct injection and with taint-tracking for agent tool-call security.

Performance

Compare to the fastest transformer detector (fmops-distilbert, 31 ms) — Subcanopy Guard is ~30–150× faster, but trades recall on advanced obfuscation and socially-engineered attacks for that speed. That tradeoff is deliberate.

License

Dual-licensed:

See COMMERCIAL_LICENSE.md for commercial terms and CLA.md for the contributor agreement.

Contributing

All contributions require a signed CLA. See CONTRIBUTING.md for the development setup.

Roadmap

See ROADMAP.md. Highlights:

• v0.3.0 — lexicon expansion for jailbreak and persona attacks ✅ shipped
• v0.3.1 — prompt-exfiltration phrases ✅ shipped
• v0.4.0 — decoding pass for base64, Morse, and homoglyphs ✅ shipped
• v0.5.0 — streaming scanner and framework integrations

Acknowledgments

Built on the findings of the buried-injections benchmark. The discontinuity signal is inspired by the stylometric approach described in "Beyond Pattern Matching" (April 2026). The severity band model follows ASCEND and tester311249/llm-security.