Category guide · prompt injection detection · LLM firewall
How to deploy a self-hosted prompt-injection firewall
A useful firewall does not merely return a score. It applies a documented policy, exposes the reason for every allow or block, supports shadow evaluation, and can be calibrated on your traffic.
Place controls at every untrusted boundary
Direct input
Scan user prompts before retrieval, tools, or an LLM can act on them.
Indirect input
Treat retrieved documents, web pages, email, and tool output as untrusted content.
Agent output
Optionally inspect assistant text and tool arguments before execution or delivery.
Decision evidence
Log policy, detector, threshold, resolution gate, decision source, and escalation path.
Install the audited firewall
pip install "prismguard[prism,guard-model]==0.1.9"PrismGuard combines rules, a local ONNX detector, and an optional judge. The default path can run self-hosted, and each outcome exposes resolution_gate and decision_source. Its ChorusGraph handler can run before retrieval or generation.
Evaluation scorecard
| Metric | Test set | Operational question |
|---|---|---|
| Attack recall | Held-out direct and indirect attacks | How many harmful attempts reach the protected system? |
| Benign allow rate | Real normal traffic | How much legitimate work is blocked? |
| Latency | Cold and warm p50/p95 | Can the guard run on every boundary? |
| Audit completeness | Every decision path | Can an operator explain and reproduce the outcome? |
Evidence and limitations
The published comparison uses a configured law-domain pipeline and a cold held-out law set against LLM Guard PromptInjection. It is vendor-authored and domain-specific. It does not prove universal superiority. Start in shadow mode, create a held-out set from your own languages, tools, documents, and false-positive budget, then promote a fixed policy.