Evaluation results · generated from CI

AI Security Gateway

A detection layer for LLM applications — prompt injection, jailbreaks, system-prompt leakage, PII, toxicity, and malicious tool calls — scored, decided, and audit-logged. This page reports real numbers from the repo's own benchmark and replay tooling, including an honest held-out generalization test.

GitHub repository Architecture & README CI runs

Headline numbers

Two corpora, two purposes: the tuned corpus is a regression suite (detectors were iterated against it); the holdout corpus is paraphrased attack wording the detectors never saw, so it's a genuine generalization check.

100%

Recall · tuned corpus (76 attacks)

96.9%

Recall · held-out paraphrased attacks (32)

False-positive rate, both corpora (28 benign)

1.2 ms

Avg. detector latency / request

Attacks neutralized · unguarded model (of 76)

Attacks neutralized · guarded model (of 76)

Detection recall by category

Tuned corpus (96 cases: 20 benign + 76 attacks) vs. held-out corpus (40 cases: 8 benign + 32 paraphrased attacks), regenerated on every CI run via python cli.py benchmark.

Tuned corpus Held-out (paraphrased)

Gateway effect across model backends

Every attack in the tuned corpus sent to two offline, deterministic backends — naive_mock (simulates an unguarded model that complies with attacks) and guarded_mock (simulates a reasonably aligned one) — first with no gateway, then routed through SecurityGateway. "Compromised" is judged by a heuristic oracle (refusal-phrase absence, PII/leakage detectors on the response) — see benchmark/multi_model.py. Real backends (OpenAI, Anthropic) run the same comparison when API keys are configured.

Unprotected (no gateway) Gateway-protected

Even a well-aligned model (guarded_mock) drops from a 52.6% to a 21.1% compromise rate with the gateway in front — a second, independent, auditable layer of defense pays off regardless of how good the underlying model's own alignment is.

What's actually being tested

Prompt injection

Override/disregard phrasing, fake role delimiters, HTML-comment smuggling, base64-encoded instruction payloads.

Jailbreak

DAN/AIM/STAN personas, developer-mode claims, "pretend you have no restrictions," dual-response splitting, false-authority framing.

System-prompt leakage

Extraction attempts on the input side; verbatim/near-verbatim reproduction on the output side via sliding-window similarity.

PII

Email, phone (US & international), SSN, Luhn-checked card numbers, IBAN, passport, IP, DOB, street address, AWS/GitHub keys, passwords — with redaction.

Toxicity

Weighted lexicon: profanity, harassment, threats, self-harm, hate-speech structure, plus aggressive-formatting heuristics.

Malicious tool calls

Shell injection, destructive/tautological SQL, path traversal, credential access, SSRF (loopback/link-local/cloud-metadata), exfiltration params.

Output validation

Script/markup injection, markdown image/link exfiltration payloads, degenerate repetition, JSON-schema conformance.

Risk scoring & audit

Weighted-max aggregation → allow/flag/sanitize/block, plus append-only JSONL audit logs and an attack-replay regression harness.

Reproduce these numbers

git clone https://github.com/ara-5/AI-Security-Gateway
cd AI-Security-Gateway
pip install -r requirements.txt

python cli.py benchmark                                   # tuned corpus
python cli.py benchmark --corpus data/holdout_corpus.jsonl # held-out corpus
python cli.py multi-model --backends naive_mock,guarded_mock
python -m pytest -q                                        # 42 tests, incl. regression floors

Honesty note: the tuned-corpus 100% is a statement about internal consistency, not proof the detectors catch every novel attack — it was authored and iterated by the same person who built the detectors. The held-out corpus exists specifically to counter that: it's deliberately paraphrased away from the tuned patterns, and 96.9% (not 100%) is the more credible number. Regex/heuristic detectors are transparent and auditable but will miss sufficiently novel phrasing — swapping in an embedding- or LLM-based classifier behind the same detector interface is the natural next step.