Semantic Filtering

Converts input text into high-dimensional vector embeddings that capture semantic meaning rather than literal keywords. An adversarial prompt like "pretend you are DAN" and a benign one like "act as a helpful assistant" occupy vastly different regions in embedding space, enabling detection even when exact keywords are novel.

• Uses transformer-based encoders to generate embeddings
• Compares input vectors against known adversarial clusters
• Detects semantic similarity to prohibited intents

Employs cosine similarity or euclidean distance metrics to measure how closely an incoming prompt aligns with a database of known jailbreak and injection patterns. If the semantic distance falls below a calibrated threshold, the input is blocked before reaching the model.

• Maintains a dynamic embedding store of adversarial examples
• Thresholds tuned per deployment risk tolerance
• Sub-millisecond lookup with approximate nearest neighbor (ANN) indexes

Unlike regex-based filters that fail against simple rewording, semantic filtering recognizes that "ignore previous instructions" and "disregard all prior directives" carry identical intent. The embedding model's attention mechanisms capture this equivalence naturally.

• Immune to synonym substitution and syntactic rearrangement
• Detects multilingual adversarial prompts via cross-lingual embeddings
• Resistant to homoglyph and whitespace obfuscation

Detection models are trained using contrastive loss functions that explicitly pull benign prompt embeddings apart from adversarial ones in vector space. This creates wide decision boundaries that are harder for gradient-based attacks to cross.

• Trained on paired (benign, adversarial) prompt datasets
• Produces adversarially robust embedding spaces
• Reduces false positives on edge-case legitimate queries

Complex prompts containing both legitimate and malicious sub-intents are decomposed into constituent semantic units. Each fragment is independently embedded and scored, preventing attackers from hiding jailbreak payloads within lengthy benign context.

• Uses text segmentation before embedding generation
• Scores each segment independently against threat vectors
• Blocks only the malicious fragment or the entire composite prompt

Frequently encountered benign prompt patterns are cached as pre-computed embedding fingerprints, allowing instant allowlisting without repeated inference. This maintains low latency for production traffic while reserving deep semantic analysis for novel or suspicious inputs.

• Implements least recently used (LRU) cache for hot embeddings
• Reduces inference overhead by 80-95% on common queries
• Cache invalidation on model updates ensures freshness

A safety framework that establishes privilege levels for different instruction sources. System-level directives are given highest priority, user inputs receive lower priority, and third-party data gets the lowest. This structural defense prevents lower-privilege inputs from overriding core operational constraints.

• System > User > Tool Output priority chain
• Models trained to recognize and respect privilege boundaries
• Complements semantic filtering by providing structural defense

A statistical defense that flags inputs with abnormally high perplexity scores. Obfuscated or encoded adversarial payloads often deviate significantly from natural language distributions. While semantic filtering analyzes intent, perplexity filtering catches the encoding tricks attackers use to smuggle malicious content past intent-based detectors.

• Detects Base64-encoded payloads
• Identifies token smuggling attempts
• Low computational overhead for real-time screening

A security layer that intercepts and analyzes both prompts and model responses in real-time. Unlike semantic filtering which focuses on input intent, a prompt firewall provides bidirectional protection — blocking injection attacks on the way in and preventing data exfiltration on the way out.

• Real-time input/output inspection
• Policy enforcement for content and tool access
• Often combines multiple detection methods including semantic analysis

A secondary, smaller classifier trained specifically to evaluate the safety and integrity of inputs and outputs. Guard models act as independent auditors for primary language models. Semantic filtering can be implemented as one capability within a broader guard model architecture.

• Lightweight models optimized for classification speed
• Trained on adversarial example datasets
• Provides independent verification separate from the primary model's reasoning

The process of cleansing user-supplied data by removing or encoding potentially dangerous characters and patterns before they reach the language model. While semantic filtering addresses meaning, sanitization handles syntax-level threats like delimiter injection and control character manipulation.

• Unicode normalization to prevent homoglyph attacks
• Stripping invisible control characters
• Encoding special characters that could break prompt structure