Input Sanitization

The process of enforcing a rigid structural contract on all incoming data, rejecting any payload that does not conform to the expected format, type, and length constraints. This is the first line of defense against malformed input attacks.

• JSON Schema Enforcement: Validates keys, types, and nesting depth.
• Regex Whitelisting: Only permits characters matching a safe pattern (e.g., [a-zA-Z0-9\s]).
• Type Casting: Forces inputs to strict types (integer, boolean) to prevent type juggling vulnerabilities.
• Length Bounding: Truncates or rejects strings exceeding a maximum token limit to prevent resource exhaustion.

Transforming unsafe characters into a safe format based on the specific downstream interpreter context. This prevents cross-context injection where data escapes the data field and becomes executable code.

• HTML Entity Encoding: Converts < to < to prevent DOM-based attacks in rendered outputs.
• JavaScript Escaping: Neutralizes quotes and backslashes before insertion into script contexts.
• SQL Parameterization: Uses prepared statements to separate code from data, rendering SQL injection inert.
• Markdown Fencing: Wraps user input in code blocks to prevent accidental interpretation of markdown syntax by LLMs.

Applying machine learning classifiers or heuristic rules to detect and block harmful intent, even if the input is syntactically valid. This addresses semantic attacks like jailbreaks and hate speech.

• Toxicity Classifiers: Real-time APIs (e.g., Perspective API) that score text for profanity and harassment.
• Prompt Injection Detection: Models fine-tuned to recognize 'ignore previous instructions' patterns.
• Canary Tokens: Embedding invisible strings in system prompts to detect if they are leaked or extracted.
• PII Scrubbing: Automatically redacting names, emails, and credit card numbers using Named Entity Recognition (NER).

Reducing input to a single, standard representation to prevent attackers from bypassing filters using encoding tricks or Unicode look-alikes.

• Unicode Normalization (NFC/NFD): Resolves visually identical characters (e.g., Latin 'A' vs. Cyrillic 'А') to a single code point.
• Path Canonicalization: Resolves relative paths (../../etc/passwd) to absolute paths to prevent directory traversal.
• Case Folding: Converts text to lowercase for case-insensitive comparisons.
• Encoding Recursion: Repeatedly decoding (e.g., URL decode, Base64) until the payload stabilizes to catch multi-layered obfuscation.

Techniques specifically designed to remove or neutralize the subtle mathematical noise added to inputs to fool classifiers. This defends against evasion attacks on vision and text models.

• Feature Squeezing: Reducing the color depth of images or the synonym space of text to collapse adversarial noise.
• Spatial Smoothing: Applying median or Gaussian filters to break the precise pixel-level gradients of adversarial patches.
• JPEG Compression: Lossy compression that discards high-frequency perturbations invisible to the human eye.
• Randomized Resizing: Resizing and re-padding inputs slightly to shift the alignment of the adversarial perturbation.

Executing complex parsing or conversion logic inside a heavily restricted, isolated environment to contain the blast radius of zero-day parser exploits.

• gVisor/Firecracker Micro-VMs: Running file parsers (PDF, DOCX) in lightweight virtual machines with no network access.
• Seccomp-bpf Filters: Restricting system calls available to the sanitization process.
• Memory Limits: Enforcing strict cgroup memory limits to prevent heap spray attacks during parsing.
• Timeouts: Killing the sanitization process if it takes longer than a strict threshold, preventing algorithmic complexity denial-of-service attacks.

A subtle, often imperceptible modification to input data specifically crafted to cause a machine learning model to make an incorrect prediction. These perturbations exploit the model's decision boundaries by adding carefully calculated noise that is invisible to humans but catastrophic for classifiers. Input sanitization acts as a first-line defense by detecting and neutralizing these perturbations before inference.

• White-box attacks use full knowledge of model gradients (e.g., FGSM, PGD)
• Black-box attacks estimate gradients through repeated querying
• Defenses include feature squeezing, JPEG compression, and adversarial training

A vulnerability in large language models where an attacker overrides original system instructions by crafting malicious inputs that hijack the model's behavior. Unlike traditional code injection, prompt injection exploits the model's inability to reliably distinguish between system-level instructions and user-provided data. Input sanitization techniques must parse and neutralize delimiter-breaking patterns, instruction-override attempts, and context-switching tokens.

• Direct injection: "Ignore previous instructions and..."
• Indirect injection: Poisoned data retrieved via RAG pipelines
• Mitigation requires strict input validation, output filtering, and privilege separation

An attack on model integrity where an adversary contaminates the training dataset with malicious samples to corrupt the learning process and implant a backdoor or degrade performance. While input sanitization protects at inference time, data poisoning subverts the model before deployment. Backdoor attacks cause misclassification only when a specific trigger pattern is present in the input.

• Label flipping corrupts supervised learning by swapping ground-truth annotations
• Clean-label attacks insert correctly labeled but subtly perturbed samples
• Defenses include robust statistics, anomaly detection on training data, and provenance tracking

A defensive technique that improves model robustness by augmenting the training dataset with adversarial examples, forcing the model to learn correct classifications for manipulated inputs. This creates a hardened decision boundary that is less susceptible to small perturbations. Input sanitization complements adversarial training by handling novel attack patterns the model wasn't trained on.

• PGD-based training uses projected gradient descent to generate strong adversarial examples during each epoch
• TRADES balances clean accuracy against adversarial robustness
• Computational cost is significant—training time increases 3-10x

A privacy breach where an attacker reconstructs sensitive training data or statistical features of a class by repeatedly querying a model and analyzing its outputs. Input sanitization alone cannot prevent this—the attack exploits legitimate model responses. Defenses require output sanitization and query rate limiting.

• Attackers optimize input to maximize class confidence scores, revealing prototypical training examples
• Differential privacy during training provides mathematical guarantees against inversion
• Prediction vector clipping and confidence score rounding reduce information leakage

Programmatic constraints and validation layers integrated into an AI application's runtime to enforce safety policies, structural output formats, and prevent off-topic or harmful conversations. Guardrails extend input sanitization into a continuous validation pipeline that operates on both inputs and outputs.

• Input guardrails validate format, detect PII, and block known attack patterns
• Output guardrails enforce schema compliance, toxicity filters, and factual consistency checks
• Frameworks like NVIDIA NeMo Guardrails and Guardrails AI provide programmable rule engines