Package org.openidentityplatform.openig.ai.filter

Class LLMPromptGuardFilter

java.lang.Object

org.openidentityplatform.openig.ai.filter.LLMPromptGuardFilter

All Implemented Interfaces:

org.forgerock.http.Filter

public class LLMPromptGuardFilter
extends Object
implements org.forgerock.http.Filter

Detects and blocks prompt-injection attacks before they reach the downstream LLM API.

Detection pipeline

1. Prompt extraction – parses the JSON request body and extracts all prompt text from messages[].content (OpenAI chat format) or a top-level prompt field.
2. Layer-1: Regex – fast, deterministic pattern matching including Unicode normalization and Base64 decode-then-scan.
4. Layer-2: Typoglycemia (enabled by typoglycemiaEnabled, default true) – catches injection keywords whose interior letters have been transposed to evade exact matching (e.g. "jialbrek" for "jailbreak"). Uses a fingerprint gate (first char + last char + sorted interior bag) followed by true unrestricted Damerau-Levenshtein distance ≤ typoglycemiaMaxEditDist (default 3).

Actions on detection

• BLOCK – returns a configurable HTTP error (default 400).
• LOG_ONLY – no headers, no blocking.

Route JSON configuration

 {
   "type": "LLMPromptGuardFilter",
   "config": {
      "action":                       "BLOCK",
      "patternFile":                  "injection-patterns.json",
      "typoglycemiaEnabled":           true,
      "typoglycemiaMaxEditDist":       3,
      "typoglycemiaMinWordLen":        4,
      "typoglycemiaKeywords":         "typoglycemia-keywords.json",
      "blockResponse": {
          "status": 400,
          "body":   "{ \"error\": \"prompt_injection_detected\" }"
     }
   }
 }
 

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	LLMPromptGuardFilter.Action
static class	LLMPromptGuardFilter.Heaplet

Constructor Summary

Constructors

Constructor	Description
LLMPromptGuardFilter(InjectionDetector detector, LLMPromptGuardFilter.Action action)

Method Summary

Modifier and Type	Method	Description
org.forgerock.util.promise.Promise<org.forgerock.http.protocol.Response,org.forgerock.util.promise.NeverThrowsException>	filter(org.forgerock.services.context.Context context, org.forgerock.http.protocol.Request request, org.forgerock.http.Handler next)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

LLMPromptGuardFilter

public LLMPromptGuardFilter(InjectionDetector detector,
                            LLMPromptGuardFilter.Action action)

Method Detail

filter

public org.forgerock.util.promise.Promise<org.forgerock.http.protocol.Response,org.forgerock.util.promise.NeverThrowsException> filter(org.forgerock.services.context.Context context,
                                                                                                                                             org.forgerock.http.protocol.Request request,
                                                                                                                                             org.forgerock.http.Handler next)

Specified by:

filter in interface org.forgerock.http.Filter