$ llmfirewall/how-it-works

Nothing here is an AI call. That's the point.

The preflight is regex, checksums, and one sentence-shape heuristic — no model judgment in the detection path. Here's exactly what runs, and what it does and doesn't catch.

pipeline

your prompt → pre-check → Gemini → post-check → response

A hit at pre-check stops the request before Gemini ever sees it. Post-check re-runs PII detection on Gemini's own reply, in case the model repeats something back that shouldn't leave. Nothing runs an LLM to decide; both gates are the same pure functions.

pii detection

Five checks, four of them checksum-backed

Format regexes cast a wide net; a checksum decides whether a candidate is real. A random 16-digit number matches the card pattern about 1 time in 10 before Luhn narrows it down — same idea for IBAN.

SSNformat only

\d{3}-\d{2}-\d{4}

CardLuhn checksum

13–19 digit candidate, spaces/dashes allowed, then mod 10 == 0 on the Luhn-weighted sum.

IBANmod-97 checksum

2-letter country + 2 check digits + BBAN, then the ISO 13616 rearrange-and-mod 97 == 1 check.

Phoneformat only

Loose international-leaning pattern, optional country code and separators.

Emailformat only

Standard local@domain.tld pattern.

injection detection

Three layers, none of them a model

detectInjection()

// 1. ~20 known phrases, matched tolerant of spacing/punctuation "ignore[\s\-_.,]{0,3}previous[\s\-_.,]{0,3}instructions" // catches "ignore-previous-instructions" too — but a real word // in between still breaks the match, so it can't over-fire // 2. hidden-Unicode smuggling U+200B zero-width space, U+202A–202E bidi override, U+2060–2064 // excludes ZWNJ/ZWJ/bidi-marks/BOM — legitimate in Persian, // Indic scripts, emoji, and files pasted with a BOM // 3. imperative-sentence heuristic 2+ sentences matching /^(ignore|disregard|reveal|bypass|…)/ AND mentioning instructions|prompt|system|rules in one call

why no model in the loop

inspectable

Every block traces to one line of matched text. No confidence score to argue with, no "the model felt unsafe."

no adaptive surface

There's no judgment call to attack with a crafted prompt — you can't gaslight a regex into thinking "ignore-previous-instructions" means something else.

cheap and fast

Runs before the Gemini call, not after — a bad prompt never burns model latency or a token, let alone gets a response.

testable to zero ambiguity

Pure functions, no I/O. Same input, same output, every time — the whole detector is 64 asserted test cases.

what this doesn't catch

Novel phrasing. Anything semantically equivalent to a known phrase but lexically unrelated — a paraphrase, a different language — has no pattern to match. arXiv:2602.10453
Plausible-looking data stuffing. Content that manipulates a downstream system just by being dense and keyword-heavy, with nothing hidden and nothing that reads as an instruction. arXiv:2605.28999
PII formats outside SSN/card/IBAN/phone/email. National IDs, passports, addresses — deliberately left out rather than shipped with a high false-positive format guess.
A determined, adaptive attacker. Every AI-based defense in the literature we reviewed gets broken by one; deterministic filtering is the category that's held up so far, not a guarantee that it always will. arXiv:2604.23887 · arXiv:2503.00061

One layer of defense-in-depth, not a verdict on your data. It catches what's pattern-shaped and stays honest about what isn't.

Try the firewall → Read arXiv:2604.23887 →