Built, shipped, operated
Shadow
A unified, open-source security shield for agentic AI — defense-in-depth prompt-injection protection on both model input and output, with canary tokens, goal-hijack auditing, and benchmarks it publishes honestly.
- AI Security
- Open-source
- PyPI
- MIT
Live interface
Systems under pressure. You bring the pressure.
Type a prompt injection — or pick one — and the real shadowshield package (the same one on PyPI) scans it server-side and shows you exactly what it caught.
Pick a preset or paste your own injection, then Test it — the real shadowshield package scans it server-side.
Operating brief
The constraint.
Prompt injection is the number-one risk for agentic AI (OWASP LLM01), but most open-source guards are a single regex that only inspects user input. A jailbroken model still leaks secrets on the way out, and a single strong signal gets averaged away by naive scoring.
What the system does
Guards both directions with one engine — model input (prompts, retrieved docs, tool results) and model output (secret/PII leaks, system-prompt regurgitation).
Layers detection: multilingual signatures, normalization-aware matching (zero-width/homoglyph/bidi), encoded-payload decoding, heuristic scoring, an optional DeBERTa classifier and LLM self-check — combined with a noisy-or aggregator.
Is agent-aware: tool-call guarding, canary tokens that detect successful injections, and an agent-trace alignment audit for goal-hijack.
Acts, not just alerts: sanitize, block, throttle, or isolate (spotlighting / datamarking), across strict / balanced / permissive modes.
Architecture
How it moves.
The same engine runs on input and output. Untrusted text is normalized, scored by a detector ladder, aggregated, then answered with an action.
- Untrusted text (input or output)
- Normalize & decode
- Detection ladder (signatures · vector · DeBERTa · LLM check)
- Noisy-or aggregator
- Response (sanitize · block · isolate)
Canary tokens detect successful injections; an agent-trace alignment audit catches goal-hijack.
Build ledger
What carries it.
- Language
- Python 3.10+ · strict typing · FastAPI service
- Detection
- Multilingual signatures (de/es/fr/it/pt) · optional DeBERTa · vector similarity
- Distribution
- PyPI (pip install shadowshield) · MIT license · OIDC release pipeline
- Testing
- 130+ tests · reproducible benchmark harness (PINT / deepset / InjecAgent)
Current status
Delivered.
Open-source on PyPI under MIT, with strict typing and 130+ tests.
0% false-positive rate on hard negatives in the bundled benchmark — and publishes the harder external numbers on purpose.
Measured recall ladder on deepset/prompt-injections (all at 0% false positives): regex 18% → +multilingual 23% → +vector 25% → +DeBERTa 48%.