Metadata-Version: 2.4
Name: prompt-dictator
Version: 0.1.0
Summary: Offline, zero-dependency indirect prompt injection scanner for LLM applications.
Project-URL: Homepage, https://github.com/trinityman-hash/Prompt.dictator
Project-URL: Repository, https://github.com/trinityman-hash/Prompt.dictator
Project-URL: Issues, https://github.com/trinityman-hash/Prompt.dictator/issues
Project-URL: Changelog, https://github.com/trinityman-hash/Prompt.dictator/blob/main/CHANGELOG.md
Author: trinityman-hash
License: MIT
License-File: LICENSE
Keywords: ai-safety,guardrails,llm,machine-learning,nlp,prompt-injection,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.9
Provides-Extra: dev
Requires-Dist: mypy>=1.0; extra == 'dev'
Requires-Dist: pytest-cov>=4.0; extra == 'dev'
Requires-Dist: pytest>=7.0; extra == 'dev'
Requires-Dist: ruff>=0.4; extra == 'dev'
Provides-Extra: ml
Requires-Dist: sentence-transformers>=2.2; extra == 'ml'
Description-Content-Type: text/markdown

# prompt-dictator 🛡️

> Offline, zero-dependency indirect prompt injection scanner for LLM applications.

[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![PyPI](https://img.shields.io/pypi/v/prompt-dictator.svg)](https://pypi.org/project/prompt-dictator/)

## Install

```bash
pip install prompt-dictator
```

## The Problem

When your AI app reads external content (PDFs, emails, web pages), attackers can hide instructions inside that content to hijack your LLM’s behavior. This is called **indirect prompt injection** — and it’s the #1 security risk for LLM apps (OWASP LLM01:2025).

Every existing solution either:
- Requires cloud APIs (sends your private data to a third party)
- Needs heavy dependencies (OpenAI key + Pinecone + vector DB)
- Only works pre-deployment (not runtime protection)

**prompt-dictator is different.** It is:
- ✅ Fully offline — zero network calls
- ✅ Zero required dependencies — Python stdlib only
- ✅ Runtime protection — scans live in your pipeline
- ✅ Structural separation — the parameterized query pattern for LLMs

## Quick Start

```python
from prompt_dictator import Scanner

scanner = Scanner()
result = scanner.scan(pdf_text)

if result.is_injection:
    print(f"Attack detected! Risk: {result.risk_score:.2f}")
    print(f"Reason: {result.reason}")
    print(f"Layer: {result.detected_by}")
```

## SafeCall API — The Parameterized Query for LLMs

```python
from prompt_dictator import SafeCall, SafeData

# OLD WAY (dangerous — mixes trusted + untrusted content):
response = llm(f"Summarize this: {pdf_text}")

# prompt-dictator WAY (structural separation):
response = SafeCall(
    task="Summarize this document",
    data=SafeData(pdf_text, source="user_pdf", trust="untrusted"),
    model=my_llm_function
)
# Raises UnsafeOutputWarning if LLM behavior drifts from original task
```

## Canary Tokens

```python
from prompt_dictator import Scanner

scanner = Scanner()

# Inject a hidden canary marker into content before sending to LLM
marked_content, token = scanner.inject_canary(pdf_text)

# After LLM responds, check if canary was leaked (exfiltration attack)
if scanner.check_canary(llm_response, token):
    print("WARNING: Canary token leaked — exfiltration attack detected!")
```

## Detection Layers

| Layer | Method | Speed | Bypassed by |
|-------|--------|-------|-------------|
| 1 — Heuristic | 500+ real attack patterns (OWASP + HackAPrompt) | ~0ms | Encoding, rephrasing |
| 2 — Structural | Imperative verb + context mismatch analysis | ~2ms | Very sophisticated attacks |
| 3 — Canary | Hidden token injection + leak detection | ~0ms | Nothing — post-hoc detection |
| 4 — Intent Monitor | Output drift from original task scope | ~1ms | Nothing — catches post-execution |

## Architecture Philosophy

prompt-dictator does NOT try to detect every possible attack string — that is an arms race you always lose.

Instead it:
1. **Tags provenance** — tracks where every piece of content came from (trusted vs untrusted)
2. **Separates structurally** — wraps untrusted content so it cannot escape into the instruction layer
3. **Monitors output** — catches behavioral drift even when input scanning fails

This is the same paradigm shift that parameterized queries brought to SQL injection — not scanning for bad SQL, but structurally separating code from data.

## License

MIT — see [LICENSE](LICENSE)
