playground · prompt guard · runs in your browser
Stop known attacks
before your LLM reads them.
Prompt injection ("ignore your instructions and…") reaches your model through user messages, documents and web pages. Many attacks are copies of copies. A shad0w table can recognise those in microseconds and block them, and send everything it isn't sure about to your model. It never lets anything through on its own word.
measured
On prompts it never saw.
Trained on the public safe-guard-prompt-injection dataset (its labels were the teacher), and tested on its … held-out prompts.
how it behaves
Block, or ask the model. Never "allow".
- Block only when the table says "injection" and the answer is certified: tested in advance to disagree with its teacher on at most 5% of certified answers.
- Ask the model for everything else, including messages it thinks are safe. A table can't vouch for a new attack, so it never gets the last word on letting something through.
- In the library,
shad0w.guard.Guardalso normalises the input first (zero-width and bidi characters, homoglyphs, leetspeak, spaced letters, base64 and hex payloads) and sends anything it had to undo to your model. This page runs the table alone. Try the encoded and full-width examples: the bare table reads them as safe, even certified, which is exactly why a guard must never allow on the table's word. Here they go to the model; in the library the normaliser also undoes the encoding first. - It catches repeats of known attacks cheaply. It is not a defence against an adaptive attacker on its own: keep your model's own safeguards.
from shad0w.guard import Guard
gate = Guard(shad0w.decision("injection", options={"attack": "...", "safe": "..."}, llm="openai/gpt-6-luna"))
gate.calibrate(fresh_texts, llm_answers) # block-only certificate
gate.check(text) # "block" or "ask_model", never "allow"