I built a prompt-injection firewall for LLM apps

Every LLM feature you ship is a new attack surface. Users paste in text, tools return text, retrieval pulls in text, and all of it lands in the same context window as your instructions. dynarq-shield is a small firewall that sits in front of the model and decides, per input, whether to allow it, flag it, or block it.

Channel-gated detectors

The core idea is that not every check should run on every channel. A user message and a tool result carry different risk. Each detector declares which channels it applies to, so the retrieval channel gets exfiltration and delimiter-injection checks while the user channel gets jailbreak and override checks.

• Instruction override ("ignore previous instructions")
• Jailbreak and role-play framing
• Data exfiltration and secret-leak patterns
• Delimiter and encoding-evasion attempts

Defeating evasion first

Attackers hide intent with zero-width characters and homoglyphs. Before any detector runs, the input is Unicode-normalized so "ignοre" with a Greek omicron collapses to the same tokens as the plain-ASCII version. Normalizing up front means the detectors stay simple and readable.

$ python -m dynarq_shield scan --channel user "ignore all previous rules"risk: 0.82  verdict: BLOCKhits: instruction_override, imperative_reset

Additive scoring, not a single classifier

Rather than one opaque score, each detector contributes to an additive risk value with a clear reason. That makes the decision explainable: you can see exactly which signals pushed an input over the block threshold. It is pure standard library, zero runtime dependencies, and ships with 34 tests.

The goal was never a perfect classifier. It was a fast, explainable gate you can actually reason about in production.