Rebuff

Analyzes incoming prompts using fast, pattern-based rules to detect common prompt injection attack signatures (keywords, structural patterns, encoding tricks). Operates as the first defense layer before LLM-based detection, using configurable keyword lists and regex-based pattern matching to identify malicious intent without requiring model inference. Returns a heuristic score that can be compared against a configurable threshold to block suspicious inputs.

Delegates prompt injection detection to a dedicated language model that analyzes user input semantically to identify malicious intent, jailbreak attempts, and instruction-override attacks. The SDK abstracts the LLM backend (OpenAI, Anthropic, local models via Ollama) and returns a detection score based on the model's confidence in identifying an attack. This layer captures sophisticated, context-aware attacks that simple heuristics miss.

Provides APIs to log detected attacks (especially canary token leaks) to the vector database, enabling the system to learn from incidents and improve future detection. When isCanaryWordLeaked() detects a leak, the application can call logAttack() to store the attack input and metadata, which gets embedded and added to the vector database. This creates a feedback loop where each incident improves detection of similar future attacks.

Returns detailed detection results that include individual scores from each enabled tactic (heuristic score, LLM confidence, vector similarity score) alongside the final detection decision. This enables developers to understand which tactic flagged an input and why, supporting debugging, threshold tuning, and explainability to stakeholders. Detection results include metadata like matched attack patterns from vector database or heuristic rules triggered.

Stores embeddings of previously detected or known prompt injection attacks in a vector database (Pinecone, Supabase, or custom backends), then compares incoming prompts against this corpus using semantic similarity. When a user input's embedding exceeds a similarity threshold to known attacks, the system flags it as a potential injection. This layer learns from past incidents and enables zero-shot detection of attack variants.

Inserts randomly generated, unique canary tokens into system prompts before sending to the LLM, then monitors the model's response to detect if those tokens appear in the output. If a canary token leaks, it indicates the model has exposed its system instructions, revealing a successful prompt injection. The SDK provides addCanaryWord() to inject tokens and isCanaryWordLeaked() to check responses, enabling post-hoc detection of instruction leakage.

Implements strategy pattern to compose heuristic, LLM-based, and vector database detection tactics into a unified detection pipeline. Each tactic has an independent, configurable threshold that determines sensitivity. The SDK allows enabling/disabling tactics, adjusting thresholds per tactic, and combining scores across tactics to make a final detection decision. This architecture enables teams to tune detection sensitivity for their specific risk tolerance and false-positive budget.

Provides Python bindings for Rebuff detection with both sync (detect_injection) and async (async detect_injection) methods, enabling integration into synchronous Flask/Django applications and async FastAPI/Starlette services. The SDK abstracts backend configuration (LLM provider, vector database, heuristic rules) via environment variables or constructor parameters, reducing boilerplate and enabling environment-specific configuration.

Provides TypeScript-first SDK for JavaScript environments (Node.js, Deno, browsers) with full type safety and ESM/CommonJS module support. Implements the same multi-tactic detection strategy as Python SDK but optimized for JavaScript async/await patterns. Includes built-in support for configuring LLM providers and vector databases via constructor options or environment variables.

Abstracts vector database implementation behind a unified interface, supporting Pinecone, Supabase, Weaviate, Milvus, and custom backends. The SDK accepts a vector database configuration object at initialization and delegates all embedding storage/retrieval to the chosen backend. This enables teams to switch vector databases without code changes and implement custom backends for compliance or performance requirements.

Provides a web-based UI (hosted at rebuff.ai or self-hosted) where developers can test prompt injection detection in real-time, adjust tactic thresholds, and visualize per-tactic detection scores. The playground connects to a backend API that runs the full detection pipeline and returns detailed results, enabling rapid iteration on threshold tuning and detection strategy without writing code.

Enables self-hosting of Rebuff server (detection backend and playground UI) via Docker, Kubernetes, or direct binary deployment. Configuration is entirely environment-variable-driven (LLM provider, vector database, heuristic rules), enabling teams to deploy to private infrastructure without code changes. Supports Netlify Functions, AWS Lambda, and traditional server deployments.