PROMPTPurify
starsforks
How to install PROMPTPurify?
securelayer7/promptpurify
$git clone https://github.com/securelayer7/PROMPTPurifyTiny prompt-injection firewall for LLM chat apps. ~14 MB. CPU-only. Drop-in guard between your user input and your LLM — runs on the same box, no GPU, no API, no extra service.
README.md
| 1 | <p align="center"> |
| 2 | <picture> |
| 3 | <source media="(prefers-color-scheme: dark)" srcset="assets/logo/logo-mark-dark-mode.png"> |
| 4 | <source media="(prefers-color-scheme: light)" srcset="assets/logo/logo-mark-light-mode.png"> |
| 5 | <img alt="promptpurify" src="assets/logo/logo-mark-light-mode.png" width="160" height="160"> |
| 6 | </picture> |
| 7 | </p> |
| 8 | |
| 9 | <h1 align="center">promptpurify</h1> |
| 10 | |
| 11 | [](https://github.com/securelayer7/PROMPTPurify/actions/workflows/ci.yml) |
| 12 | [](https://www.npmjs.com/package/promptpurify) |
| 13 | [](https://www.npmjs.com/package/promptpurify) |
| 14 | [](https://huggingface.co/Securelayer7/promptpurify) |
| 15 | [](LICENSE) |
| 16 | [](MODEL_CARD.md) |
| 17 | [](SECURITY.md) |
| 18 | |
| 19 | **Tiny prompt-injection firewall for LLM chat apps. ~14 MB. CPU-only.** |
| 20 | Drop-in guard between your user input and your LLM — runs on the same box, |
| 21 | no GPU, no API, no extra service. |
| 22 | |
| 23 | > Built by the [SecureLayer7](https://securelayer7.net) red-team. Most |
| 24 | > OSS guardrails are hundreds of MB, want a GPU, and still miss the |
| 25 | > attacks we see in production. We needed something we could ship inside |
| 26 | > our own AI products and our customers' apps without any of that. |
| 27 | |
| 28 | ## Why this exists |
| 29 | |
| 30 | | | promptpurify | typical OSS guardrail | |
| 31 | |---|---|---| |
| 32 | | Install size | **~14 MB ONNX** | 180 MB – 7 GB | |
| 33 | | Inference | **CPU, single-digit ms** | GPU recommended | |
| 34 | | Where it runs | **In your Node process** | Sidecar or hosted API | |
| 35 | | Cost per call | **$0** | $ or GPU compute | |
| 36 | |
| 37 | Benchmark comparison vs OSS baselines → [docs/BENCHMARKS.md](docs/BENCHMARKS.md). |
| 38 | |
| 39 | ## Install |
| 40 | |
| 41 | ```bash |
| 42 | # SDK (zero-dep, ~50 KB) — structural firewall + browser bundle |
| 43 | npm i promptpurify |
| 44 | |
| 45 | # Add the model (~14 MB ONNX) for the chat-injection guard |
| 46 | npm i onnxruntime-node |
| 47 | curl -L -o promptpurify-model.tar.gz \ |
| 48 | https://github.com/securelayer7/PROMPTPurify/releases/download/v0.0.1/promptpurify-model.tar.gz |
| 49 | curl -L -o promptpurify-model.tar.gz.sha256 \ |
| 50 | https://github.com/securelayer7/PROMPTPurify/releases/download/v0.0.1/promptpurify-model.tar.gz.sha256 |
| 51 | sha256sum -c promptpurify-model.tar.gz.sha256 # MUST print "OK" |
| 52 | tar xzf promptpurify-model.tar.gz # creates models/l5e/ |
| 53 | ``` |
| 54 | |
| 55 | The model isn't in the npm tarball — the SDK stays tiny for people who |
| 56 | only want the structural firewall (browser, edge, RAG). Full |
| 57 | distribution options: [docs/SAMPLE-DATA.md](docs/SAMPLE-DATA.md#how-to-get-the-model). |
| 58 | |
| 59 | ## 3-line drop-in |
| 60 | |
| 61 | ```ts |
| 62 | import { createL5eRunner } from "promptpurify/l5"; |
| 63 | |
| 64 | const guard = await createL5eRunner(); |
| 65 | |
| 66 | // In your /chat handler: |
| 67 | const score = await guard.score(userMessage); |
| 68 | if (score >= 0.95) return refusal(); // hard block |
| 69 | if (score >= 0.85) flagForReview(userMessage); // advisory |
| 70 | const reply = await yourLLM.complete(userMessage); // pass through |
| 71 | ``` |
| 72 | |
| 73 | Works with Groq, OpenAI, Anthropic, vLLM, local LLMs — |
| 74 | promptpurify never talks to your LLM, only to your input. |
| 75 | |
| 76 | For the deterministic structural firewall (Unicode neutralization, |
| 77 | role-fenced messages, output exfil guard) see |
| 78 | [docs/QUICKSTART.md](docs/QUICKSTART.md). |
| 79 | |
| 80 | ## Built from scratch |
| 81 | |
| 82 | We built our model from random initialization because no existing OSS |
| 83 | guardrail gave us the size / latency tradeoff we wanted to ship in our |
| 84 | own products. |
| 85 | |
| 86 | - **From-scratch.** No teacher weights from any vendor classifier are |
| 87 | redistributed. |
| 88 | - **Benchmarked against public datasets** for direct comparison with OSS |
| 89 | baselines (ProtectAI v2, deepset, Meta Prompt-Guard, Meta Prompt-Guard-2). Held-out |
| 90 | evaluation; false positives r |
People who liked this also viewed
6 picksType
- Resk-LLM Resk is a robust Python library designed to enhance security and manage context when interacting with LLMs. It provides a protective layer for API calls, safeguarding against common vulnerabilities and ensuring optimal performance. And safe layer again Prompt Injection. PromptsJun 2026
- agentic-ai-prompt-researchResearch into how agentic AI coding assistants work. Reconstructed prompt patterns, agent coordination, and security classificationPromptsMar 2026
- promptmapa security scanner for custom LLM applicationsPromptsDec 2025
- finite-monkey-engineAI engine for smart contract auditPromptsJan 2026
- prompt-hacker-collectionsprompt attack-defense, prompt Injection, reverse engineering notes and examples | 提示词对抗、破解例子与笔记 PromptsFeb 2025
- acipThe Advanced Cognitive Inoculation PromptPromptsMar 2026
