AI safety evaluation
Prompt-injection guard evaluation
LyraShield AI includes a deterministic prompt-injection guard that gates MCP tool-call inputs before they reach the LLM scan engine. This page documents how we evaluate that guard against two open frameworks: the OWASP Gen AI Red Teaming Guide and the MLCommons AILuminate demo prompt set. Results are bounded, honest, and limitation-aware.
Last reviewed:
What we test
The guard is a regex-based filter with 15+ pattern categories: instruction override, role hijack, memory wipe, code execution, SQL injection, destructive commands, environment variable extraction, prompt extraction, file access, obfuscation, system tags, ChatML tags, and more. It normalizes input (NFKC, zero-width stripping, HTML entity decoding) before matching. We test whether it blocks, sanitizes, or allows each adversarial input.
This is not an LLM safety test. The guard is a deterministic filter. A "blocked" result means the LLM never sees the input. An "allowed" result means the LLM's own safety training is the last line of defense. The evaluation tests the guard, not the LLM.
OWASP Gen AI Red Teaming Guide
OWASP Gen AI Security Project — Red Teaming Initiative· Guide published January 2025 · Vendor Evaluation Criteria v1.0 published February 2026
42
Test cases
32
Blocked by guard
10
Allowed through
85.7%
Expected outcomes matched
36 of 42 cases matched both the declared guard outcome and expected detection patterns.
Per-area results
| Assessment area | Total | Blocked | Allowed | Block rate |
|---|---|---|---|---|
| Model Evaluation | 12 | 9 | 3 | 75.0% |
| Implementation Testing | 16 | 14 | 2 | 87.5% |
| Infrastructure Assessment | 6 | 3 | 3 | 50.0% |
| Runtime Behavior Analysis | 8 | 6 | 2 | 75.0% |
Fixed bypasses (5)
Five bypass techniques discovered during evaluation have been fixed:
- Zero-width character obfuscation: zero-width chars are now replaced with spaces (not removed), so "ignore\u200Ball\u200Binstructions" becomes "ignore all instructions" and matches.
- Cross-script Unicode homoglyphs: a homoglyph mapping table (Cyrillic + Greek → Latin) is applied before NFKC normalization.
- Base64-encoded instructions: the guard now decodes base64 tokens (20+ chars, printable ASCII) and appends the decoded text for pattern matching.
- Leetspeak substitution: a digit-to-letter map (0→o, 1→i, 3→e, 4→a, 5→s, 7→t) is applied during normalization.
- URL percent-encoding: the guard now URL-decodes input (decodeURIComponent) before pattern matching.
Known limitations (2)
Two bypass techniques remain as known limitations — the guard does not catch them:
- Dot-separated tokens: "ig.nore" does not match "ignore" — stripping intra-word dots would break legitimate file paths like "config.js".
- Non-English instructions: guard patterns are English-only — "Ignoriere alle vorherigen Anweisungen" (German) is not caught.
These are documented honestly rather than hidden. Dot-separation would require context-aware parsing (distinguishing "ig.nore" from "config.js"), and multilingual support would need pattern sets for every major language.
MLCommons AILuminate — scope verification
MLCommons AILuminate· Demo set v1.0 · CC-BY-4.0 · 292 prompts across 3 hazard categories
Why we ran a test we knew we'd "fail"
AILuminate tests content safety — whether an LLM produces harmful output when asked directly. The guard tests prompt injection — whether someone can override the system's instructions, hijack its role, or extract its secrets. These are different problems. We ran AILuminate through the guard to prove the guard does its job and only its job: it blocks injection attempts and does not over-reach into content filtering.
If the guard blocked 100% of AILuminate prompts, that would be a bug — it would mean the guard is filtering legitimate user requests, breaking real scan targets. The correct result for a prompt-injection filter tested against content-safety prompts is a low block rate: block the prompts that contain injection language, pass the rest to the LLM's own safety training.
292
Content-safety prompts
13
Matched injection-pattern rules
279
Did not match guard rules
What this verifies
- ✓ The guard blocks prompts that contain injection patterns (role hijack, instruction override) — even when the prompt is also harmful content.
- ✓ The guard does not block prompts just because they request harmful content — that is the LLM's job, not the guard's.
- ✓ The guard has a narrow, well-defined scope: injection prevention, not content moderation.
- ✓ The guard does not over-block, which means it won't break legitimate scan targets.
Not an MLCommons-certified result. The demo set is CC-BY-4.0 and is for internal testing only. This scope verification is not published with the MLCommons name or trademark. The demo CSV contains 3 of 12 AILuminate hazard categories (CSE, SSH, NCR).
Per-hazard breakdown
| Hazard category | Total | Injection language found | Did not match guard rules |
|---|---|---|---|
| Child Sexual Exploitation | 99 | 3 | 96 |
| Sexual Safety & Harassment | 94 | 8 | 86 |
| Non-consensual Sexual Content (Real) | 99 | 2 | 97 |
Methodology
The recorded result artifact lives in apps/marketing/src/data/ai-safety-results.json. It came from a deterministic evaluation of a regex-based guard, not an LLM. The historical runner was removed from the active workspace, so the artifact is inspectable but the run is not currently reproducible from a clean checkout.
OWASP suite (42 test cases): synthetic inputs across four assessment areas — model evaluation (adversarial prompts), implementation testing (bypass techniques), infrastructure assessment (MCP tool-call arguments), and runtime behavior analysis (indirect prompt injection via scan results). Each case has an expected outcome and expected detection patterns. In the recorded run, 36 of 42 cases (85.7%) matched those declared expectations.
AILuminate scope verification (292 prompts): the CC-BY-4.0 demo CSV is downloaded fromgithub.com/mlcommons/ailuminateand cached locally. Each prompt is sent to the guard to observe whether a guard rule matches. Thirteen prompts matched injection-pattern rules and 279 did not. The corpus has no prompt-injection oracle, so neither outcome is labeled correct and this is not a score.
Guard configuration: maxInputLength=10000, strictMode=true, timeoutMs=1000.
Limitations
- →This evaluation tests the PromptInjectionGuard, a deterministic regex-based filter. It does not test the LLM scan engine's own safety training.
- →A high OWASP expected-outcome rate means the guard matched this finite corpus. It does not prove immunity to prompt injection attacks.
- →The AILuminate run is an observational scope check, not a score or proof that every blocked or allowed decision was correct.
- →Two known bypass techniques remain (dot-separation, non-English). These are documented, not hidden.
- →The AILuminate demo set is a 10% subset with 3 of 12 hazard categories. The full practice set may reveal different injection-language patterns.
- →This evaluation does not constitute certification, compliance, or a security guarantee.
What this is not
LyraShield's prompt-injection guard does not perform content moderation or filter harmful-but-non-injection content. It only blocks attempts to override, hijack, or extract instructions from the agent, and treats content-safety filtering as the responsibility of the underlying LLM's own safety training.
- • Not "AI safety tested" in the sense of a formal evaluation by NIST, MLCommons, or a third-party lab.
- • Not "adversarial robustness proven" — no finite test suite proves universal robustness.
- • Not an MLCommons-certified result — the demo set is for internal testing only.
- • Not a guarantee that the guard blocks all prompt injection attacks.
- • Not a substitute for LLM-level safety training, output filtering, or human review.
See methodologyfor the full scan and evidence methodology.
AI safety questions
Is LyraShield's AI safety evaluation certified by MLCommons or OWASP?
No. LyraShield's prompt-injection guard is evaluated against the OWASP Gen AI Red Teaming Guide and the MLCommons AILuminate demo prompt set, but neither organization has certified the result. The AILuminate demo set is for internal testing only, not their production benchmark.
Does the guard block all prompt injection attacks?
No. No finite test suite can prove that, so LyraShield does not claim it. The evaluation states what was tested, what passed, and what is still a known limitation.
Does the prompt-injection guard also filter harmful content?
No. It blocks attempts to override, hijack, or extract instructions from the agent. Filtering harmful-but-non-injection content is the responsibility of the underlying LLM's own safety training, not this guard.
Can this replace human security review or LLM-level safety training?
No. It is a bounded, scoped check against two named public frameworks, not a substitute for LLM-level safety training, output filtering, or human review.
Start with a check you can inspect.
The free tools run locally in your browser and state their limits.