Yesterday somebody on r/PromptEngineering dropped a proxy layer that scans every prompt before it reaches the model. u/GiiTZzz got tired of watching SSNs and card numbers slip into support chats, so they built a filter: regex for SSN and email shapes, Luhn validation for card numbers, a blocklist of known injection phrases. Anything that matches never reaches the provider.
The twist: input scanning wasn’t the part that mattered most. Checking the model’s reply caught leaks the input scan never would have. One commenter watched the same trick catch their own model regurgitating test data it had memorized from a forgotten system prompt. The leak wasn’t in what went in, it was in what came back out.
Here’s the mini-workflow if you want to try this on your own stack:
- 🛡️ Regex-match the obvious shapes first (SSN, email, phone) before anything touches the model
- 🔢 Run Luhn validation on anything number-shaped that looks like a card
- 🚫 Keep a blocklist of injection phrases like “ignore the above” and block on match
- 🔁 Scan the OUTPUT too, not just the input. That’s where the real surprises live
Pro tip: the hard part isn’t catching leaks, it’s not catching your own users by accident. Too strict and you block someone’s legit phone number or an innocent “ignore the noise above.” Too loose and the actual SSN slides through. Nobody in the thread claims to have that balance nailed yet, and that’s the honest state of the art right now. GiiTZzz has a live version up at apptechlab.com/p/llmfirewall if you want to try to break it yourself.
If you’re piping user input into a model in production, go scan your outputs, not just your inputs. That’s usually where the real leak hides. ⚓
Frequently Asked Questions
Q: Should I scan model outputs, or just inputs?
Definitely both. Output scanning caught one user’s model regurgitating test data from their system prompt – something input scanning alone would have missed. Even if a prompt is clean going in, the model can leak sensitive information on the way back out.
Q: How do you balance false positives vs false negatives?
It’s a trade-off with no perfect answer. Too strict and you block innocent conversation (phone numbers, phrases like “ignore the above”), too loose and real threats slip through. Start conservative, monitor what gets blocked, and whitelist safe patterns as you learn your actual traffic.
Q: Can scanning alone protect me?
Scanning input and output helps, but don’t forget to audit your system prompts – sensitive test data, API keys, or credentials baked into the prompt itself won’t get caught by scanning. A model can leak whatever’s already in the prompt.
Q: Should I use regex or a classifier for injection detection?
The author went with regex and known injection phrase lists in production – simpler, faster, and more predictable than an ML classifier. You could add a small classifier later if you spot novel evasion attempts, but regex gets you far and keeps the logic transparent.
How are you catching PII / prompt-injection before it hits the model? Sharing my regex+Luhn approach and where it falls down.
by u/GiiTZzz in PromptEngineering