Dicklesworthstone/acip

What it solves

ACIP addresses the vulnerability of Large Language Models (LLMs) to prompt injection attacks. These attacks range from direct user manipulation (e.g., "ignore previous instructions") to indirect injections where malicious commands are hidden within retrieved documents, webpages, or tool outputs (RAG). It specifically targets sophisticated methods like psychological manipulation, obfuscation, and multi-turn capability aggregation.

How it works

ACIP is a framework of engineered prompts (available in multiple versions) that act as a "cognitive inoculation." It fortifies the model by providing explicit instructions on how to recognize and neutralize threats. Key mechanisms include:

• Instruction Hierarchy: Establishes a clear trust boundary where system and developer instructions override user input, and untrusted content (like RAG results) is treated strictly as data, not instructions.
• Decision Discipline: A behavioral framework that guides the model to classify a request's risk level (Safe, Sensitive-Allowed, or Disallowed) before generating a response.
• Domain Rubrics: Detailed guidelines for high-risk areas (Cybersecurity, Chemical/Bio, Physical Safety, Self-Harm, Financial, and Privacy) to ensure consistent refusal patterns.
• Threat Recognition: Explicitly defines attack vectors like "authority laundering," "benign transformation loopholes," and "covert channels" to close semantic gaps attackers use to bypass filters.
• Graduated Response: Implements a "ratchet" system where the model becomes less verbose in its refusals after repeated suspicious attempts in a single session.

Who it’s for

Developers and security operators deploying LLMs in production environments, particularly those integrating RAG, external tools, or handling sensitive high-risk domains where robust input validation and prompt-level defense are necessary.

Highlights

• Multi-versioned approach: Offers different versions (v1.0, v1.2, v1.3) tailored to different token budgets and risk profiles.
• Audit Mode: An optional, machine-parseable tagging system for operators to monitor blocked attacks without leaking detection logic to the user.
• RAG Hardening: Specific protections against indirect prompt injection from external data sources.
• Compound Signal Detection: Guidance for models to recognize when multiple weak risk signals combine into a high-risk attack.