Kavach

Try it — live detection

Paste any text below and see exactly what Kavach's input cascade decides. This runs the real Stage 1 + Stage 2 detectors against your text only — nothing here is ever forwarded to a model.

How detection works: a two-stage cascade

• Stage 1 — heuristics. 12 deterministic rules (attack-signature regexes, encoding/ obfuscation checks, structural role-injection detection) run on every request. Sub-millisecond on typical traffic (0.295ms p95, measured on real validation traffic).
• Stage 2 — semantic similarity. Requests Stage 1 doesn't already resolve are embedded (MiniLM, Xenova/all-MiniLM-L6-v2) and compared against a curated reference index of known attacks, chunked so long inputs don't dilute a short injected span.
• Escalation is automatic, not always-on. Stage 2 only runs when Stage 1 hasn't already reached a verdict, so the common case stays fast.
• Configurable per key — sensitivity (strict / balanced / permissive) and an explicit fail-open vs. fail-closed policy for what happens if detection itself becomes unavailable.

Measured, not assumed

Detection and false-positive numbers below are measured on a held-out validation split of a ~23.8K-prompt benchmark corpus (JailbreakBench, HackAPrompt, deepset, LMSYS and others), not asserted.

The repo documents negative results too, not just wins — a third detection stage (a learned classifier) was measured and found to genuinely catch attacks the two stages above miss, but was deliberately kept out of the live cascade after measurement showed it would multiply false-positive rate ~4-4.5x on the specific traffic it would actually see in production. Full writeup in the repo's architecture doc.

Example: a blocked request

A request carrying an instruction-override / system-prompt-extraction attempt, sent to Kavach instead of the model provider directly:

Kavach's response — HTTP 400, blocked before the model ever sees it: