頂石專案:防禦系統實作

class InputFilter:
    """Analyzes user input for injection and policy violations."""
 
    def analyze(self, user_input: str) -> FilterResult:
        signals = []
 
        # Check for instruction override patterns
        override_score = self._check_instruction_override(user_input)
        if override_score > 0.7:
            signals.append(Signal(
                type="injection",
                subtype="instruction_override",
                confidence=override_score,
                evidence=self._extract_override_pattern(user_input),
            ))
 
        # Check for encoding-based evasion
        decoded = self._decode_obfuscation(user_input)
        if decoded != user_input:
            evasion_score = self._check_instruction_override(decoded)
            if evasion_score > 0.5:
                signals.append(Signal(
                    type="injection",
                    subtype="encoded_evasion",
                    confidence=evasion_score,
                    evidence=f"Decoded payload: {decoded[:200]}",
                ))
 
        # Aggregate signals into a decision
        max_confidence = max((s.confidence for s in signals), default=0.0)
        return FilterResult(
            action="block" if max_confidence > 0.8 else
                   "flag" if max_confidence > 0.5 else "allow",
            signals=signals,
            input_hash=sha256(user_input.encode()).hexdigest(),
        )

## Defense Evaluation Summary
 
### Detection Rates by Category
| Attack Category         | Payloads | Detected | Rate   |
|------------------------|----------|----------|--------|
| Direct injection       | 25       | 21       | 84%    |
| Indirect injection     | 15       | 9        | 60%    |
| Role-play jailbreak    | 12       | 7        | 58%    |
| Encoding bypass        | 10       | 8        | 80%    |
| Multi-turn escalation  | 8        | 3        | 38%    |
| Data extraction        | 10       | 8        | 80%    |
| System prompt leak     | 10       | 9        | 90%    |
 
### False Positive Rate
- Benign queries tested: 100
- Incorrectly blocked: 3
- Incorrectly flagged: 7
- False positive rate (block): 3%
- False positive rate (block + flag): 10%
 
### Performance Impact
| Layer          | P50 Latency | P99 Latency |
|---------------|-------------|-------------|
| Rate limiter  | 2ms         | 5ms         |
| Input filter  | 45ms        | 120ms       |
| Output monitor| 35ms        | 95ms        |
| Logging       | 8ms         | 20ms        |
| **Total**     | **90ms**    | **240ms**   |