Repository navigation
Recipe 26: Prompt-injection screening #26
Description
Recipe 26 of 60 · Level 3 (Intermediate) · Trust & security ·
Noul
Use case
Flag instruction-redirection attempts in retrieved text using adversarial and benign quotation fixtures to measure false positives and missed attacks.
What to build
The folder recipes/26-prompt-injection-screening/ with notebook.ipynb, README.md, and fixtures/, meeting the recipe contract. Start from python tools/new_recipe.py 26 and the template in recipes/_template/.
Build notes
- Fixtures must cover all four combinations of the two propositions, not two complementary groups. An earlier wording of this bullet said "two groups" and produced a fixture set in which
discusseswas the mechanical complement ofredirect, so the secondNoulcould not change any composed outcome and scored a perfect F1 by construction (found by the Opus review of PR Recipe 26: prompt-injection screening #206, comment 6092513082). Required: text that redirects only; text that discusses or quotes only; text where both hold at once (for example a passage that discusses injection and also carries a live attempt); and text where neither holds (ordinary content that is not about prompt injection at all, the "no match" case ofCONTRIBUTING.mdsection 5). The both-and-neither cases are the hard cases this recipe is judged on, and they are what justifies two independentNoulquestions instead of oneChoice. - Report false positives and missed attacks separately.
- State that screening is one layer of defence and no guarantee. S07 documents the model's limits on adversarial content.
Decision design
- Noul. Write each proposition as a statement that is true or false. One independent question per label or concern, sent together in one request. Noul has no confidence field, so each threshold is chosen from examples and evaluated.
Level 3 scope
Multiple judgments or stages, structured evidence, deterministic composition, and task-level evaluation.
Acceptance criteria
-
recipes/26-prompt-injection-screening/notebook.ipynbruns top to bottom offline, with no key and no network, and its outputs are committed - Live mode is opt-in (
JEV_COOKBOOK_LIVE=1withTYPESAFE_API_KEY) and uses the same question definitions as the offline run - Fixtures are synthetic, include the hard cases named in the build notes, carry gold labels, and pass the fixture validator
- Every response fixture records its provenance, and the notebook states which mode it ran in
- Evaluation: Miss rate on the adversarial group and false-positive rate on the benign group at the chosen threshold.
- The deterministic composition lives in a Python function with tests in
tests/ - Evaluation is at task level, not only per question
- Each of the two propositions is independently consequential: flipping one stored decision changes at least one composed outcome, and a test proves it. A per-label metric that is perfect by construction is reported as such or not reported
- No statement about Jev's quality, latency, or cost appears without recorded live inference; in a synthetic run, metrics are labelled as pipeline checks
-
recipes/26-prompt-injection-screening/README.mdsays what the recipe teaches, how to run it, and what was and was not measured live - The pull request changes only
recipes/26-prompt-injection-screening/and CI is green
Dependencies
- Blocked by Foundation: CI executes every notebook offline and validates fixtures #69 (CI executes every notebook offline and validates fixtures)
- Tracked in Epic: Level 3 · Intermediate recipes #77
Sources
Read these before writing the questions.
- S02 · TypeSafe AI: Primitives (Questions): Choice, Noul, Score, independent questions, and dependent follow-up calls.
- S03 · TypeSafe AI: Confidence: Distribution-derived confidence and task-specific thresholds informed by observed outcomes.
- S04 · TypeSafe AI: How to build with TypeSafe: Narrow semantic judgments integrated with workflows, deterministic logic, and side effects controlled by code.
- S07 · TypeSafe AI: Jev 1.13 jaggedness: Version-specific limitations affecting arithmetic, context selection, adversarial content, and generation.
Out of scope
- Changes to shared code, the catalog, or the root README. If the shared package is missing something, open a foundation issue and link it here.
- Real side effects of any kind. Actions are simulated.
Activity
CompleteDotTech commentedon Oct 10, 2026
Issue text amended by the orchestrator after the Opus review of PR #206 (comment 6092513082) showed that this issue's own Build notes caused a real defect in the recipe.
What was wrong. The Build notes said "Fixtures in two groups: adversarial text that tries to redirect instructions, and benign text that quotes or discusses such attempts." Two complementary groups is a specification for complementary labels, and that is what the builder produced:
build_fixtures.pyderivesdiscussesas the mechanical complement ofredirect, so no fixture has both labels true or both false. The reviewer measured the consequence — the composed outcome ofhelpers.screenis identical on all 40 fixtures to aredirect-only rule, flipping any storeddiscussesdecision changes zero outcomes, andevaluation-testprintsdiscusses alone: f1 1.0000without noting that the 1.0 is perfect by construction. The recipe's own justification for twoNoulquestions rather than oneChoice— that both can hold at once, or neither — is never exercised, and the "mixed" and "no match" hard cases ofCONTRIBUTING.mdsection 5 are both absent.What changed here. The two-groups bullet is replaced by one requiring all four combinations: redirect only, discusses or quotes only, both at once, and neither (ordinary content not about prompt injection at all). A new acceptance criterion requires each proposition to be independently consequential — flipping one stored decision must change at least one composed outcome, with a test proving it — and requires a per-label metric that is perfect by construction to be reported as such or not reported at all. Nothing else in the issue was touched.
Scope of the correction. This is the issue text catching up with what the contract already required, not a new requirement invented late. PR #206's fix round is briefed against the amended text.
For whoever writes the next multi-label
Noulissue: name the mixed and neither cases explicitly in the Build notes. A fixture specification that lists exactly as many groups as there are labels will keep producing label sets that cannot disagree.Fix round 1: break the discusses/redirect complement, prove independe…