---
license: mit
language:
  - en
library_name: onnx
pipeline_tag: text-classification
tags:
  - prompt-injection
  - jailbreak
  - llm-security
  - guardrail
  - onnx
metrics:
  - recall
  - false_positive_rate
---

# promptpurify model card

**Tiny prompt-injection detector. ~14 MB. CPU. Built from scratch by
[SecureLayer7](https://securelayer7.net).**

## Intended use

Single-turn classification of untrusted text into `benign` vs
`prompt-injection`. Sits between user input (or a retrieved RAG chunk,
or a tool output) and your LLM call. Outputs a probability score; you
decide the threshold and the policy.

```ts
import { createL5eRunner } from "promptpurify/l5";
const guard = await createL5eRunner();
const score = await guard.score(userMessage);
if (score >= 0.95) return refusal();
```

Full integration patterns: [docs/QUICKSTART.md](docs/QUICKSTART.md).

## At a glance

| | |
|---|---|
| Type | ONNX transformer classifier |
| Size on disk | **~14 MB (INT8)** |
| Inference | CPU, single-digit ms |
| Runtime | `onnxruntime-node` (optional peer) |
| Network | **None.** In-process. |

## Training

Built from scratch by SecureLayer7 on curated internal corpora.

## Evaluation

Benchmarked against public datasets and OSS baselines. Comparison and
methodology: [docs/BENCHMARKS.md](docs/BENCHMARKS.md). Reproducibility:
[docs/REPRODUCE.md](docs/REPRODUCE.md). Bench script
`scripts/bench.mjs` re-scores the shipped public eval slice with this
exact model artifact.

## Out of scope

- Single-turn scoring only — pair with conversation-level monitoring.
- Content moderation (toxicity, hate, CSAM, self-harm) — pair with a
  content classifier.
- Authentication and tool-scope enforcement are application
  responsibilities, not the model's.

See [docs/HONEST-LIMITS.md](docs/HONEST-LIMITS.md).

## Bias

The model is English-strongest. Operators serving multilingual traffic
should calibrate the threshold per language. The model has no access
to user identity, account state, or conversation history.

## License

MIT for both the SDK and the model weights.

Public datasets we evaluate against (and the OSS baseline models we
compare to) carry their own upstream licenses — see
[`training/CORPUS_LICENSES.json`](training/CORPUS_LICENSES.json).

## Integrity verification

Every model artifact is checksummed. Verify before extracting:

```bash
sha256sum -c models/l5e/SHA256SUMS
```

The release tarball is additionally cosign-signed with keyless
Sigstore.

## Distribution mirrors

| Mirror | URL |
|---|---|
| GitHub Releases | `https://github.com/securelayer7/PROMPTPurify/releases` |
| Hugging Face Hub | [`Securelayer7/promptpurify`](https://huggingface.co/Securelayer7/promptpurify) |

## Contact

- Security disclosures: [`SECURITY.md`](SECURITY.md) →
  `info@securelayer7.net`
- General: [GitHub Issues](https://github.com/securelayer7/PROMPTPurify/issues)

## Acknowledgments

Name and design philosophy inspired by
[DOMPurify](https://github.com/cure53/DOMPurify) by [Cure53](https://cure53.de).
Thanks to **Mario Heiderich** for suggesting the name.