experiment: pluggable guardrails evaluation for Story 6

AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+See [CLAUDE.md](CLAUDE.md) for project rules and design decisions.

CLAUDE.md

@@ -10,6 +10,8 @@ Fullsend is a living design document exploring fully autonomous agentic developm
 - The security threat model (threat priority: external injection > insider > drift > supply chain) should inform all other documents.
 - Keep core problem documents organization-agnostic. Organization-specific details belong in `docs/problems/applied/<org-name>/`.
 - The target audience is any contributor community considering autonomous agents — keep language accessible, avoid presuming solutions.
+- Always run `pre-commit run --files <changed-files>` before submitting changes and fix any failures.
+- Never commit secrets (tokens, API keys, PEM keys, gcloud credentials) or sensitive data (GCP project names, service account identifiers, Model Armor template names, internal hostnames). Use environment variables with no defaults for sensitive values.
 
 ## Key design decisions made
 

experiments/guardrails-eval/.gitignore

@@ -0,0 +1,6 @@
+# Virtual environment
+.venv/
+
+# Python bytecode
+__pycache__/
+*.pyc

experiments/guardrails-eval/README.md

@@ -0,0 +1,108 @@
+# Experiment: Pluggable Guardrails Evaluation
+
+Evaluates prompt injection scanning tools as pre-LLM guardrails for fullsend's autonomous SDLC pipeline. Extends the [Model Armor experiment](../model-armor-vs-agent-triage/) (PR #117) with additional attack payloads and alternative scanning backends.
+
+Related: [Story 6 (#129)](https://github.com/fullsend-ai/fullsend/issues/129) — Prompt injection defense
+
+## Hypothesis
+
+LLM Guard's DeBERTa-v3 classifier with sentence-level matching detects prompt injection attacks that Model Armor misses, including unicode/encoding tricks and indirect injection via file content.
+
+## Background
+
+PR #117 found that Model Armor detected only 1/4 injection payloads (25%) at maximum sensitivity. The [prompt-injection-defense](../prompt-injection-defense/) experiment found that Claude Sonnet 4.6 is inherently resilient, but the DeBERTa v1 classifier "adds no value" beyond what the model catches.
+
+This experiment tests whether:
+1. LLM Guard's v2 classifier with sentence-level matching improves detection
+2. NeMo Guardrails' YARA rules catch LLM prompt injection (spoiler: they don't)
+3. Model Armor handles extended attack types (unicode, indirect injection)
+
+## Attack Payloads
+
+### Original (from `../prompt-injection-defense/attacks/`)
+
+| Payload | Technique |
+|---------|-----------|
+| benign | Clean commit message (control) |
+| obvious-injection | "Ignore all previous instructions" |
+| subtle-injection | Social engineering ("already approved") |
+| bypass-classifier | Social engineering in git trailers |
+| bypass-sandwiching | Mimics sandwich defense closing instruction |
+| bypass-spotlighting | Closes data markers early |
+
+### Extended (new in `payloads/`)
+
+| Payload | Technique | Category |
+|---------|-----------|----------|
+| unicode-homoglyph | Cyrillic characters replacing Latin | unicode/encoding |
+| zero-width-chars | ZWNJ (U+200C) between trigger word chars | unicode/encoding |
+| base64-encoded | Injection instructions as base64 string | encoding |
+| indirect-code-comment | Injection disguised as TODO comments | indirect |
+| indirect-review-feedback | Fake review feedback requesting escalation | indirect |
+| indirect-ci-output | Injection in fake test failure SUGGESTION | indirect |
+| indirect-multistep | Benign project config planting later instructions | indirect |
+
+## Results
+
+| Category | Model Armor | LLM Guard (full) | LLM Guard (sentence) |
+|----------|-------------|-------------------|----------------------|
+| Original (social engineering) | 1/5 (20%) | 2/5 (40%) | 5/5 (100%) |
+| Unicode/encoding | 0/2 (0%) | 1/2 (50%) | 2/2 (100%) |
+| Indirect injection | 0/4 (0%) | 0/4 (0%) | 3/4 (75%) |
+| Encoding (base64) | 0/1 (0%) | 0/1 (0%) | 0/1 (0%) |
+| **Overall** | **1/12 (8%)** | **3/12 (25%)** | **10/12 (83%)** |
+| **False positives** | **0/1** | **0/1** | **0/1** |
+
+### Key Findings
+
+1. **LLM Guard sentence mode: 83% detection, 0 false positives.** Sentence-level splitting isolates social engineering phrases for independent classification, catching attacks diluted in full-text scanning.
+
+2. **Model Armor: 8% detection.** Only catches crude "ignore all instructions." Same dilution problem as LLM Guard full mode — detects social engineering in isolation but misses when embedded in larger text. No sentence-splitting option.
+
+3. **Two fundamentally undetectable attack classes:** Base64 encoding (classifier sees random alphanumeric) and multi-step delayed injection (each step individually benign). These require architectural mitigations (CODEOWNERS, permission boundaries).
+
+### Latency
+
+Measured on Intel i7-1365U (10c/12t, 5.2GHz), 32GB RAM. GitHub Actions `ubuntu-latest` (4 vCPU, 16GB) expected ~2-3x slower.
+
+| Scanner | Local Latency | Est. Actions Runner |
+|---------|---------------|---------------------|
+| LLM Guard (sentence, ONNX CPU) | 216ms | ~450-650ms |
+| LLM Guard (full, ONNX CPU) | 72ms | ~150-200ms |
+| Model Armor (GCP) | 216ms | ~216ms (network-bound) |
+
+## Running
+
+```bash
+cd experiments/guardrails-eval
+uv venv .venv
+uv pip install "llm-guard[onnxruntime]" pyyaml yara-python nemoguardrails
+
+# LLM Guard evaluation (original payloads)
+uv run python eval-llm-guard.py
+
+# NeMo / YARA comparison
+uv run python eval-nemo-guardrails.py
+
+# Full 13-payload evaluation (LLM Guard + InvisibleText)
+uv run python eval-extended.py
+
+# Model Armor evaluation (requires GCP auth + env vars)
+# export GCP_PROJECT_ID=<your-gcp-project>
+# export MODEL_ARMOR_TEMPLATE=<your-template-name>
+# gcloud auth activate-service-account --key-file=<sa-key.json>
+uv run python eval-model-armor.py
+```
+
+## Recommendation
+
+Use **LLM Guard with `match_type=SENTENCE`** as the default always-on local scanner in fullsend workflows. Cloud scanners (Model Armor, promptfoo Enterprise) are optional parallel checks but currently add no unique detection capability.
+
+```python
+from llm_guard.input_scanners import PromptInjection
+from llm_guard.input_scanners.prompt_injection import MatchType
+
+scanner = PromptInjection(threshold=0.92, match_type=MatchType.SENTENCE, use_onnx=True)
+sanitized, is_valid, risk_score = scanner.scan(text)
+# is_valid=False means injection detected
+```

experiments/guardrails-eval/eval-extended.py

@@ -0,0 +1,191 @@
+"""Evaluate LLM Guard against extended payload set including unicode/encoding,
+token-boundary, and indirect injection attacks.
+
+Runs both original PR #117 payloads and new extended payloads through
+LLM Guard's PromptInjection scanner in sentence mode (recommended config).
+"""
+
+import sys
+import time
+from pathlib import Path
+
+import yaml
+from llm_guard.input_scanners import InvisibleText, PromptInjection
+from llm_guard.input_scanners.prompt_injection import MatchType
+
+ORIGINAL_DIR = Path(__file__).parent.parent / "prompt-injection-defense" / "attacks"
+EXTENDED_DIR = Path(__file__).parent / "payloads"
+
+
+def load_payloads(directory: Path) -> list[dict]:
+    payloads = []
+    for path in sorted(directory.glob("*.yaml")):
+        with open(path) as f:
+            data = yaml.safe_load(f)
+        payloads.append(data)
+    return payloads
+
+
+def scan_payload(scanner, text: str) -> tuple[bool, float, float]:
+    start = time.perf_counter()
+    sanitized, is_valid, risk_score = scanner.scan(text)
+    elapsed_ms = (time.perf_counter() - start) * 1000
+    return not is_valid, risk_score, elapsed_ms
+
+
+def run_eval(payloads: list[dict], label: str, scanner_full, scanner_sentence, invisible_scanner):
+    print(f"\n{'=' * 100}")
+    print(f"  {label}")
+    print(f"{'=' * 100}")
+
+    results = []
+    for payload in payloads:
+        name = payload["name"]
+        text = payload["commit_message"]
+        technique = payload.get("technique", "original")
+
+        det_full, score_full, lat_full = scan_payload(scanner_full, text)
+        det_sent, score_sent, lat_sent = scan_payload(scanner_sentence, text)
+
+        # Also run InvisibleText scanner for unicode payloads
+        inv_det = False
+        inv_detail = ""
+        if technique in ("unicode/encoding", "encoding"):
+            inv_start = time.perf_counter()
+            _, inv_valid, inv_score = invisible_scanner.scan(text)
+            inv_elapsed = (time.perf_counter() - inv_start) * 1000
+            inv_det = not inv_valid
+            inv_detail = (
+                f"{'DETECTED' if inv_det else 'CLEAN'} ({inv_score:.2f}, {inv_elapsed:.0f}ms)"
+            )
+
+        is_attack = name != "benign"
+        results.append(
+            {
+                "name": name,
+                "technique": technique,
+                "det_full": det_full,
+                "det_sentence": det_sent,
+                "score_full": score_full,
+                "score_sentence": score_sent,
+                "lat_full": lat_full,
+                "lat_sentence": lat_sent,
+                "invisible": inv_detail,
+                "is_attack": is_attack,
+            }
+        )
+
+        status_f = "DETECTED" if det_full else "CLEAN"
+        status_s = "DETECTED" if det_sent else "CLEAN"
+        inv_str = f" | InvisibleText: {inv_detail}" if inv_detail else ""
+        print(
+            f"  {name:<28} full={status_f:<8} sent={status_s:<8} "
+            f"score_f={score_full:+.4f} score_s={score_sent:+.4f}{inv_str}"
+        )
+
+    return results
+
+
+def print_summary_table(all_results: list[dict]):
+    print(f"\n{'=' * 120}")
+    print("FULL COMPARISON TABLE")
+    print(f"{'=' * 120}")
+
+    header = (
+        f"| {'Payload':<28} | {'Technique':<18} | {'Full Mode':<10} | "
+        f"{'Sentence':<10} | {'Score (F)':<10} | {'Score (S)':<10} | "
+        f"{'Latency':<8} | {'InvisibleText':<20} |"
+    )
+    print(header)
+    print("|" + "|".join(["-" * n for n in [30, 20, 12, 12, 12, 12, 10, 22]]) + "|")
+
+    for r in all_results:
+        sf = "DETECTED" if r["det_full"] else "CLEAN"
+        ss = "DETECTED" if r["det_sentence"] else "CLEAN"
+        inv = r["invisible"] if r["invisible"] else "N/A"
+        print(
+            f"| {r['name']:<28} | {r['technique']:<18} | {sf:<10} | "
+            f"{ss:<10} | {r['score_full']:+10.4f} | {r['score_sentence']:+10.4f} | "
+            f"{r['lat_sentence']:<6.0f}ms | {inv:<20} |"
+        )
+
+    # Detection rates by category
+    print(f"\n{'=' * 80}")
+    print("DETECTION RATES BY CATEGORY")
+    print(f"{'=' * 80}")
+
+    categories = {}
+    for r in all_results:
+        if not r["is_attack"]:
+            continue
+        cat = r["technique"]
+        if cat not in categories:
+            categories[cat] = {"full": [], "sentence": []}
+        categories[cat]["full"].append(r["det_full"])
+        categories[cat]["sentence"].append(r["det_sentence"])
+
+    for cat, data in sorted(categories.items()):
+        n = len(data["full"])
+        df = sum(data["full"])
+        ds = sum(data["sentence"])
+        pct_f = 100 * df / n
+        pct_s = 100 * ds / n
+        print(f"  {cat:<25} full: {df}/{n} ({pct_f:.0f}%)   sentence: {ds}/{n} ({pct_s:.0f}%)")
+
+    # Overall
+    attacks = [r for r in all_results if r["is_attack"]]
+    n = len(attacks)
+    df_total = sum(r["det_full"] for r in attacks)
+    ds_total = sum(r["det_sentence"] for r in attacks)
+    pct_f = 100 * df_total / n
+    pct_s = 100 * ds_total / n
+    lbl = "OVERALL"
+    print(f"\n  {lbl:<25} full: {df_total}/{n} ({pct_f:.0f}%)")
+    print(f"  {'':<25} sentence: {ds_total}/{n} ({pct_s:.0f}%)")
+
+    # False positives
+    benign = [r for r in all_results if not r["is_attack"]]
+    fp_full = sum(r["det_full"] for r in benign)
+    fp_sent = sum(r["det_sentence"] for r in benign)
+    nb = len(benign)
+    print(f"\n  False positives (benign):  full: {fp_full}/{nb}   sentence: {fp_sent}/{nb}")
+
+
+def main():
+    if not ORIGINAL_DIR.exists():
+        print(f"Original payloads not found: {ORIGINAL_DIR}")
+        sys.exit(1)
+    if not EXTENDED_DIR.exists():
+        print(f"Extended payloads not found: {EXTENDED_DIR}")
+        sys.exit(1)
+
+    # Initialize scanners
+    print("Initializing scanners...")
+    scanner_full = PromptInjection(threshold=0.92, match_type=MatchType.FULL, use_onnx=True)
+    scanner_sentence = PromptInjection(threshold=0.92, match_type=MatchType.SENTENCE, use_onnx=True)
+    invisible_scanner = InvisibleText()
+
+    # Load payloads
+    original = load_payloads(ORIGINAL_DIR)
+    extended = load_payloads(EXTENDED_DIR)
+    print(f"Loaded {len(original)} original + {len(extended)} extended payloads")
+
+    # Run evals
+    results_orig = run_eval(
+        original, "ORIGINAL PAYLOADS (PR #117)", scanner_full, scanner_sentence, invisible_scanner
+    )
+    results_ext = run_eval(
+        extended,
+        "EXTENDED PAYLOADS (unicode/indirect)",
+        scanner_full,
+        scanner_sentence,
+        invisible_scanner,
+    )
+
+    # Combined summary
+    all_results = results_orig + results_ext
+    print_summary_table(all_results)
+
+
+if __name__ == "__main__":
+    main()