Attackers commonly use prompt injection to target AI applications. To address this challenge, SecureLayer7 has released Promptpurify, which is an open-source prompt-injection firewall that sits between user inputs and large language models (LLMs).
Designed to be lightweight and CPU-only, it runs directly alongside the AI application on the same machine. Unlike many guardrail solutions that require large models, GPUs, hosted APIs, or extra services, Promptpurify operates locally with minimal deployment requirements.
How We Built Promptpurify
We built Promptpurify because many existing open-source guardrails are difficult to deploy in production environments. Our primary objective is to create a prompt-injection defense that developers could run directly alongside their applications without introducing new infrastructure or deployment overhead.
Key Features of Promptpurify
Promptpurify has been designed to be lightweight, easy to integrate, and practical for real-world AI systems. Promptpurify combines prompt-injection detection, deterministic security controls, and lightweight deployment into a single package.
The following capabilities make it suitable for protecting LLM-powered applications across cloud-hosted and self-hosted environments:
- Easy integration in just 3-lines: Promptpurify sits between user input and the target LLM, so your app can score, block, or review prompts before they reach the model.
- Lightweight design: The ONNX model is about 14 MB, much smaller than many open-source guardrails that can be hundreds of megabytes or even several gigabytes.
- Runs fast only on CPUs: You get single-digit millisecond latency without needing GPU acceleration.
- In-process deployment: Runs directly inside a Node.js application instead of as a sidecar service or hosted API.
- Works with any LLM: Compatible with Groq, OpenAI, Anthropic, vLLM, and local language models.
- Provides a structural firewall: Features like Unicode normalization, role-fenced messages, sink policies, and output exfiltration guards are included.
- Model built from scratch: It has been trained from random initialization and does not reuse teacher weights from vendor classifiers.
- MIT-licensed weights and SDK: You can use them in production, whether your project is commercial or not.
- Releases you can verify: Each release comes with provenance attestations, signatures, checksums, and SBOM documentation.
Getting Started
To get started with Promptpurify, install the lightweight SDK. Follow the installation steps below:
The model is distributed separately from the npm package, so the SDK remains lightweight for developers who only need the structural firewall.
For detailed installation instructions and integration patterns, refer to the Quickstart documentation.
How Promptpurify Works
Promptpurify has two main components:
- Structural firewall
- Promptpurify model
1.Structural Firewall
User input first passes through the structural firewall, which conducts four checks:
- Unicode normalization: Removes zero-width and bidi (bi-directional) smuggling, decodes regional-indicator steganography, and enforces per-sink length limits.
- Structure and fencing: Implements per-call nonce fences, neutralizes forged chat-template tokens, and enforces role separation to prevent untrusted text from appearing in the system role.
- Sink policy: Applies context-specific rules for trusted instructions, untrusted user input, tool output, and retrieved content.
- Tripwire regex: Flags known jailbreak patterns for logging, rate limiting, and honeypots. These checks are advisory and do not block by default.
2. Promptpurify model
The second layer is a compact ONNX transformer classifier developed by SecureLayer7. The model is about 14 MB in INT8 format, runs locally with onnxruntime-node, requires no network connectivity, and performs inference in single-digit milliseconds on CPUs.
Limitations of Promptpurify
We built Promptpurify to defend against prompt-injection attacks, but we also want to be transparent about what it does and its limitations: .
- It is not a guarantee: There is no .safe boolean, and no security tool can guarantee that every prompt-injection attempt will be detected or blocked.
- It is not a content classifier: Promptpurify focuses on prompt-injection detection rather than content moderation.
- It is not a multi-turn auditor: Promptpurify is not designed to perform conversation-level analysis across multiple interactions.
Conclusion
Promptpurify fills a critical gap for developers who need reliable, local prompt-injection protection without unnecessary complexity. Its open-source nature and minimal requirements make it easy to adopt and adapt, empowering teams to secure their AI applications with confidence.
Additional Details:
Verified Release
We ship Promptpurify with signed and verifiable releases.
The npm package includes provenance attestations, while model releases include Sigstore signatures, SLSA build provenance attestations, SHA256 manifests, and CycloneDX SBOM documentation.
Acknowledgments
The name and design philosophy behind Promptpurify are inspired by DOMPurify by Cure53.
Licences
The SDK and model weights are licensed under MIT.
