Open Source · Apache 2.0

Oubliette Shield

The AI firewall that detects prompt injections, deceives attackers with honeypots, and generates threat intelligence. Pre-filter decisions in under a millisecond (0.006 ms median, 2026-04-22 throughput run).

Install from PyPI View Source

Three Pillars of AI Defense

Detection alone isn't enough. Oubliette combines detection, deception, and intelligence into a unified platform.

Detection

5-stage tiered ensemble pipeline. The pre-filter blocks obvious attacks in under a millisecond; the LLM judge is reserved for inputs the earlier stages cannot settle.

11 pre-filter rules<1ms pre-filter

Deception

Three deception modes turn attacks into intelligence-gathering operations. Honeypot returns fake data, Tarpit wastes attacker time, Redirect steers conversations.

HoneypotTarpitRedirectHoney Tokens

Intelligence

Every detected attack generates structured threat intelligence. STIX 2.1 export, MITRE ATLAS mapping (v2026.06), IOC extraction, CEF logging for SIEM integration.

STIX 2.1MITRE ATLASIOC ExtractCEF Logging

5-Stage Detection Pipeline

Block obvious attacks in under a millisecond. Reserve expensive LLM calls for the inputs that need them.

Input Sanitizer

<1ms

Strips 9 types of encoding attacks, Unicode obfuscation, and invisible characters before any analysis begins.

Pre-Filter

<1ms

11 pre-filter rules block obvious prompt injections, jailbreaks, and DAN attacks. Sub-millisecond: 0.11 ms mean in the 2026-03-12 comparison run.

ML Classifier

733 features

Server/demo model: LogisticRegression + TF-IDF with 733 features. Weighted F1 0.98 / ROC-AUC 0.99 on a held-out split of template-generated training data; not yet evaluated on an external dataset. Catches sophisticated attacks the pre-filter misses.

LLM Judge

12 LLM-judge providers

Only inputs the earlier stages cannot settle reach the LLM judge. Supports OpenAI, Anthropic, Azure, Bedrock, Vertex, Ollama, and more.

Session Tracker

multi-turn

Accumulates attack signals across conversation turns. Escalates sessions when thresholds are exceeded.

"Most attacks are obvious — a pattern match catches it in under a millisecond. Only the truly ambiguous inputs need the full LLM judge."

ML Classifier Details

A lightweight linear model that runs on every request. Figures below are for the server/demo model.

Architecture

ModelLogisticRegression
Feature ExtractionTF-IDF + Structural
Feature Dimensions733
Training Samples1,365
Categories553 benign / 812 malicious

Performance

Weighted F1 (held-out split)0.98
ROC-AUC (held-out split)0.99
False positives0 / 111 benign
5-fold CV F10.986

Server/demo model (733 features), not the lighter model bundled with the pip package. Weighted F1 0.98 / ROC-AUC 0.99 on a stratified 20% split (273 samples) of our 1,365-sample template-generated training set; 5-fold CV F1 0.986; 0 false positives on 111 benign messages in that evaluation split. Not yet evaluated on an external dataset.

12 LLM-Judge Providers

Use any of these as your judge backend. Switch with a single config change.

Ollama

OpenAI

Azure OpenAI

Anthropic

AWS Bedrock

Google Vertex AI

Google Gemini

llama.cpp

Any OpenAI-compatible server (vLLM, LocalAI, LM Studio)

Local Hugging Face classifier

Fallback chain

Ollama runs in plain and structured-output modes. The OpenAI-compatible judge is unit-tested with a mocked call; there is no live vLLM, LocalAI or LM Studio test yet, and other OpenAI-compatible endpoints are untested.

Quick Start

Drop-in integration with your existing stack. Choose your framework:

quickstart.py

from oubliette_shield import Shield

shield = Shield(provider="openai")
result = shield.analyze("user input here")

if result.blocked:
    print("Attack detected!", result.verdict)

app.py

from flask import Flask
from oubliette_shield import Shield, create_shield_blueprint

app = Flask(__name__)
shield = Shield(provider="ollama")
app.register_blueprint(
    create_shield_blueprint(shield)
)

chain.py

from oubliette_shield.integrations.langchain import (
    OublietteCallbackHandler
)

handler = OublietteCallbackHandler(
    shield_url="http://localhost:5000"
)
chain.invoke(
    input,
    config={"callbacks": [handler]}
)

main.py

from fastapi import FastAPI
from oubliette_shield.integrations.fastapi import (
    ShieldMiddleware
)

app = FastAPI()
app.add_middleware(
    ShieldMiddleware,
    shield_url="http://localhost:5000"
)

pip install oubliette-shield[langchain,fastapi,litellm,crewai,haystack]

Detection Capabilities

Comprehensive coverage across all known prompt injection categories.

Instruction override / prompt injection

Persona override / identity manipulation

DAN and jailbreak attempts

Hypothetical framing attacks

Logic traps and indirect prompts

Prompt extraction / system prompt leakage

Context switching attacks

Multi-turn escalation patterns

Encoding and obfuscation attacks

Output manipulation / response steering

Deploy Anywhere

From cloud to air-gapped SCIF environments. Zero cloud dependencies required.

Cloud

Docker/K8s in front of OpenAI, Anthropic, Azure, or Bedrock

On-Premise

Ollama backend, SQLite storage, zero external dependencies

Air-Gapped

SCIF-ready, no internet required, CEF to local SIEM only

New

MCP Server Integration

Use Shield as an MCP server in Claude Desktop, Claude Code, or any MCP-compatible client. Every tool call is security-scanned in real time.

analyze

Scan text for prompt injection and jailbreak attacks. Returns verdict, ML score, and MITRE ATLAS mapping (v2026.06).

validate_tool_call

Validate MCP tool arguments for injection attacks, path traversal, SSRF, and credential leaks.

scan_output

Scan LLM output for secrets, PII, suspicious URLs, invisible text, and data leakage.

get_session

Retrieve session state including threat counts, escalation status, and attack pattern history.

list_honey_tools

List available deception tool definitions for injection into MCP server tool lists.

export_threat_intel

Export STIX 2.1 threat intelligence bundle for a session's detected attacks.

MCP servers available on request: contact info@oubliettesecurity.com

Compliance-Ready from Day One

Mapped to every major AI security framework. Audit-ready documentation included.

OWASP LLM Top 10

7 of 10 (LLM01, 02, 05–08, 10)

OWASP Agentic AI

9 of 15 categories

MITRE ATLAS

Detections mapped to MITRE ATLAS (v2026.06): 13 techniques

AML.T0029, AML.T0034, AML.T0037, AML.T0050, AML.T0051, AML.T0051.000, AML.T0053, AML.T0054, AML.T0056, AML.T0057, AML.T0068, AML.T0080, AML.T0086

NIST AI RMF 1.0

4 functions

NIST SP 800-53

9 controls

CMMC Level 2

Self-assessment posture

CWE

13 identifiers

CVSS v3.1

Severity mapping

NIST CSF 2.0

12 subcategories

Start Protecting Your AI Today

Free and open source. Enterprise support available.

Install from PyPI Contact Sales