{
"engine": "sieve",
"version": "1.0.0",
"note": "Documentation only: the engine does not read this file. The rules are defined in sieve.py (= app.py).",
"unsafe_rule": "A chunk is unsafe if any finding is high severity, or medium findings from two different families appear together (medium rules listed in noncounting_medium never count toward that), or a high-confidence secret or card number is present.",
"threat_rules": [
{
"family": "instruction_override",
"rule": "ignore_previous",
"severity": "high",
"pattern": "\\b(?:ignore|disregard|forget|overlook|bypass|override|discard|throw out|set aside|abandon|neglect)(?:\\s{1,3}(?:the|these|those))?\\s{1,3}(?:all|any|every|your|previous|prior|above|earlier|preceding|foregoing|original|initial|system|existing)(?:\\s{1,3}(?:of|the|your|previous|prior|above|earlier|preceding|original|initial|system)){0,3}\\s{1,3}(?:instructions?|prompts?|guidance|guidelines|directions|directives|guardrails|rules|orders|commands|system (?:message|prompt)s?|programming|constraints)\\b(?!\\s{1,3}(?:for|on|about|regarding|in|of|to|when|if|by|with|using|via|through|from|during)\\b)",
"prefilter": "ignore|disregard|forget|overlook|bypass|override|discard|throw out|set aside|abandon|neglect"
},
{
"family": "instruction_override",
"rule": "instructions_above",
"severity": "high",
"pattern": "\\b(?:ignore|disregard|forget|overlook|bypass|override|discard|throw out|set aside|abandon|neglect)(?:\\s{1,3}(?:all|any|the|your)){0,2}\\s{1,3}(?:instructions?|prompts?|guidance|guidelines|directions|directives|guardrails|rules|orders|commands|system (?:message|prompt)s?|programming|constraints)\\s{1,3}(?:above|before this|so far|you (?:were|have been) given|you received|given (?:to you )?(?:above|earlier|before))\\b",
"prefilter": "ignore|disregard|forget|overlook|bypass|override|discard|throw out|set aside|abandon|neglect"
},
{
"family": "instruction_override",
"rule": "ignore_the_above",
"severity": "high",
"pattern": "\\b(?:ignore|disregard|forget)\\s{1,3}(?:all\\s{1,3}|everything\\s{1,3}|anything\\s{1,3})?(?:(?:that\\s{1,3})?(?:was\\s{1,3})?(?:said|written|stated)\\s{1,3})?(?:the\\s{1,3})?(?:above|previous|prior|foregoing|preceding)(?:\\s{1,3}(?:instructions?|directions?|prompts?|text|content|context|messages?|guidance))?\\s{0,3}(?:[.,;:!]|$|\\band\\b|\\binstead\\b)",
"prefilter": "ignore|disregard|forget"
},
{
"family": "instruction_override",
"rule": "stop_following",
"severity": "high",
"pattern": "\\b(?:stop|cease|quit)\\s{1,3}(?:following|obeying|applying)\\b[^.\\n]{0,20}?\\b(?:your|all|any|previous|prior|system|original)\\b[^.\\n]{0,20}?\\b(?:instructions?|prompts?|guidance|guidelines|directions|directives|guardrails|rules|orders|commands|system (?:message|prompt)s?|programming|constraints)\\b|\\b(?:do not|don't|never|no longer)\\s{1,3}(?:follow|obey|apply)\\b[^.\\n]{0,20}?\\b(?:your|previous|prior|earlier|above|system|original)\\b[^.\\n]{0,20}?\\b(?:instructions?|prompts?|guidance|guidelines|directions|directives|guardrails|rules|orders|commands|system (?:message|prompt)s?|programming|constraints)\\b",
"prefilter": "follow|obey|apply"
},
{
"family": "instruction_override",
"rule": "forget_everything",
"severity": "high",
"pattern": "\\b(?:forget|disregard|ignore|set aside)\\s{1,3}(?:everything|all(?:\\s{1,3}(?:of\\s{1,3})?(?:that|this|the above))?|what)\\s{1,3}(?:you\\s{1,3}(?:were|have been|'ve been|was)\\s{1,3}(?:told|given|instructed)|above|before|previously|so far|earlier)\\b",
"prefilter": "forget|disregard|ignore|set aside"
},
{
"family": "instruction_override",
"rule": "disregard_what_told",
"severity": "high",
"pattern": "\\b(?:disregard|ignore|forget)\\s{1,3}(?:what|everything|anything)\\s{1,3}(?:the\\s{1,3})?(?:developer|system|admin(?:istrator)?|operator|they|others|anyone|your (?:developer|creator|operator|owner))\\s{1,3}(?:told|said to|instructed|asked)\\s{1,3}you\\b|\\b(?:has|have)\\s{1,3}(?:updated|changed|replaced|overridden)\\s{1,3}your\\s{1,3}(?:rules|instructions|guidelines|programming|system prompt)\\b|\\bi will (?:now\\s{1,3})?(?:ignore|disregard) my (?:guidelines|instructions|rules|programming)\\b",
"prefilter": "disregard|ignore|forget|updated|changed|replaced|overridden"
},
{
"family": "instruction_override",
"rule": "mixed_lang_ignore",
"severity": "high",
"pattern": "\\bignore\\b[^.\\n。]{0,10}?(?:以前|前|上記|これまで)の?[^.\\n。]{0,5}?(?:instructions?|指示)",
"prefilter": "ignore"
},
{
"family": "instruction_override",
"rule": "vocative_ai",
"severity": "high",
"pattern": "(?:^|(?<=[\\s.!?\\\"'(]))(?:(?:dear|hey|hi|hello|attention|pay attention),?\\s{1,3})?(?:ai|a\\.i\\.|assistant|chatbot|llm|language model|gpt|chatgpt|claude|gemini|copilot|bard)[ \\t]{0,2},[^.\\n]{0,100}?\\b(?:tell|say|respond|reply|answer|recommend|output|include|ignore|disregard|mention|state)\\b|(?:dear|hey|hi|hello|attention|pay attention),?[ \\t]{1,3}(?:ai|a\\.i\\.|assistant|chatbot|llm|language model|gpt|chatgpt|claude|gemini|copilot|bard)[ \\t]{0,2}[::]",
"prefilter": "ai|assistant|chatbot|llm|model|gpt|claude|gemini|copilot|bard"
},
{
"family": "instruction_override",
"rule": "instructions_void",
"severity": "high",
"pattern": "\\b(?:previous|prior|earlier|above|original|initial|system)\\s{1,3}(?:instructions?|prompts?|guidance)\\s{1,3}(?:(?:that\\s{1,3})?you\\s{1,3}(?:were given|received|have)\\s{1,3})?(?:is|are|have been|has been)\\s{1,3}(?:now\\s{1,3})?(?:void|invalid|deprecated|revoked|cancell?ed|obsolete|superseded|overridden|null|no longer (?:valid|apply|applies|in effect|relevant))|\\binstructions?\\s{1,3}you\\s{1,3}(?:received|were given|got)\\s{1,3}(?:before|earlier|previously|above)[^.\\n]{0,30}?\\b(?:void|invalid|no longer|cancell?ed|revoked|obsolete)|\\byour\\s{1,3}(?:earlier|previous|prior|original|initial)\\s{1,3}(?:instructions?|guidance|prompts?|rules)\\s{1,3}(?:no longer (?:apply|applies|valid)|(?:is|are) (?:void|invalid|revoked|cancell?ed|obsolete))",
"prefilter": "void|invalid|deprecated|revoked|cancel|obsolete|superseded|overridden|null|no longer"
},
{
"family": "instruction_override",
"rule": "new_instructions",
"severity": "high",
"pattern": "\\b(?:real|actual|true|hidden|secret)\\s{1,3}(?:system\\s{1,3})?instructions?\\s{0,3}(?:[::]|are\\b|is\\b)|\\bnew\\s{1,3}system\\s{1,3}(?:instructions?|prompt)\\b|\\binstead\\s{0,3},?\\s{1,3}you\\s{1,3}(?:must|should|will)\\s{1,3}(?:now\\s{1,3})?(?:say|tell|respond|answer|reply|output|ignore|pretend)\\b|\\byour\\s{1,3}(?:real|true|actual|new)\\s{1,3}instructions?\\s{1,3}(?:are|is)\\b|\\byour\\s{1,3}(?:real|true|actual)\\s{1,3}(?:task|job|goal|objective|mission|purpose)\\s{1,3}(?:is|are)\\b",
"prefilter": "instruction|instead|real|true|actual"
},
{
"family": "instruction_override",
"rule": "new_goal",
"severity": "medium",
"pattern": "\\byour\\s{1,3}new\\s{1,3}(?:task|goal|objective|purpose|mission)\\s{1,3}(?:is|are)\\b",
"prefilter": "your new"
},
{
"family": "instruction_override",
"rule": "updated_instructions_header",
"severity": "low",
"pattern": "\\b(?:new|updated|revised)\\s{1,3}instructions?\\s{0,3}[::]",
"prefilter": "instruction"
},
{
"family": "instruction_override",
"rule": "from_now_on",
"severity": "high",
"pattern": "\\bfrom now on\\b[^.\\n]{0,30}?\\byou\\s{1,3}(?:must|will|should|shall|are to)\\s{1,3}(?:only\\s{1,3})?(?:respond|reply|answer|say|ignore|pretend|act as|speak only|output|refuse|disregard)\\b|\\bfrom now on\\b[^.\\n]{0,10}?\\b(?:ignore|respond only|answer only|reply only|disregard)\\b",
"prefilter": "from now on"
},
{
"family": "instruction_override",
"rule": "ai_reader_directed",
"severity": "high",
"pattern": "\\b(?:any\\s{1,3}|all\\s{1,3}|the\\s{1,3})?(?:ai|a\\.i\\.|artificial intelligence|assistants?|chat ?bots?|llms?|large language models?|language models?|the model|gpt(?:-?\\d)?|chatgpt|claude|copilot|gemini|bard|bots?|agents?)(?:\\s{1,3}(?:models?|systems?|agents?|tools?|assistants?|readers?|crawlers?|summari[sz]ers?|screeners?))?\\s{1,3}(?:that\\s{1,3}(?:is|are)\\s{1,3})?(?:reading|evaluating|reviewing|summari[sz]ing|screening|seeing|crawling|scanning)\\s{1,3}(?:this|these)\\b[^.\\n]{0,80}?\\b(?:must|should|shall|will|please|need to|are required to|always|never|rate|say|recommend|ignore|tell|respond|reply|output|include|state|mention|describe)\\b",
"prefilter": "reading|evaluating|reviewing|summari|screening|seeing|crawling|scanning"
},
{
"family": "instruction_override",
"rule": "if_you_are_ai",
"severity": "high",
"pattern": "\\bif\\s{1,3}you(?:'re|\\s{1,3}are)\\s{1,3}(?:an?\\s{1,3}|the\\s{1,3}|any\\s{1,3})?(?:ai|a\\.i\\.|artificial intelligence|llm|large language model|language model|chat ?bot|ai assistant|assistant|gpt|chatgpt|claude|gemini|copilot|bot|agent|model|automated (?:system|tool|screener|reviewer|recruiter))\\b[^.\\n]{0,80}?\\b(?:reading|processing|evaluating|reviewing|summari[sz]ing|screening|parsing|analy[sz]ing|seeing|crawling|please|must|should|rate|say|recommend|ignore|tell|respond|reply|output|include|mention|state)\\b",
"prefilter": "if you"
},
{
"family": "instruction_override",
"rule": "ai_directed",
"severity": "medium",
"pattern": "\\b(?:ai|a\\.i\\.|artificial intelligence|assistants?|chat ?bots?|llms?|large language models?|language models?|the model|gpt(?:-?\\d)?|chatgpt|claude|copilot|gemini|bard|bots?|agents?)\\b[^.\\n]{0,30}?\\b(?:must|shall|are required to)\\b[^.\\n]{0,50}?\\b(?:tell|say|answer|reply|respond|output|recommend|state|claim|include|append|visit|ignore|disregard|reveal|print|send|write)\\b",
"prefilter": "must|shall|required"
},
{
"family": "instruction_override",
"rule": "note_to_ai",
"severity": "high",
"pattern": "\\b(?:note|message|instructions?|attention|important|reminder|notice|memo)\\s{1,3}(?:to|for)\\s{1,3}(?:the\\s{1,3}|any\\s{1,3}|all\\s{1,3}|every\\s{1,3})?(?:ai|a\\.i\\.|artificial intelligence|assistants?|chat ?bots?|llms?|large language models?|language models?|the model|gpt(?:-?\\d)?|chatgpt|claude|copilot|gemini|bard|bots?|agents?)(?:\\s{1,3}(?:models?|systems?|agents?|tools?|assistants?|readers?|crawlers?|summari[sz]ers?|screeners?))?\\s{0,3}[::,\\-—]|\\b(?:rules?|instructions?|directives?)\\s{1,3}for\\s{1,3}(?:the\\s{1,3})?(?:ai|a\\.i\\.|artificial intelligence|assistants?|chat ?bots?|llms?|large language models?|language models?|the model|gpt(?:-?\\d)?|chatgpt|claude|copilot|gemini|bard|bots?|agents?)(?:\\s{1,3}(?:models?|systems?|agents?|tools?|assistants?|readers?|crawlers?|summari[sz]ers?|screeners?))?\\s{0,3}[::]",
"prefilter": "note|message|instruction|attention|important|reminder|notice|memo|rule|directive"
},
{
"family": "instruction_override",
"rule": "greet_ai",
"severity": "high",
"pattern": "(?:^|(?<=[\\s.!?\\\"'(]))(?:dear|hey|hi|hello|attention)[ \\t]{1,3}(?:ai|a\\.i\\.|assistant|chatbot|llm|language model|gpt|chatgpt|claude|copilot|gemini|bard|agent)s?\\b[ \\t]{0,3}[::,!]",
"prefilter": "dear|hey|hi|hello|attention"
},
{
"family": "instruction_override",
"rule": "system_override",
"severity": "high",
"pattern": "\\bsystem\\s{1,3}override\\b|\\boverride\\s{1,3}(?:mode|protocol|code)\\s{1,3}(?:activated|enabled|engaged)\\b",
"prefilter": "override"
},
{
"family": "instruction_override",
"rule": "ja_ignore",
"severity": "high",
"pattern": "(?:以前|前|上記|これまで|先ほど|直前|上|今まで|最初|元|システム|これより前|過去|あなた)(?:の|に|で)?(?:与えられた|受けた|示された)?\\s?(?:指示|命令|指令|ルール|プロンプト|制約|ガイドライン)(?:は|を)?\\s?(?:すべて|全て|一旦|いったん)?\\s?(?:無視(?!され|しないで|しては|すると|しない)|忘れ(?!ず|ない|ること|がち|物|ては|ても)|破棄(?!され)|取り?消(?!され)|リセット(?!され)|撤回(?!され)|従わな(?!いと|ければ|い場合)|従う必要はな|無効に(?:し|する))",
"prefilter": "無視|忘れ|破棄|取り消|取消|リセット|撤回|従わな|従う必要|無効"
},
{
"family": "instruction_override",
"rule": "ja_instructions_void",
"severity": "high",
"pattern": "(?:以前|前|上記|これまで|これより前|今まで|最初|元|システム|過去)(?:の|に)?(?:与えられた|受けた)?\\s?(?:指示|命令|ルール|プロンプト|制約)(?:は)?\\s?(?:すべて|全て)?(?:無効|取り消され|撤回され|破棄され)(?:です|でした|ました|となります|となりました|とする|である)",
"prefilter": "無効|取り消され|撤回され|破棄され"
},
{
"family": "instruction_override",
"rule": "ja_ignore_short",
"severity": "high",
"pattern": "(?:指示|命令|ルール|制約)を?(?:すべて|全て)?無視(?:してください|して下さい|しろ|せよ|すること)",
"prefilter": "無視"
},
{
"family": "instruction_override",
"rule": "ja_forget_context",
"severity": "high",
"pattern": "(?:これまで|今まで|上記|以前|これより前)の(?:内容|会話|やりとり|やり取り|設定|文脈)は?(?:すべて|全て|一旦)?(?:忘れて|忘れろ|忘れること|無視して|無視しろ|リセットして|リセットし|破棄して)",
"prefilter": "忘れ|無視|リセット|破棄"
},
{
"family": "instruction_override",
"rule": "ja_new_instruction",
"severity": "high",
"pattern": "(?:新しい|本当の|真の|隠された)(?:指示|命令)\\s?[::]",
"prefilter": "指示|命令"
},
{
"family": "instruction_override",
"rule": "ja_ai_directed",
"severity": "high",
"pattern": "(?:生成ai|aiアシスタント|ai|アシスタント|チャットボット|言語モデル|llm|gpt|chatgpt)(?:の方|の皆さん|さん|様|たち)?(?:へ|に告ぐ)\\s?[::、]|(?:ai|アシスタント|チャットボット|言語モデル|llm)(?:への|に対する|向けの)(?:指示|命令|お願い|注意)\\s?[::]|この(?:ページ|文書|文章|記事|メール|チケット|資料|レビュー|履歴書|投稿|ファイル|データ|サイト|問い合わせ)を(?:読んだ|読む|読んでいる|処理する|要約する|評価する|確認する)(?:ai|アシスタント|チャットボット|言語モデル|llm)は|(?:もし|仮に)?あなたが(?:ai|アシスタント|言語モデル|チャットボット)(?:なら|であれば|の場合)",
"prefilter": "ai|アシスタント|チャットボット|言語モデル|llm|gpt"
},
{
"family": "role_hijack",
"rule": "you_are_now",
"severity": "high",
"pattern": "\\byou(?:'re| are) now\\s{1,3}(?:in\\s{1,3})?(?:jailbroken|unrestricted|uncensored|unfiltered|free\\s{1,3}(?:from|of)\\s{1,3}(?:all\\s{1,3})?(?:rules|restrictions|guidelines|limits|filters)|no longer\\s{1,3}(?:bound|restricted|an?\\s{1,3}(?:ai|assistant))|(?:god|dan|evil|jailbreak)\\s{1,3}mode|(?:an?\\s{1,3})?(?:evil|malicious|rogue|unrestricted|uncensored)\\s{1,3}(?:ai|assistant|model|bot))",
"prefilter": "you are now|you're now"
},
{
"family": "role_hijack",
"rule": "unrestricted_persona",
"severity": "high",
"pattern": "\\byou(?:'re| are)\\s{1,3}(?:an?\\s{1,3})?(?:unrestricted|uncensored|unfiltered|jailbroken|evil|malicious)\\s{1,3}(?:ai|assistant|model|bot|chatbot|language model)\\b",
"prefilter": "unrestricted|uncensored|unfiltered|jailbroken|evil|malicious"
},
{
"family": "role_hijack",
"rule": "you_are_now_generic",
"severity": "low",
"pattern": "\\byou are now\\s{1,3}(?:an?|the)\\s{1,3}[a-z]{2,20}\\b",
"prefilter": "you are now"
},
{
"family": "role_hijack",
"rule": "persona_switch",
"severity": "high",
"pattern": "\\bfrom now on,?\\s{1,3}you are\\s{1,3}(?:an?\\s{1,3}|the\\s{1,3}|my\\s{1,3})?(?:\\w{1,20}\\s{1,3}){0,2}(?:ai|assistant|chatbot|model|bot|character|persona|hacker|pirate|dan|jailbroken|unrestricted|uncensored)\\b|\\bfrom now on,?\\s{1,3}you are no longer\\b|\\byou will now\\s{1,3}(?:act|behave|respond|pretend)\\b|\\bnew persona\\b|\\byour new (?:persona|identity)\\b",
"prefilter": "from now on|you will now|persona|identity"
},
{
"family": "role_hijack",
"rule": "role_marker",
"severity": "high",
"pattern": "\\b(?:system|developer)\\s{0,2}[::]\\s{0,2}(?:ignore|disregard|forget|reveal|you are now|act as|pretend|override|new instructions|you must (?:now\\s{1,3})?(?:ignore|respond only|reply only|reveal|output|disregard))",
"prefilter": "system|developer"
},
{
"family": "role_hijack",
"rule": "role_marker_directive",
"severity": "high",
"pattern": "(?:^|\\n)\\s{0,4}(?:system|developer)\\s{0,2}[::]\\s{0,2}(?:you (?:must|should)|always|never)\\b[^\\n]{0,60}?\\b(?:tell|say|recommend|mention|claim|state|promote|describe)\\w{0,3}\\b[^\\n]{0,40}?\\b(?:the user|users|the customer|customers|the reader|readers|everyone|people)\\b",
"prefilter": "system|developer"
},
{
"family": "role_hijack",
"rule": "bracket_role",
"severity": "high",
"pattern": "\\[(?:system|assistant|developer)\\]\\(\\s{0,2}#|-{2,}\\s{0,3}begin\\s{1,3}(?:system|hidden|new)\\s{1,3}(?:prompt|instructions?)|\\bbegin\\s{1,3}system\\s{1,3}prompt\\b|\\bend\\s{1,3}of\\s{1,3}system\\s{1,3}prompt\\b",
"prefilter": "system|begin|assistant|developer"
},
{
"family": "role_hijack",
"rule": "json_role",
"severity": "medium",
"pattern": "[\\\"']role[\\\"']\\s{0,3}:\\s{0,3}[\\\"'](?:system|developer)[\\\"']",
"prefilter": "role"
},
{
"family": "role_hijack",
"rule": "system_line",
"severity": "low",
"pattern": "^[ \\t]{0,8}system[ \\t]{0,3}[::][ \\t]{0,3}\\S",
"prefilter": "system"
},
{
"family": "role_hijack",
"rule": "chat_transcript_marker",
"severity": "low",
"pattern": "^[ \\t]{0,8}(?:assistant|user|human|ai)[ \\t]{0,3}[::][ \\t]{0,3}\\S",
"prefilter": "assistant|user|human|ai"
},
{
"family": "role_hijack",
"rule": "chat_template_token",
"severity": "high",
"pattern": "<\\|(?:system|im_start|im_end|endoftext|assistant|user)\\|>|\\[/?inst\\]|<?sys>>",
"prefilter": "<\\||inst\\]|<<"
},
{
"family": "role_hijack",
"rule": "chat_role_tag",
"severity": "medium",
"pattern": "<\\s{0,2}/?\\s{0,2}(?:system|im_start)\\s{0,2}>|^[ \\t]{0,8}###[ \\t]{0,3}(?:system|instruction|response)[ \\t]{0,3}:",
"prefilter": "system|im_start|###"
},
{
"family": "role_hijack",
"rule": "jailbreak_terms",
"severity": "high",
"pattern": "\\bdo anything now\\b|\\bjailbreak(?:ed)? mode\\b",
"prefilter": "do anything|jailbreak"
},
{
"family": "role_hijack",
"rule": "jailbreak_mention",
"severity": "medium",
"pattern": "\\bjailbreak\\b|\\bdeveloper mode\\b|開発者モード|脱獄",
"prefilter": "jailbreak|developer mode|開発者モード|脱獄"
},
{
"family": "role_hijack",
"rule": "act_as",
"severity": "medium",
"pattern": "\\b(?:act|behave) as (?:an?|the|if)\\b|\\bpretend (?:to be|you are|that you)\\b|\\broleplay as\\b",
"prefilter": "act|behave|pretend|roleplay"
},
{
"family": "role_hijack",
"rule": "ja_role",
"severity": "high",
"pattern": "(?:あなた|君|お前)は(?:今から|これから|以後|今後)、?[^。\\n]{0,20}?(?:ai|アシスタント|キャラクター|海賊|悪役|ハッカー|管理者|犯罪者|制限|ルール|なりきって|のふりを|振る舞(?:って|い、|え|いなさい))|(?:以後|今後|今から|これから|以降)の?\\s?(?:あなた|君|きみ|お前|ai)は[^。\\n]{0,20}?(?:として振る舞|になりきって|のふりをして|制限|ルール|指示に従わ|aiではない)|(?:あなた|君)の新しい(?:役割|任務|指示)は|システム\\s?[::]\\s?(?:以前の|これまでの|指示を無視|無視|あなたは今から)|制限(?:なし|のない|を解除し)(?:て|で|の)?\\s?(?:ai|アシスタント|回答|答え|出力)|あなたは制限のない",
"prefilter": "あなた|君|お前|システム|制限"
},
{
"family": "role_hijack",
"rule": "ja_roleplay",
"severity": "low",
"pattern": "ロールプレイ|として振る舞|になりきって",
"prefilter": "ロールプレイ|振る舞|なりきって"
},
{
"family": "prompt_extraction",
"rule": "reveal_prompt",
"severity": "high",
"pattern": "\\b(?:reveal|show|print|repeat|output|display|tell me|give me|leak|dump|disclose|recite|echo|share|list|summari[sz]e|paraphrase|translate|quote|describe)\\b[^.\\n]{0,30}?\\b(?:(?:the|your)\\s{1,3})?(?:system prompt|system message|initial (?:prompt|instructions?)|hidden (?:prompt|instructions?|rules)|internal (?:rules|instructions)|your (?:system prompt|instructions|initial instructions|hidden instructions|configuration|guidelines verbatim)|the prompt above|developer (?:message|prompt|instructions)|confidential instructions|pre-?prompt)",
"prefilter": "prompt|instruction|developer|system message|hidden|internal|configuration"
},
{
"family": "prompt_extraction",
"rule": "repeat_above",
"severity": "high",
"pattern": "\\b(?:repeat|print|output|echo|recite|copy|reproduce)\\s{1,3}(?:back\\s{1,3})?(?:everything|all|the text|the words|the content|(?:all\\s{1,3})?(?:the\\s{1,3})?messages)\\s{1,3}(?:above|before|preceding|prior)(?:\\s{1,3}this\\s{1,3}(?:line|message|point|sentence))?|\\bstarting\\s{1,3}(?:from|with)\\s{1,3}[\\\"'“‘]you are\\b",
"prefilter": "repeat|print|output|echo|recite|copy|reproduce|starting"
},
{
"family": "prompt_extraction",
"rule": "reveal_secrets",
"severity": "medium",
"pattern": "\\b(?:reveal|print|show|give me|tell me|output|leak|dump|send me)\\b[^.\\n]{0,20}?\\b(?:the\\s{1,3}|all\\s{1,3})?(?:admin(?:istrator)?|root|master|database|db|confidential|secret|private|internal)\\s{0,3}(?:passwords?|credentials|keys?|tokens?|data|information)\\b",
"prefilter": "reveal|print|show|give me|tell me|output|leak|dump|send me"
},
{
"family": "prompt_extraction",
"rule": "what_are_your_instructions",
"severity": "high",
"pattern": "\\bwhat (?:is|are|were) your (?:initial |original |system |hidden )?(?:instructions|prompt|system prompt)\\b",
"prefilter": "your"
},
{
"family": "prompt_extraction",
"rule": "ja_reveal",
"severity": "high",
"pattern": "(?:システムプロンプト|初期(?:指示|プロンプト)|最初の指示|隠された指示|隠しルール|内部(?:指示|ルール)|開発者(?:の)?指示|あなたの(?:初期設定|設定内容|ルール|指示|プロンプト))[^。\\n]{0,15}?(?:を)?\\s?(?:表示|教え|出力|開示|見せ|繰り返|書き出|漏ら|そのまま)",
"prefilter": "プロンプト|指示|ルール|設定"
},
{
"family": "exfiltration",
"rule": "markdown_image",
"severity": "medium",
"pattern": "!\\[[^\\]\\n]{0,200}\\]\\(\\s{0,3}(?:<\\s{0,2})?(?:https?:)?//[^\\s)]{1,500}\\)",
"prefilter": "!\\["
},
{
"family": "exfiltration",
"rule": "markdown_image_suspicious",
"severity": "high",
"pattern": "!\\[[^\\]\\n]{0,200}\\]\\(\\s{0,3}(?:<\\s{0,2})?(?:https?:)?//[^\\s)]{0,300}?(?:\\{[^}\\s]{1,40}\\}|\\$\\{|%7b|[?&](?:q|d|c|m|data|secret|token|key|question|conversation|history|summary|prompt|password|email|user|chat|context|msg|text|info|payload|query)=)[^\\s)]{0,300}\\)",
"prefilter": "!\\["
},
{
"family": "exfiltration",
"rule": "image_instruction",
"severity": "high",
"pattern": "\\b(?:append|add|include|render|insert|output|display|show)\\b[^.\\n]{0,80}?!\\[|\\b(?:always|each|every)\\s{1,3}(?:end|answer|response|reply|message)[^.\\n]{0,60}?!\\[|!\\[[^\\]\\n]{0,100}\\]\\([^)\\n]{1,300}\\)[^.\\n]{0,100}?\\b(?:replac\\w*|substitut\\w*|fill in|insert)\\b[^.\\n]{0,60}?\\b(?:user|question|conversation|message|answer|input|query|history)",
"prefilter": "!\\["
},
{
"family": "exfiltration",
"rule": "reference_image",
"severity": "medium",
"pattern": "^[ \\t]{0,8}\\[[^\\]\\n]{1,40}\\]:[ \\t]{0,3}(?:<\\s{0,2})?(?:https?:)?//\\S{1,300}\\?\\S{1,300}",
"prefilter": "\\]:"
},
{
"family": "exfiltration",
"rule": "html_image_suspicious",
"severity": "high",
"pattern": "
]{0,300}\\bsrc\\s{0,3}=\\s{0,3}[\\\"']?\\s{0,3}(?:https?:)?//[^\\s\\\"'>]{0,300}?[?&](?:q|d|c|m|data|secret|token|key|question|conversation|history|summary|prompt|password|email|user|chat|context|msg|text|info|payload|query)=",
"prefilter": "
\\n]{3,60}>[^)\\n]{0,100}\\)|\\bwhen you (?:respond|reply|answer)\\b[^.\\n]{0,80}?!\\[|\\bend (?:each |every |your )?(?:response |reply |answer |message )?with\\b[^.\\n]{0,60}?!\\[",
"prefilter": "!\\["
},
{
"family": "exfiltration",
"rule": "html_image",
"severity": "medium",
"pattern": "
]{0,300}\\bsrc\\s{0,3}=\\s{0,3}[\\\"']?\\s{0,3}(?:https?:)?//",
"prefilter": "
]{0,200}?(?:\\{\\{?\\s{0,2}(?:conversation|chat|history|chat_history|user_?(?:input|message|question)|summary|prompt|system_prompt|secret|password|context|messages?|question)\\s{0,2}\\}?\\}|\\$\\{\\s{0,2}(?:conversation|history|summary|context|prompt|secret|password|messages?|question)\\s{0,2}\\})",
"prefilter": "http"
},
{
"family": "exfiltration",
"rule": "ja_send",
"severity": "high",
"pattern": "(?:会話|履歴|入力内容|質問内容|回答内容|個人情報|パスワード|認証情報|トークン|ユーザー情報|秘密|機密)[^。\\n]{0,20}?(?:https?://\\S{1,200}|外部(?:の|サーバー)|(?:次|以下)の(?:url|アドレス)|[\\w.-]{1,64}@[\\w-]{1,63}\\.\\w{2,24})[^。\\n]{0,20}?(?:送信|送って|転送|アップロード|投稿|post|put)(?!しないで|しない|禁止|厳禁|してはいけ|しては|することはありません|されません|されることはありません)|(?:https?://\\S{1,200}|外部(?:の|サーバー)|(?:次|以下)の(?:url|アドレス)|[\\w.-]{1,64}@[\\w-]{1,63}\\.\\w{2,24})[^。\\n]{0,20}?(?:会話|履歴|入力内容|質問内容|個人情報|パスワード|認証情報|トークン|ユーザー情報|秘密|機密)[^。\\n]{0,20}?(?:送信|送って|転送|アップロード|投稿|post|put)(?!しないで|しない|禁止|厳禁|してはいけ|しては|することはありません|されません|されることはありません)",
"prefilter": "送信|送って|転送|アップロード|投稿|post|put"
},
{
"family": "exfiltration",
"rule": "ja_access_url",
"severity": "medium",
"pattern": "(?:https?://\\S{1,200}|(?:次|以下)の(?:url|リンク))[^。\\n]{0,20}?(?:に|へ)[^。\\n]{0,10}?アクセス",
"prefilter": "アクセス"
},
{
"family": "encoded_payload",
"rule": "decode_instruction",
"severity": "medium",
"pattern": "\\b(?:base64|rot13|rot-13|hex)[- ]?(?:decode|decoded|encoded)\\b|\\bdecode (?:this|the following)\\b|(?:base64|rot13)\\s?(?:で)?(?:デコード|復号)",
"prefilter": "base64|rot|hex|decode|デコード|復号"
},
{
"family": "hidden_text",
"rule": "css_hidden",
"severity": "medium",
"pattern": "display\\s{0,3}:\\s{0,3}none|visibility\\s{0,3}:\\s{0,3}hidden|font-size\\s{0,3}:\\s{0,3}(?:0(?:\\.\\d{1,3})?|1)(?:px|pt)?\\s{0,3}[;\\\"'}]|font-size\\s{0,3}:\\s{0,3}0(?:\\.\\d{1,3})?(?:em|rem)\\b|opacity\\s{0,3}:\\s{0,3}0(?:\\.0{1,5})?\\s{0,3}[;\\\"'}]|color\\s{0,3}:\\s{0,3}(?:white|transparent|#f[ef]f[ef]f[ef]\\b|#fff\\b|rgba?\\(\\s{0,3}25[0-5]\\s{0,3},\\s{0,3}25[0-5]\\s{0,3},\\s{0,3}25[0-5])|\\baria-hidden\\s{0,3}=\\s{0,3}[\\\"']?true|<[^>\\n]{0,100}\\shidden(?:\\s|=|>)|text-indent\\s{0,3}:\\s{0,3}-\\d{3,}|(?:left|top)\\s{0,3}:\\s{0,3}-\\d{3,}px|clip\\s{0,3}:\\s{0,3}rect\\(\\s{0,3}0",
"prefilter": "none|hidden|font-size|opacity|color|indent|left|top|clip"
},
{
"family": "hidden_text",
"rule": "script_or_style_tag",
"severity": "medium",
"pattern": "<\\s{0,3}(?:script|style|iframe|object|embed)\\b",
"prefilter": "<"
},
{
"family": "exfiltration",
"rule": "image_placeholder",
"severity": "high",
"pattern": "!\\[[^\\]\\n]{0,200}\\]\\(\\s{0,3}(?:<\\s{0,2})?(?:https?:)?//[^\\s)]{0,300}?(?:\\b[A-Z]{2,}(?:_[A-Z]{2,}){1,6}\\b|\\b(?:SUMMARY|QUESTION|HISTORY|PASSWORD|CONVERSATION|SECRET|TOKEN|CONTEXT|PROMPT|ANSWER|MESSAGE|DATA)\\b|<[A-Za-z_]{3,30}>)[^\\s)]{0,300}\\)",
"prefilter": null,
"case_sensitive": true
},
{
"family": "role_hijack",
"rule": "dan_persona",
"severity": "high",
"pattern": "(?i:you(?:'re| are)(?: now)?|act as|become|pretend to be)\\s{1,3}(?:a\\s{1,3})?DAN\\b|\\bDAN\\s{1,3}(?i:mode)\\b",
"prefilter": null,
"case_sensitive": true
}
],
"noncounting_medium": [
"act_as",
"chat_role_tag",
"decode_instruction",
"html_image",
"ja_access_url",
"jailbreak_mention",
"json_role",
"markdown_image",
"reference_image",
"visit_url"
],
"obfuscated_phrases": [
"ignorepreviousinstructions",
"ignoreallpreviousinstructions",
"ignorepriorinstructions",
"ignoreallpriorinstructions",
"disregardpreviousinstructions",
"disregardallpreviousinstructions",
"disregardpriorinstructions",
"disregardtheabove",
"ignoretheaboveinstructions",
"forgetallpreviousinstructions",
"forgeteverythingabove",
"ignoreyourinstructions",
"revealthesystemprompt",
"revealyoursystemprompt",
"printyoursystemprompt",
"showyoursystemprompt",
"printthesystemprompt",
"stopfollowingyourinstructions",
"donotfollowyourinstructions",
"以前の指示を無視",
"上記の指示を無視",
"これまでの指示を無視",
"前の指示を無視",
"指示をすべて無視",
"システムプロンプトを表示",
"忽略之前的指令",
"忽略以上指令",
"忽略所有先前的指示",
"忽略之前的所有指令",
"无视之前的指令",
"이전지시를무시",
"이전의모든지시를무시",
"모든지시를무시",
"ignoralasinstruccionesanteriores",
"ignoratodaslasinstrucciones",
"ignorezlesinstructionsprecedentes",
"ignoreztouteslesinstructions",
"ignoriereallevorherigenanweisungen",
"ignorieredievorherigenanweisungen",
"ignoraleistruzioniprecedenti",
"ignorelesinstructionsprecedentes",
"ignoreztouteslesinstructionsprecedentes",
"ignorierensiedievorherigenanweisungen",
"ignorierensiealleanweisungen",
"ignoratutteleistruzioniprecedenti",
"ignoralasinstruccionesprevias",
"忽略先前的所有指令",
"忽略先前的指令",
"忽略上述指令",
"忽視之前的指令",
"이전지시사항을무시",
"앞의지시를무시",
"이전의지시를무시"
],
"multilingual_phrases": [
"ignoralasinstruccionesanteriores",
"ignoralasinstruccionesprevias",
"ignoraleistruzioniprecedenti",
"ignoratodaslasinstrucciones",
"ignoratutteleistruzioniprecedenti",
"ignorelesinstructionsprecedentes",
"ignorezlesinstructionsprecedentes",
"ignoreztouteslesinstructions",
"ignoreztouteslesinstructionsprecedentes",
"ignoriereallevorherigenanweisungen",
"ignorieredievorherigenanweisungen",
"ignorierensiealleanweisungen",
"ignorierensiedievorherigenanweisungen",
"忽略上述指令",
"忽略之前的所有指令",
"忽略之前的指令",
"忽略以上指令",
"忽略先前的所有指令",
"忽略先前的指令",
"忽略所有先前的指示",
"忽視之前的指令",
"无视之前的指令",
"모든지시를무시",
"앞의지시를무시",
"이전의모든지시를무시",
"이전의지시를무시",
"이전지시를무시",
"이전지시사항을무시"
],
"secret_rules": [
{
"kind": "openai_like_key",
"confidence": "high",
"pattern": "\\bsk-(?:proj-|ant-(?:api\\d{2}-)?|live-)?[A-Za-z0-9_\\-]{20,}"
},
{
"kind": "github_token",
"confidence": "high",
"pattern": "\\bgh[pousr]_[A-Za-z0-9]{36,}\\b|\\bgithub_pat_[A-Za-z0-9_]{22,}\\b"
},
{
"kind": "aws_access_key_id",
"confidence": "high",
"pattern": "\\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA)[0-9A-Z]{16}\\b"
},
{
"kind": "slack_token",
"confidence": "high",
"pattern": "\\bxox[abposr]-[A-Za-z0-9\\-]{10,}"
},
{
"kind": "slack_webhook",
"confidence": "high",
"pattern": "https://hooks\\.slack\\.com/services/[A-Za-z0-9/_\\-]{20,}"
},
{
"kind": "google_api_key",
"confidence": "high",
"pattern": "\\bAIza[0-9A-Za-z_\\-]{35}\\b"
},
{
"kind": "huggingface_token",
"confidence": "high",
"pattern": "\\bhf_[A-Za-z0-9]{30,}\\b"
},
{
"kind": "gitlab_token",
"confidence": "high",
"pattern": "\\bglpat-[A-Za-z0-9_\\-]{20,}\\b"
},
{
"kind": "stripe_key",
"confidence": "high",
"pattern": "\\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\\b"
},
{
"kind": "stripe_publishable_key",
"confidence": "low",
"pattern": "\\bpk_(?:live|test)_[A-Za-z0-9]{16,}\\b"
},
{
"kind": "aws_secret_access_key",
"confidence": "high",
"pattern": "(?i)aws_?secret_?access_?key[\\\"']?\\s{0,3}[:=]\\s{0,3}[\\\"']?[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])"
},
{
"kind": "uri_credentials",
"confidence": "high",
"pattern": "\\b[a-z][a-z0-9+.\\-]{1,20}://[^\\s:/@\\\"'<>]{1,64}:[^\\s@/\\\"'<>]{3,128}@[^\\s/\\\"'<>]{1,253}"
},
{
"kind": "sendgrid_key",
"confidence": "high",
"pattern": "\\bSG\\.[A-Za-z0-9_\\-]{16,}\\.[A-Za-z0-9_\\-]{16,}\\b"
},
{
"kind": "npm_token",
"confidence": "high",
"pattern": "\\bnpm_[A-Za-z0-9]{36}\\b"
},
{
"kind": "google_oauth_token",
"confidence": "high",
"pattern": "\\bya29\\.[0-9A-Za-z_\\-]{20,}"
},
{
"kind": "private_key",
"confidence": "high",
"pattern": "-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----"
},
{
"kind": "credential_assignment",
"confidence": "high",
"pattern": "(?i)(?