Rebuff
open-sourceSummary
Rebuff is an open-source library for detecting prompt injection attacks against AI applications, distributed as a Python package that developers import directly into their code. It layers four defenses: heuristics to filter suspicious input before it reaches the LLM, a dedicated LLM to analyze incoming prompts, a vector database that recognizes similar attacks seen before, and canary tokens that catch prompt leakage. It's aimed at developers building LLM-backed applications who need to harden them against adversarial input rather than at SOC teams monitoring infrastructure. The README describes it as self-hardening, learning from past attacks stored in the vector database, and its own disclaimer is candid that it remains a prototype offering no guarantee of full protection. Started in 2023 with 13 contributors, the project has seen no commits in the past year.
What Rebuff answers
What kinds of prompt injection does it actually catch before they reach the model?
filters obvious adversarial phrasing through heuristics first, then a dedicated LLM and a vector database of past attacks catch what the heuristics miss, so coverage grows only as wide as the attacks it has already seen
What does it need to run alongside my application?
a pinecone vector database and a separate LLM account for the detection layer, both called on every request, so there are external dependencies and costs beyond the library itself
Can it tell me when the model leaks its own prompt back to the user?
canary tokens inserted into prompts reveal leakage when they reappear in output, which then feeds that attack back into the vector database for future detection
Is this something I run standalone or wire into my own code?
it's a library imported directly into an application's request path, not a service or proxy sitting in front of one, so hardening happens per-application rather than at the infrastructure layer
Should I treat this as a finished defense or one layer among others?
the project's own disclaimer says it cannot guarantee full protection, and with no commits in the past year and only 13 contributors, unseen attack patterns may go unaddressed going forward
Does the roadmap suggest features I'd be relying on are still missing?
local-only mode and parity between the Python and JavaScript SDKs are both still unchecked, so teams standardizing on Python may hit gaps the JavaScript version doesn't have
Examples
Command line
No option matches that search.
| option | found in | since | description |
|---|
No option matches that search.
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release history
Nothing shipped since we started watching. Releases and docs updates land here as they happen.