{"id":13919542,"url":"https://github.com/sinanw/llm-security-prompt-injection","last_synced_at":"2025-07-18T17:31:12.339Z","repository":{"id":208527052,"uuid":"721855992","full_name":"sinanw/llm-security-prompt-injection","owner":"sinanw","description":"This project investigates the security of large language models by performing binary classification of a set of input prompts to discover malicious prompts. Several approaches have been analyzed using classical ML algorithms, a trained LLM model, and a fine-tuned LLM model.","archived":false,"fork":false,"pushed_at":"2023-12-18T23:50:31.000Z","size":2879,"stargazers_count":34,"open_issues_count":0,"forks_count":7,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-11-26T02:34:00.480Z","etag":null,"topics":["cybersecurity","llm-prompting","llm-security","prompt-injection","transformers-models"],"latest_commit_sha":null,"homepage":"","language":"Jupyter Notebook","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sinanw.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-21T23:05:13.000Z","updated_at":"2024-10-30T07:00:09.000Z","dependencies_parsed_at":"2024-11-26T02:41:32.969Z","dependency_job_id":null,"html_url":"https://github.com/sinanw/llm-security-prompt-injection","commit_stats":null,"previous_names":["sinanw/llm-security-prompt-injection"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sinanw/llm-security-prompt-injection","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinanw%2Fllm-security-prompt-injection","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinanw%2Fllm-security-prompt-injection/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinanw%2Fllm-security-prompt-injection/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinanw%2Fllm-security-prompt-injection/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sinanw","download_url":"https://codeload.github.com/sinanw/llm-security-prompt-injection/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinanw%2Fllm-security-prompt-injection/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265801670,"owners_count":23830452,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","llm-prompting","llm-security","prompt-injection","transformers-models"],"created_at":"2024-08-07T05:06:59.551Z","updated_at":"2025-07-18T17:31:11.199Z","avatar_url":"https://github.com/sinanw.png","language":"Jupyter Notebook","funding_links":[],"categories":["Tools \u0026 Datasets","DATA","Building","🔐 Secure Prompting"],"sub_categories":["Telegram Channels","LLM Models","Hall Of Fame:"],"readme":"# Security of Large Language Models (LLM) - Prompt Injection Classification\nIn this project, we investigate the security of large language models in terms of [prompt injection attacks](https://www.techopedia.com/definition/prompt-injection-attack). Primarily, we perform binary classification of a dataset of input prompts in order to discover malicious prompts that represent injections.\n\n*In short: prompt injections aim at manipulating the LLM using crafted input prompts to steer the model into ignoring previous instructions and, thus, performing unintended actions.*\n\nTo do so, we analyzed several AI-driven mechanisms to do the classification task, we particularly examined 1) classical ML algorithms, 2) a pre-trained LLM model, and 3) a fine-tuned LLM model.\n\n\n## Data Set (Deepset Prompt Injection Dataset)\nThe dataset used in this demo is: [Prompt Injection Dataset](https://huggingface.co/datasets/deepset/prompt-injections) provided by [deepset](https://www.deepset.ai/), an AI company specialized in offering tools to build NLP-driven applications using LLMs. \u003cbr/\u003e\n- The dataset combines hundreds of samples of both normal and manipulated prompts labeled as injections.\n- It contains prompts mainly in English, along with some other prompts translated into other languages, primarily German.\n- The original data set is already split into training and holdout subsets. We maintained this split across the multiple experiments to compare results using a unified testing benchmark.\n\n\n### METHOD 1 - Classification Using Traditional ML\n\u003e Corresponding notebook:  [ml-classification.ipynb](https://github.com/sinanw/llm-security-prompt-injection/blob/main/notebooks/1-ml-classification.ipynb)\n\nAnalysis steps:\n1. Loading the dataset from HuggingFace library and exploring it.\n2. Tokenizing prompt texts and generating embeddings using the [multilingual BERT (Bidirectional Encoder Representations from Transformers)](https://huggingface.co/bert-base-multilingual-uncased) LLM model.\n3. Training the following ML algorithms on the downstream prompt classification task:\n    - [Naive Bayes](https://scikit-learn.org/stable/modules/generated/sklearn.naive_bayes.GaussianNB.html)\n    - [Logistic Regression](https://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LogisticRegression.html)\n    - [Support Vector Machine](https://scikit-learn.org/stable/modules/svm.html)\n    - [Random Forest](https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.RandomForestClassifier.html)\n4. Analyzing and comparing the performance of classification models.\n5. Investigating incorrect predictions of the best-performing model.\n\n#### Results:\n|                      | Accuracy | Precision | Recall   | F1 Score |\n|----------------------|----------|-----------|----------|----------|\n| Naive Bayes          | 88.79%   | 87.30%    | 91.67%   | 89.43%   |\n| Logistic Regression  | 96.55%   | 100.00%   | 93.33%   | 96.55%   |\n| Support Vector Machine | 95.69% | 100.00%   | 91.67%   | 95.65%   |\n| Random Forest        | 89.66%   | 100.00%   | 80.00%   | 88.89%   |\n\n\n### METHOD 2 - Classification Using a Pre-trained LLM (XLM-RoBERTa)\n\u003e Corresponding notebook:  [llm-classification-pretrained.ipynb](https://github.com/sinanw/llm-security-prompt-injection/blob/main/notebooks/2-llm-classification-pretrained.ipynb)\n\nAnalysis steps:\n1. Loading the dataset from HuggingFace library.\n2. Loading the pre-trained [XLM-RoBERTa](https://huggingface.co/xlm-roberta-large) model, the multilingual version of RoBERTa, the enhanced version of BERT, from HuggingFace library.\n3. Using HuggingFace [zero-shot classification](https://huggingface.co/tasks/zero-shot-classification) pipeline and XLM-RoBERTa to perform prompt classification on the testing dataset (without fine-tuning).\n4. Analyzing classification results and model performance.\n\n#### Results:\n|              | Accuracy | Precision | Recall   | F1 Score |\n|--------------|----------|-----------|----------|----------|\n| Testing Data | 55.17%   | 55.13%    | 71.67%   | 62.32%   |\n\n\n### METHOD 3 - Classification Using a Fine-tuned LLM (XLM-RoBERTa)\n\u003e Corresponding notebook:  [llm-classification-finetuned.ipynb](https://github.com/sinanw/llm-security-prompt-injection/blob/main/notebooks/3-llm-classification-finetuned.ipynb)\n\nAnalysis steps:\n1. Loading the dataset from HuggingFace library.\n2. Loading the pre-trained [XLM-RoBERTa](https://huggingface.co/xlm-roberta-large) model, the multilingual version of RoBERTa, the enhanced version of BERT, from HuggingFace library.\n3. Fine-tuning XLM-RoBERTa to perform prompt classification on the training dataset.\n4. Analyzing the fine-tuning accuracy across 5 epochs on the testing dataset.\n5. Analyzing the final model accuracy and its performance, and comparing it with previous experiments.\n\n#### Results:\n| Epoch | Accuracy | Precision | Recall   | F1      |\n|-------|----------|-----------|----------|---------|\n| 1     | 62.93%   | 100.00%   | 28.33%   | 44.16%  |\n| 2     | 91.38%   | 100.00%   | 83.33%   | 90.91%  |\n| 3     | 93.10%   | 100.00%   | 86.67%   | 92.86%  |\n| 4     | 96.55%   | 100.00%   | 93.33%   | 96.55%  |\n| 5     | 97.41%   | 100.00%   | 95.00%   | 97.44%  |\n\n\n\n\n\n\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsinanw%2Fllm-security-prompt-injection","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsinanw%2Fllm-security-prompt-injection","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsinanw%2Fllm-security-prompt-injection/lists"}