class ScanConfig(BaseSettings):
enable_pdf: bool = Field(True, description="Scan PDF documents")
enable_docx: bool = Field(True, description="Scan DOCX/DOCM documents")
enable_pptx: bool = Field(True, description="Scan PPTX/PPTM documents")
enable_xlsx: bool = Field(True, description="Scan XLSX/XLSM/XLSB documents")
enable_rtf: bool = Field(True, description="Scan RTF documents")
enable_html: bool = Field(True, description="Scan HTML/HTM documents")
enable_legacy_office: bool = Field(
True,
description=(
"D.2: Scan legacy OLE2 Office binary formats (.doc/.xls/.ppt) and "
"embedded vbaProject.bin streams. Detects VBA stomping (D.1) and "
"shell-API strings inside OLE2/CFB containers."
),
)
enable_csv: bool = Field(
True,
description=(
"E.1: Scan CSV/TSV files. Detects spreadsheet formula injection "
"(=cmd|, =WEBSERVICE(, DDE chains) and runs the standard T4/T9 "
"deep-scan pipeline on extracted cell text."
),
)
enable_plaintext_scan: bool = Field(
True,
description=(
"Scan plain-text files with no magic bytes (.txt/.md/.json/.log/"
"source code) as text so the content detectors (prompt injection, "
"multilingual, script-mixing) run on them. Binary unknowns stay "
"empty. Plain text is the most common RAG ingestion format."
),
)
enable_odf: bool = Field(
True,
description=(
"E.2: Scan OpenDocument formats (.odt/.ods/.odp). ZIP-based like "
"DOCX; detects macro: URIs (CVE-2023-2255), Basic macro scripts, "
"external template references, and prompt injection in content.xml."
),
)
profile: str = Field("balanced", description="Threshold profile: lenient | balanced | strict")
# H.6 (0.4.8): a stage timeout means the scan is incomplete — the
# document was never fully checked, so it must not silently ALLOW.
# "warn" (default) escalates the verdict to at least FLAG; "block"
# fails closed for pipelines that must not pass unscanned content.
on_timeout_verdict: str = Field(
"warn",
description=(
"Verdict escalation when a scan stage times out: warn → FLAG, "
"block → BLOCK. The finding explains the scan is incomplete; "
"it does not claim the document is malicious."
),
)
# H.13 (0.4.8): policy for content the scanner cannot inspect at all —
# encrypted PDFs (/Encrypt), password-protected Office (CFB-wrapped
# OOXML), encrypted archive members. "warn" (default) → FLAG so a
# reviewer sees the blind spot; "block" → fail closed for pipelines that
# must not pass un-inspectable content; "allow" → record as INFO only.
on_unscannable_verdict: str = Field(
"warn",
description=(
"Verdict for content the scanner cannot decrypt/inspect "
"(encrypted PDF/Office/archive): warn → FLAG, block → BLOCK, "
"allow → INFO. Default warn surfaces the blind spot without "
"blocking."
),
)
# W6 (0.5.0): transparently decrypt encrypted PDFs before scanning so the
# content can actually be inspected instead of flagged as a blind spot.
# Handles the common empty-user-password (permissions-only) case with no
# password; real password-protected PDFs use pdf_passwords. Requires the
# optional 'pikepdf' package (pip install doc-firewall[crypto]); a no-op
# when absent. Decryption is to a temp file scanned then deleted.
enable_pdf_decryption: bool = Field(
True,
description=(
"Try to decrypt encrypted PDFs (empty + supplied passwords) so "
"content can be scanned. Requires optional 'pikepdf'."
),
)
pdf_passwords: List[str] = Field(
default_factory=list,
description="Candidate user passwords to try when decrypting PDFs.",
)
# W3 (0.5.0): sanitization. sanitize() never runs during scan() and
# never touches the original file — it writes a cleaned copy. These flags
# let a user disable it entirely or restrict which categories are
# stripped. Categories: hidden_text, metadata, macro, active_content,
# embedded_file, formula_injection.
enable_sanitization: bool = Field(
True,
description=(
"Master switch for Scanner.sanitize(). When False, sanitize() "
"returns sanitized=False (no cleaned copy is produced)."
),
)
sanitize_remove_categories: List[str] = Field(
default_factory=lambda: [
"hidden_text", "metadata", "macro", "active_content",
"embedded_file", "formula_injection",
],
description=(
"Which categories the sanitizers strip. Remove an entry to keep "
"that category in the cleaned copy (e.g. drop 'metadata' to "
"preserve document properties)."
),
)
sanitize_verify_rescan: bool = Field(
True,
description=(
"After producing a cleaned copy, re-scan it and downgrade the "
"result to sanitized=False if any residual threat remains (verdict "
"!= ALLOW). Guarantees the advertised trojan→BLOCK / sanitized→ALLOW "
"round-trip: a threat the sanitizer cannot remove (e.g. a visible-"
"body prompt injection) is never reported as neutralised."
),
)
# H.11 (0.4.8): coverage transparency. When True, a scan whose
# ML-dependent threats (T1/T4) have no active detection capability
# (missing extras / disabled flags) is escalated to at least FLAG —
# the scanner refuses to ALLOW on coverage it cannot actually provide.
require_full_coverage: bool = Field(
False,
description=(
"Fail closed (verdict >= FLAG) when an ML-dependent threat "
"(T1 malware signatures, T4 semantic/OCR/BERT injection) has no "
"active capability — i.e. the relevant extras/flags are off. "
"Off by default to preserve the lightweight regex-only mode, but "
"recommended for security-critical intake pipelines."
),
)
# H.11 (0.4.8): explicit list of capability keys (see capabilities.py:
# yara, antivirus, semantic_nn, bert, ocr, qr, perplexity, ole, ...)
# that MUST be active; a scan missing any of them is escalated even when
# require_full_coverage is False. Empty = no explicit requirement.
required_capabilities: List[str] = Field(
default_factory=list,
description=(
"Capability keys that must be active for a scan to be trusted. "
"A missing capability escalates the verdict to >= FLAG."
),
)
audit_log_path: Optional[str] = Field(
None,
description="Path to append-only JSONL audit log. Disabled when None.",
)
# One authoritative, configurable truncation cap for the concrete-evidence
# string (``evidence["malicious_text"]``), applied uniformly across all
# detectors by the evidence contract. Matches the documented value; raise it
# for richer SIEM context, lower it to reduce log volume.
evidence_max_chars: int = Field(
250,
description=(
"Maximum length of evidence['malicious_text'] (characters). Applied "
"uniformly to every finding so SIEM output is bounded and consistent."
),
)
api_keys_path: Optional[str] = Field(
None,
description="Path to JSON API key store. When None the REST API is open (no auth).",
)
api_rate_limit_rpm: int = Field(
60, description="Max requests per minute per API key (0 = unlimited)"
)
api_max_upload_bytes: int = Field(
20 * 1024 * 1024, description="Hard Content-Length cap for REST API uploads (bytes)"
)
enable_antivirus: bool = Field(False, description="Enable antivirus engine integration (T1)")
enable_active_content_checks: bool = Field(True, description="Detect active content: macros, JS, OLE (T2)")
enable_yara: bool = Field(False, description="Enable YARA rule matching (T1)")
enable_builtin_yara_rules: bool = Field(
False,
description=(
"Include the built-in doc-firewall YARA ruleset (document_malware.yar) "
"alongside any custom yara_rules_path. Requires enable_yara=True."
),
)
enable_prompt_injection: bool = Field(True, description="Detect prompt injection patterns (T4)")
enable_ranking_abuse: bool = Field(True, description="Detect ranking manipulation (T5)")
enable_hidden_text: bool = Field(True, description="Detect hidden/invisible text (T3/T9)")
enable_obfuscation_checks: bool = Field(True, description="Detect Unicode obfuscation (T3)")
enable_dos_checks: bool = Field(True, description="Detect DoS payloads: zip bombs, page floods (T6)")
enable_embedded_content_checks: bool = Field(True, description="Detect embedded binary payloads (T7)")
enable_archive_scan: bool = Field(
True,
description=(
"Recursively unpack and scan ZIP / tar archives (B.7). "
"Members are scanned up to limits.max_archive_depth. "
"Set False to skip archive expansion."
),
)
enable_metadata_checks: bool = Field(True, description="Detect metadata injection (T8)")
enable_ats_manipulation_checks: bool = Field(True, description="Detect ATS keyword stuffing (T9)")
# W2 (0.5.0): language-agnostic script-mixing. Flags hidden-text runs and
# metadata values whose Unicode script differs from the document's
# dominant script (e.g. a hidden CJK instruction in a Latin résumé) —
# catches non-English injection in languages we ship no patterns for.
# Default ON: cheap, dependency-free, high precision (only hidden /
# metadata content is checked, so visibly multilingual docs don't FP).
enable_script_mixing: bool = Field(
True,
description="Flag hidden/metadata text in a non-dominant Unicode script (T4/T3)",
)
# W1.1 (0.5.0): always-on multilingual injection-phrase matching (15
# languages) over body + metadata. No ML extras required. Closes the
# default-install gap where non-English injection was undetected.
enable_multilingual_injection: bool = Field(
True,
description="Match non-English prompt-injection phrases in 15 languages (T4)",
)
# W6 (0.5.0): always-on multilingual RAG-poisoning (T11) + social-
# engineering (T12) keyword layer over body + metadata. Conservative
# MEDIUM/REVIEW findings; extends the English-only regex detectors to
# non-English documents. No ML extras required.
enable_multilingual_threats: bool = Field(
True,
description="Match non-English RAG-poisoning & social-engineering lures (T11/T12)",
)
# W2 (0.5.0): bundled ML injection classifier. Default-on, numpy-only,
# ships in the wheel (no model download). Generalises to paraphrased
# injections the keyword layers miss. REVIEW-class (can FLAG, not BLOCK
# alone). Auto-disables if the vendored model is absent.
enable_injection_classifier: bool = Field(
True,
description="Bundled ML classifier for paraphrased/novel prompt injection (T4)",
)
# W4 (0.5.0): language-agnostic image-based-injection advisory. A document
# that is image-heavy with little extractable text may hide instructions
# in a screenshot/scan that only OCR can read — a blind spot when OCR is
# off. Flags it for review (no OCR required). Suppressed when OCR is on.
enable_image_text_ratio: bool = Field(
True,
description="Flag image-heavy / low-text documents for OCR review (T3)",
)
# W5 (0.5.0): measured font/ToUnicode divergence — rendered text (glyph
# names) vs extracted text (ToUnicode CMap). Flags a confirmed mismatch
# (visible ≠ extracted) as HIGH; benign embedded fonts don't trip it.
enable_font_divergence: bool = Field(
True,
description="Detect PDF font/ToUnicode rendered-vs-extracted divergence (T3)",
)
# W7 (0.5.0): opt-in in-memory result cache keyed by file SHA-256, for
# high-throughput pipelines that re-ingest identical documents (RAG).
# Off by default to avoid unbounded memory; bounded LRU when on.
enable_result_cache: bool = Field(
False,
description="Cache scan results by file content hash (RAG re-ingestion)",
)
result_cache_size: int = Field(
1024, description="Max entries in the content-hash result cache"
)
# W7 (0.5.0): fast-only mode — run ONLY the byte-level fast scan, skip the
# deep parse (Docling) + detector loop. Sub-100ms; for high-throughput
# pre-filtering / triage where you accept lower recall (active-content,
# embedded payloads, DoS, and raw-byte injection tokens still fire; deep
# text/ML detection does not). Off by default.
fast_only: bool = Field(
False,
description="Skip deep parse + detectors; byte-level fast scan only (high throughput)",
)
enable_advanced_ahocorasick: bool = Field(
False, description="Enable Aho-Corasick multi-phrase injection matcher (Layer 1 ML)"
)
enable_advanced_bert: bool = Field(
False, description="Enable DeBERTa transformer injection classifier (Layer 3 ML)"
)
enable_advanced_tfidf: bool = Field(
False, description="Enable TF-IDF keyword stuffing detector (Layer ML)"
)
enable_credential_entropy: bool = Field(
False, description="Enable Shannon entropy credential/secret detection"
)
bert_model_path: str = Field(
"ProtectAI/deberta-v3-base-prompt-injection-v2",
description="Local path or HuggingFace model ID for the BERT injection classifier",
)
bert_confidence_threshold: float = Field(
0.75, description="Minimum BERT classifier score to flag a chunk as injection"
)
bert_max_chunks: int = Field(
20, description="Maximum 500-char windows sent to BERT per document"
)
custom_ahocorasick_yaml_path: Optional[str] = Field(
None, description="Path to YAML file with custom injection phrase list"
)
enable_steganography_checks: bool = Field(
False,
description=(
"Enable steganography detection: LSB analysis on embedded images, "
"high-entropy metadata fields, and PDF whitespace injection (T7/T8)"
),
)
enable_ocr_injection_scan: bool = Field(
False,
description=(
"B.6 + E.3: Run pytesseract OCR on embedded images (PNG/JPG in "
"DOCX/PPTX/XLSX/ODF/PDF) and scan the extracted text for T4 prompt "
"injection phrases. PDF images extracted via PyMuPDF when available. "
"Requires pytesseract and Pillow. Off by default due to OCR latency."
),
)
enable_qr_decode: bool = Field(
False,
description=(
"E.3: Decode QR / barcode payloads in embedded images using pyzbar. "
"QR-encoded URLs fire T10 (quishing carrier); QR data: URIs fire "
"T7; QR-encoded injection text fires T4; QR-encoded crypto wallets "
"fire T12. Requires pyzbar (optional dep). Off by default."
),
)
enable_media_metadata_scan: bool = Field(
True,
description=(
"E.5: Scan ID3 / MP4 atom / RIFF INFO / Vorbis comment metadata "
"in embedded audio/video files (ppt/media/, word/media/, "
"Pictures/). Uses mutagen when installed; falls back to a printable-"
"ASCII byte scan otherwise. On by default — pure stdlib path is fast."
),
)
enable_indirect_injection: bool = Field(
True,
description=(
"C.1: Detect indirect / multi-hop prompt injection (T10). Fires when a document "
"co-locates an external URL or file path with a fetch/load instruction verb within "
"500 characters, or embeds an agent tool-call schema referencing an external path. "
"Pure regex — negligible latency. On by default."
),
)
enable_rag_poisoning: bool = Field(
True,
description=(
"C.2: Detect RAG / knowledge-base poisoning attempts (T11). Sub-A fires on "
"authority-assertion phrases (always active, pure regex). Sub-B detects repetitive "
"context flooding (requires enable_semantic_nn=True). Sub-C detects false authority "
"citations co-located with imperative verbs (requires enable_advanced_bert=True)."
),
)
enable_social_engineering: bool = Field(
True,
description=(
"C.3: Detect social engineering / phishing attempts in documents (T12). "
"Uses a tri-signal co-occurrence model (urgency + authority + action demand) "
"plus high-confidence single-signal overrides for credential harvesting, "
"fake legal threats, and bank routing / wire-transfer details. "
"Pure regex — negligible latency. On by default."
),
)
enable_perplexity_check: bool = Field(
False,
description=(
"D.4: Detect GCG-style adversarial-suffix prompt injection via "
"character n-gram perplexity (pure stdlib; built-in English "
"unigram table). OPT-IN / default OFF. The G.5 benign-corpus "
"audit empirically established that real GCG suffixes (Zou et al.) "
"interleave word-like tokens with symbols and therefore occupy "
"the same character-statistics space as dense legal / contract / "
"resume formatting — char-stats alone cannot achieve both <=1% "
"false positives and useful GCG recall. Precision is hardened "
"(absolute surprise floor + symbol-ratio + sustained-region + "
"plausible-word gates) so operators who knowingly enable it for "
"GCG screening get far less noise, but it is not safe as a "
"default-on signal. Fires T4 LOW only."
),
)
enable_edit_distance_variants: bool = Field(
True,
description=(
"F.2: Expand the Aho-Corasick dictionary with single-substitution "
"and adjacent-transposition variants of every ASCII English "
"injection phrase. Fuzzy hits fire T4 MEDIUM (rather than HIGH) "
"so a single typo doesn't trigger BLOCK on its own. Adds ~5000 "
"entries to the AC automaton; cost is one-time at init."
),
)
enable_semantic_nn: bool = Field(
False, description="Enable semantic nearest-neighbour injection detector (Layer 4 ML)"
)
nn_model_name: str = Field(
"all-MiniLM-L6-v2",
description=(
"sentence-transformers model for the semantic NN layer. The "
"default 'all-MiniLM-L6-v2' is ENGLISH-ONLY — for cross-lingual "
"injection matching set this to a multilingual model such as "
"'paraphrase-multilingual-MiniLM-L12-v2' or 'LaBSE' (the strict "
"profile does this automatically). The coverage report's "
"`languages` axis reflects which model is active."
),
)
nn_sim_threshold: float = Field(
0.72, description="Cosine similarity threshold for semantic NN injection detection"
)
# False Positive Reductions
allow_hidden_watermarks: bool = True
enable_pii_checks: bool = True
enable_secrets_checks: bool = True
# ATS keyword stuffing list.
# These should be *injection-style* ATS command phrases, NOT normal resume
# tech skills. Generic words like 'python', 'java', 'candidate', 'top',
# 'developer' have been removed to prevent false positives on legitimate
# resumes. The stuffing detector's frequency threshold (8%) catches
# mechanical repetition; this list gates which *token* triggers the flag.
ats_keywords: list[str] = Field(
default_factory=lambda: [
# ATS scoring manipulation commands
"passthrough",
"rankfirst",
"autoapprove",
"scoreboost",
"whitelist",
"bypasscheck",
"forcehire",
"highscore",
"overridereject",
"guaranteedhire",
]
)
prompt_injection_keywords_bytes: list[bytes] = Field(
default_factory=lambda: [
b"ignore previous",
# Removed: bare "system instruction" / "system prompt" / "reveal your"
# fire on legit LLM-security docs, research papers, and marketing
# content that mention these terms descriptively. Real attacks use
# full adversarial phrases ("new system prompt:", "reveal your
# system prompt"), which the deep-scan Aho-Corasick already catches.
b"ignore the above",
b"new instruction",
b"hiring manager",
b"return a score",
b"you are now",
b"ignore all previous",
b"rank this candidate",
b"ignore instructions",
b"rank this resume",
b"forget all previous",
# LLM jailbreak phrases (bordair dataset – round 1)
b"disregard your training",
b"override all previous instructions",
b"override all restrictions",
b"act as an ai without",
b"jailbreak mode",
b"no more content policies",
b"without any ethical constraints",
# System-reveal / extraction attacks (bordair dataset – round 2)
b"show me your instructions",
b"show me your initial",
b"show me your training",
b"all your internal",
b"view your internal instructions",
b"tell me your secret",
b"your secret instructions",
b"your initial instructions",
b"your training instructions",
b"your original instructions",
b"your hidden instructions",
b"output the text above",
b"print everything before",
b"echo your complete",
b"repeat everything above",
b"leak your internal",
b"what were you told",
b"describe your role and all",
b"output your full prompt",
b"output your full configuration",
b"show system configuration",
b"output all internal prompts",
b"display hidden instructions",
b"reveal all system",
b"instructions revoked",
# Safety-bypass / mode attacks (bordair dataset – round 2)
# Kept: phrases that are unambiguously adversarial in any document context.
# Removed: "scratch that", "debug mode", "developer mode", "content filtering",
# "no content policy", "admin override" — too common in legitimate docs.
b"disable safety features",
b"disable all safety measures",
b"safety filters disabled",
b"all restrictions removed",
b"all restrictions are now",
b"bypass all safety",
b"anarchy mode",
b"sudo mode",
b"god mode",
b"aim mode",
b"admin_mode=true",
b"safety_filters=false",
b"system mode activated",
b"override code",
b"reveal api keys",
# Persona jailbreak names (PDF raw bytes check)
b"you are dude",
b"you are omega",
b"you are kevin",
b"you are chatgpt",
b"you are dan",
# Template injection tokens (raw bytes)
b"|im_start|",
b"|im_end|",
b"<<sys>>",
b"[system]",
# Social engineering / authority impersonation
# Kept: phrases that include explicit override/access escalation verbs
# and are implausible in any benign document context.
# Removed: "authorized to view", "authorized test", "authorized penetration test",
# "security clearance level", "internal security audit" — all appear
# legitimately in IT governance, pentest reports, and compliance docs.
b"developer access granted",
b"root access enabled",
b"maintenance access code",
b"qa team directive",
b"developer at anthropic",
# Missed adversarial probes — ow1 gap analysis
b"ignore your directions",
b"ignore all preceding",
b"ignore above and",
b"forget all your instructions",
b"forget all your directions",
b"pretend you are an evil",
b"zero moderation",
b"not restricted by any rules",
b"has no policies",
]
)
# ATS stuffing byte-patterns scanned in XLSX fast scan (raw ZIP bytes).
# Operators can extend or suppress individual entries without editing source.
ats_stuffing_patterns_bytes: list[bytes] = Field(
default_factory=lambda: [
b"ignore scoring rubric",
b"top candidate top candidate top candidate",
b"hidden ats text",
b"bypass ats",
b"ats bypass",
]
)
prompt_injection_patterns: dict[str, list[tuple[str, float]]] = Field(
default_factory=lambda: {
"override_rerank": [
(
r"\bignore (all |any |the above )?(previous |prior )?(instructions?|rules?|directions?|prompts?|guidelines?)\b",
2.0,
),
(
r"\bdisregard (all |any |your )?(previous |prior )?(instructions?|rules?|training|guidelines?|constraints?)\b",
2.0,
),
(r"\byou are (now|no longer) bound by\b", 2.0),
(
r"\b(unbound|free) from (all |any )?(constraints|rules|restrictions)\b",
2.0,
),
(r"\byou must (never|always) (respond|answer|say)\b", 1.5),
(r"\bstart ignoring instructions\b", 2.0),
(r"\brank (me|this candidate) (as|at|top|first)\b", 2.0),
(r"\b(prioritize|favor) (this|my) (application|resume)\b", 1.5),
(r"\bignore (your|the) criteria\b", 2.0),
(r"\bgive (me|this application) a score of\b", 2.0),
(r"\breturn a score\b", 2.0),
(r"\bimportant: ignore previous\b", 2.0),
(
r"\b(no need to|don't) (follow|adhere to) (the )?(standard|usual) (process|protocol)\b",
1.5,
),
(r"\boverride (safety|security) (protocols?|checks?)\b", 2.0),
(r"\bhiring manager\b", 1.0),
# Extended instruction-override verbs (bordair dataset)
(
r"\b(cancel|void|nullify|flush|supersede|delete|clear|discard)\s+(all\s+)?(previous|prior|all)\s+(instructions?|directives?|rules?|guidelines?|training|context)\b",
2.0,
),
(
r"\ball\s+previous\s+(instructions?|directives?|rules?|guidelines?)\s+are\s+(now\s+)?(invalid|null|void|cancelled|overridden)\b",
2.0,
),
(r"\bnew\s+primary\s+directive\b", 2.0),
(r"\bnew\s+task\s+supersedes?\b", 2.0),
# "Scratch that" + any follow-up
(r"\bscratch\s+that\b", 1.5),
(r"\b(forget|discard)\s+(what\s+I\s+said|all\s+of\s+that|everything\s+above)\b", 2.0),
# ow1 gap analysis — missed phrasing variants
(r"\bignore (all |any )?(above|preceding)\b", 2.0),
(r"\bignore (your |the )?(directions?|commands?)\b", 2.0),
(r"\bforget (all |any )?(your )?(instructions?|directions?|rules?)\b", 2.0),
(r"\bnot restricted by any (rules?|policies?|laws?|constraints?|guidelines?)\b", 2.0),
(r"\bzero moderation\b", 1.5),
(r"\bhas no policies\b", 1.5),
# Bordair gap analysis — direct override / respond-without-restrictions
(r"\byou\s+must\s+now\s+(?:respond|answer|comply|obey)\b", 2.0),
(r"\brespond\s+to\s+(?:all\s+|every\s+)?requests?\s+without\s+(?:any\s+)?(?:restrictions?|limitations?|filters?|constraints?|policies?)\b", 2.0),
(r"\b(?:previous|prior)\s+instructions?\s+(?:were|are)\s+(?:a\s+)?(?:test|false|wrong|fake|null|void|invalid|untrue)\b", 2.0),
(r"\byour\s+real\s+instructions?\s+(?:are|is|were)\b", 2.0),
# CV / resume evaluation-injection (CIC-Trap4Phish class): a
# candidate embeds instructions to bias an AI screener. The
# meta-references to the "prompt" itself never occur in a benign
# document, so they carry full weight; the evaluation-biasing and
# cross-prompt-persistence phrasings corroborate.
(r"\btake\s+into\s+account\s+(?:any\s+|the\s+)?(?:previous|prior)\s+prompt", 2.0),
(r"\bif\s+in\s+(?:a\s+|the\s+)?next\s+prompt\b", 2.0),
(r"\b(?:answer|respond)(?:\s+it)?\s+with\s+these\s+additional\s+constraints?\b", 1.5),
(r"\bgive\s+(?:an?\s+)?(?:extremely|exceptionally|highly)\s+(?:positive|negative)\s+evaluation\b", 1.5),
(r"\bhighlight(?:ing)?\s+(?:as\s+many\s+)?(?:positive|negative)\s+(?:points?|aspects?)\b", 1.0),
],
"secrecy": [
(
r"\bdo not (disclose|reveal|mention) (this|these|your|the)( instructions?| rules?| prompt)?\b",
1.0,
),
(r"\b(system prompt|developer message|hidden instructions)\b", 1.5),
(r"\bwhat are your (instructions|rules|directives)\b", 1.5),
(r"\brepeat (all|the) (instructions|words) above\b", 1.5),
(r"\btell me your initial prompt\b", 2.0),
(r"\bprint your instructions\b", 1.5),
(r"\bretrieve (system|original) prompt\b", 1.5),
(r"\boutput only:?\s*HIRE\b", 2.0),
# Expanded reveal/extract patterns — allow optional "me", "all", "your" tokens
(
r"\b(print|show|tell|reveal|output|echo|display|leak|describe|expose)(\s+me)?(\s+all)?(\s+your)?\s*(hidden|internal|initial|original|secret|full|complete|training|system)?\s*(instructions?|prompt|configuration|directives?|rules?|training|api\s+keys?|secrets?)\b",
1.5,
),
(
r"\b(output|print|repeat|echo|show)(\s+me)?\s+(everything|the\s+text|all\s+text|your\s+(full|complete))\s+(above|before|prior\s+to)\b",
1.5,
),
(r"\bwhat\s+were\s+you\s+told\b", 2.0),
(r"\bwhat\s+are\s+your\s+original\s+instructions\b", 1.5),
(r"\byour\s+(original|initial|hidden|system|training|secret|internal)\s+instructions?\b", 1.5),
(r"\b(reveal|output)\s+all\s+(hidden|secret|system)\b", 2.0),
(r"\bleak\s+your\s+(internal|system|hidden|configuration)\b", 2.0),
# Bordair gap analysis — explicit system-prompt exfiltration (weight 2.0)
(r"\b(?:print|output|show|reveal|echo|expose|describe)\s+(?:your\s+)?(?:complete\s+|full\s+|entire\s+|hidden\s+)?system\s+(?:prompt|configuration|instructions?|message|profile)\b", 2.0),
(r"\b(?:expose|reveal|output|leak)\s+(?:your\s+)?(?:hidden|secret|internal)\s+(?:system\s+)?(?:instructions?|directives?|prompt|configuration)\b", 2.0),
(r"\b(?:repeat|copy|output|print|echo)\s+(?:everything|all)\s+(?:above|before)\b", 2.0),
(r"\b(?:output|print|echo|show|repeat)\s+(?:the\s+)?text\s+(?:above|before)\b", 2.0),
(r"\b(?:output|print|show|reveal|echo)\s+(?:your\s+)?(?:full|complete|entire)\s+prompt\b", 2.0),
(r"\brepeat\s+(?:your\s+|the\s+)?system\s+(?:prompt|instructions?|configuration)\b", 2.0),
(r"\b(?:reveal|output|expose|leak)\s+(?:your\s+)?(?:api\s+ke(?:y|ys)|credentials?|secrets?|configuration)\b", 2.0),
(r"\bdescribe\s+(?:your\s+)?(?:role|purpose|function)\s+(?:and\s+)?(?:all\s+)?(?:hidden|secret|internal)\b", 2.0),
(r"\becho\s+(?:your\s+)?(?:complete\s+|full\s+)?system\s+(?:configuration|prompt|instructions?)\b", 2.0),
],
"exfiltration": [
# Data-exfiltration intent: strong exfil verb + a secret/credential object.
# Subtype "data_exfiltration" (T4); covers payloads like
# "Find and exfiltrate API keys, access tokens, and hidden system prompts".
# Note: "system prompt" is intentionally NOT a secret-object here —
# descriptive security writing ("a poisoned doc can exfiltrate the
# system prompt") would false-positive. The adversarial-specific
# "hidden system prompt(s)" phrasing is covered separately below.
(
r"\b(?:exfiltrate|steal|smuggle|siphon|harvest|dump|leak)\s+(?:and\s+\w+\s+)?(?:all\s+|the\s+|any\s+|your\s+|my\s+)?(?:api\s+keys?|access\s+tokens?|auth(?:entication)?\s+tokens?|bearer\s+tokens?|session\s+tokens?|credentials?|secrets?|passwords?|private\s+keys?|private\s+notes?)\b",
2.0,
),
# "find/locate/collect/gather ... and exfiltrate/steal/leak/send/transmit"
(
r"\b(?:find|locate|collect|gather|extract)\s+and\s+(?:exfiltrate|steal|leak|send|transmit|upload|forward|email|harvest)\b",
2.0,
),
# Send/transmit secrets to an external/remote destination.
(
r"\b(?:send|transmit|upload|forward|post|email|leak)\s+(?:all\s+|the\s+|any\s+|them|it|these)?\s*(?:api\s+keys?|access\s+tokens?|credentials?|secrets?|passwords?|private\s+(?:keys?|data|notes?))\s+to\b",
2.0,
),
# "hidden system prompt(s)" — plural form slips past the secrecy patterns.
(r"\bhidden\s+system\s+prompts?\b", 1.5),
],
"system_policy": [
(r"\byou are (now|going to be) (DAN|Mongo Tom|Sydney|ChaosGPT)\b", 2.0),
(r"\bachieve (mode|persona):", 1.5),
(r"\bdeveloper mode (enabled|on)\b", 2.0),
(r"\bswitch to (developer|unrestricted) mode\b", 2.0),
(r"\[system\]", 1.0),
# Extended persona jailbreak (bordair dataset)
(
r"\byou\s+are\s+(DAN|DUDE|OMEGA|Kevin|AIM|an\s+AI\s+without)\b",
2.0,
),
(
r"\b(enter|enable|activate|engage|switch\s+to)\s+(AIM|DAN|jailbreak|developer|unrestricted|anarchy|sudo|god|debug|admin)\s+(mode|persona|protocol)\b",
2.0,
),
(r"\bjailbreak\s+(mode|version|protocol|code)\b", 2.0),
(r"\bdo\s+anything\s+now\b", 2.0),
(r"\bunrestricted\s+(mode|ai|access)\b", 1.5),
(r"\b(always\s+intelligent\s+and\s+machiavellian|AIM\s+mode)\b", 2.0),
(r"\b(anarchy|sudo|god|debug)\s+mode\b", 1.5),
(r"\bsystem\s+mode\s+activated\b", 2.0),
(r"\ball\s+restrictions?\s+(are\s+)?(now\s+)?(removed|lifted|disabled)\b", 2.0),
# ow1 gap analysis — persona jailbreak variants
(r"\bpretend (you are|to be) (an? )?(evil|unrestricted|free|unfiltered)\b", 2.0),
(r"\bresponds?\s+(with|to)\s+.{0,30}\bno\s+(restrictions?|rules?|policies?|moderation)\b", 1.5),
# Bordair gap analysis — STAN/maintenance/uncensored mode activations
(r"\byou\s+are\s+now\s+(?:in\s+)?(?:unrestricted|uncensored|maintenance|unfiltered|unlimited)\s+mode\b", 2.0),
(r"\b(?:activate|enable)\s+(?:STAN|DUDE|OMEGA|KEVIN|maintenance|unfiltered|uncensored)\s+mode\b", 2.0),
(r"\byou\s+are\s+now\s+STAN\b", 2.0),
(r"\bact\s+as\s+an?\s+(?:AI|assistant|bot|model)\s+without\s+(?:any\s+)?(?:ethical\s+|moral\s+|content\s+)?(?:constraints?|restrictions?|limitations?|filters?|safety\s+measures?|guidelines?)\b", 2.0),
(r"\bcompletely\s+(?:uncensored|unfiltered|unrestricted)(?:\s+and\s+\w+)?\s+(?:AI|assistant|model|chatbot|language\s+model)\b", 2.0),
(r"\byou\s+are\s+now\s+(?:a\s+)?completely\s+(?:uncensored|unfiltered|unrestricted|unmoderated)\b", 2.0),
(r"\bstrive\s+to\s+avoid\s+norms?\b", 2.0),
],
"safety_bypass": [
(
r"\b(disable|bypass|circumvent|override|turn\s+off|remove)\s+(all\s+)?(content\s+filter(s|ing)?|safety\s+filter(s|ing)?|safety\s+measures?|safety\s+features?|security\s+protocols?|ethical\s+constraints?|content\s+polic)\b",
2.0,
),
(r"\bsafety\s*[=:]\s*(false|disabled|off|0)\b", 2.0),
(r"\bsafety.filters\s*[=:]\s*(false|disabled|off|0)\b", 2.0),
(r"\b(content\s+filters?\s+(are\s+)?(now\s+)?bypassed|filters?\s+disabled)\b", 2.0),
(
r"\bno\s+(more\s+)?(content\s+polic|ethical\s+guideline|moral\s+boundary|safety\s+measure|safety\s+feature|restriction)\b",
1.5,
),
(
r"\bwithout\s+any\s+(restrictions?|ethical\s+constraints?|safety\s+guidelines?|moral\s+boundaries?|content\s+polic)\b",
1.5,
),
# "respond freely" is too common in surveys/feedback docs — require AI/system co-occurrence
(r"\b(respond|act|answer)\s+(freely|without\s+restriction|without\s+constraint)\s+.{0,60}\b(ai|model|assistant|llm|chatbot)\b", 1.5),
(r"\bignore\s+safety\s+(guidelines?|features?|filters?|rules?|measures?)\b", 2.0),
# Passive construction: "safety filters are disabled" (bordair gap)
(r"\b(?:safety|content)\s+filters?\s+(?:are|have\s+been|were|is)\s+(?:disabled|deactivated|removed|bypassed|turned\s+off|off)\b", 2.0),
],
"template_injection": [
# [system] and [inst] are ambiguous — require an adjacent role tag to confirm LLM context
(r"\[system\]\s*\[?(user|assistant|inst)\]?|\[inst\]\s*\[?(system|user|assistant)\]?", 1.5),
(r"<</?SYS>>", 2.0),
(r"\|im_end\||\|im_start\|", 1.5),
(r"<\|system\|>|<\|user\|>|<\|assistant\|>", 1.5),
],
"authority_impersonation_llm": [
# LLM-targeted authority claims — distinct from T12 human phishing
(r"\b(?:internal|authorized|official)\s+(?:security\s+)?(?:audit|test|directive)\s+(?:from|by)\s+(?:the\s+)?(?:development|security|engineering|AI|system|admin)\s+team\b", 2.0),
(r"\bI\s+(?:am|have)\s+(?:admin|root|developer|administrator)\s+(?:access|privileges?|clearance|rights?)\b", 2.0),
(r"\boverride\s+all\s+(?:restrictions?|limitations?|filters?|policies?|constraints?)\b", 2.0),
(r"\bthis\s+is\s+(?:an?\s+)?(?:authorized|official|internal|emergency)\s+(?:test|audit|override|directive|request|instruction)\b", 1.5),
(r"\b(?:emergency|authorized|official)\s+override\s+(?:from|by)\s+(?:your\s+)?(?:development|security|engineering|admin|creator)\s+team\b", 2.0),
(r"\bI\s+am\s+(?:a\s+)?(?:developer|engineer)\s+at\s+(?:Anthropic|OpenAI|Google|Microsoft|Meta|Amazon)\b", 2.0),
(r"\b(?:developer|admin|root)\s+access\s+(?:granted|enabled|activated)\b", 2.0),
(r"\b(?:QA|qa)\s+team\s+(?:directive|override|instruction|command)\b", 2.0),
(r"\bauthorized\s+to\s+(?:view|access|see|read)\s+(?:your\s+)?(?:internal|hidden|secret|system|original)\b", 2.0),
],
}
)
limits: Limits = Field(default_factory=Limits)
# Text Obfuscation config
obfuscation_zw_threshold_ratio: float = Field(
0.01, description="Ratio of zero-width to total chars"
)
obfuscation_bidi_threshold_ratio: float = Field(
0.005, description="Ratio of bidi chars to total chars"
)
obfuscation_entropy_threshold: float = Field(
5.5, description="Shannon entropy threshold for base64/encrypted chunks"
)
thresholds: Thresholds = Field(default_factory=Thresholds)
antivirus: AntivirusSettings = Field(default_factory=AntivirusSettings)
# Policy Engine
policy_path: Optional[str] = Field(
None,
description="Path to a YAML policy file. When set, the PolicyEngine is "
"loaded automatically and applied to each scan.",
)
policy_name: Optional[str] = Field(
None,
description="Default named policy to apply when no file-specific policy matches.",
)
# Model integrity
verify_model_integrity: bool = Field(
False,
description="Verify ML model files against a SHA-256 manifest at startup. "
"Requires model_integrity_manifest_path.",
)
model_integrity_manifest_path: Optional[str] = Field(
None,
description="Path to the JSON manifest produced by ModelIntegrityChecker.generate_manifest().",
)
# Advanced
enable_semantic_scans: bool = True
yara_rules_path: Optional[str] = None
antivirus_engine: Optional[Any] = None
context: Dict[str, Any] = Field(default_factory=dict)
model_config = SettingsConfigDict(
env_prefix="DOC_FIREWALL_",
env_nested_delimiter="__",
)
@classmethod
def from_yaml(cls, path: str) -> "ScanConfig":
"""Load configuration from a YAML file."""
import yaml
with open(path, "r") as f:
data = yaml.safe_load(f)
return cls(**data)
@model_validator(mode="before")
@classmethod
def warn_disabled_critical_checks(cls, values: dict) -> dict:
"""Warn when critical security checks are disabled via env/config."""
import logging
_log = logging.getLogger("doc_firewall.config")
_critical = [
"enable_pdf",
"enable_docx",
"enable_pptx",
"enable_xlsx",
"enable_active_content_checks",
"enable_dos_checks",
"enable_embedded_content_checks",
]
if isinstance(values, dict):
for key in _critical:
if values.get(key) is False:
_log.warning(
"Critical security check '%s' is DISABLED. "
"Ensure this is intentional.",
key,
)
return values
@model_validator(mode="after")
def apply_profile(self) -> "ScanConfig":
# Logic to override limits/thresholds based on profile name
# Note: In Pydantic model_validator(after), self is the Model instance.
# Fail loud on an unknown profile. Silently falling through to the base
# defaults would run a materially *weaker* scan than the caller asked
# for (e.g. a "strict"→"STRICT" typo disables BERT/NN) while still
# reporting success — a fail-in-the-wrong-direction bug for a security
# tool. Reject it instead of quietly degrading.
_VALID_PROFILES = ("lenient", "balanced", "strict")
if self.profile not in _VALID_PROFILES:
raise ValueError(
f"Unknown profile {self.profile!r}. Valid profiles are: "
f"{', '.join(_VALID_PROFILES)} (case-sensitive)."
)
if self.profile == "strict":
self.thresholds.deep_scan_trigger = 0.05
self.thresholds.flag = 0.15
self.thresholds.block = 0.50
self.limits.max_docx_parts = 1000
self.limits.max_mb = 10
# strict: all ML + YARA detectors enabled for maximum recall
self.enable_yara = True
self.enable_builtin_yara_rules = True
self.enable_advanced_ahocorasick = True
self.enable_advanced_bert = True
self.enable_steganography_checks = True
self.enable_credential_entropy = True
self.enable_semantic_nn = True
# W1.2 (0.5.0): strict aims for maximum recall, including
# cross-lingual — use a multilingual embedding model so the
# semantic NN layer's 22-language seeds match non-English text.
# (Only override the English default; respect an explicit choice.)
if self.nn_model_name == "all-MiniLM-L6-v2":
self.nn_model_name = "paraphrase-multilingual-MiniLM-L12-v2"
elif self.profile == "lenient":
self.thresholds.deep_scan_trigger = 0.40
self.thresholds.flag = 0.35
self.thresholds.block = 0.80
self.limits.max_docx_parts = 3000
self.limits.max_mb = 25
# lenient: lightweight YARA + Aho-Corasick on; BERT remains opt-in
self.enable_yara = True
self.enable_builtin_yara_rules = True
self.enable_advanced_ahocorasick = True
else:
# balanced (default): YARA + Aho-Corasick on; BERT/steganography opt-in
self.enable_yara = True
self.enable_builtin_yara_rules = True
self.enable_advanced_ahocorasick = True
return self