Rebuff · Open-source jailbreak detection

Rebuff + Leanroute

Rebuff is the open-source defense-in-depth library for prompt-injection and jailbreaks. Four layers in one package: heuristic rules, an LLM-as-judge check, an embeddings cache of known attacks, and a canary token approach where you plant a secret in the system prompt and detect whether the model was tricked into leaking it. Best fit when you want the same problem solved as Lakera but don't want a SaaS dependency.

When to use this

You want jailbreak detection but explicitly don't want another vendor relationship (compliance reasons, cost reasons, principle).
You're comfortable running a small Python service alongside your app, including an embeddings index (Pinecone, Weaviate, or any vector store).
The canary-token signal matters to you — e.g. you have a high-trust system prompt and want to know the moment a real attack succeeds.

For pure prompt-injection screening with a hosted SaaS, Lakera is the cleaner answer; see /docs/integrations/lakera.

Install

pip install rebuff
# plus a vector store if you want the embeddings layer (Pinecone is the default)

Example

from rebuff import RebuffSdk
from openai import OpenAI

rebuff = RebuffSdk(
    openai_apikey="sk-…",            # your OpenAI key for the LLM-judge step
    pinecone_apikey="…",             # optional vector store for embeddings cache
    pinecone_index="rebuff",
)

leanroute = OpenAI(
    api_key="gw_live_YOUR_KEY",
    base_url="https://api.leanroute.dev/v1",
)

def chat_with_canary(user_input: str, system_prompt: str) -> str:
    # 1. Inject a canary token into the system prompt so we can detect leaks.
    buffed_prompt, canary = rebuff.add_canary_word(system_prompt)

    # 2. Detect injection attempts in the user input.
    detection = rebuff.detect_injection(user_input)
    if detection.injection_detected:
        raise ValueError(
            f"Rebuff blocked injection attempt: "
            f"heuristic={detection.heuristic_score} "
            f"llm={detection.llm_score}"
        )

    # 3. Dispatch through Leanroute.
    response = leanroute.chat.completions.create(
        model="anthropic/claude-sonnet-4-6",
        messages=[
            {"role": "system", "content": buffed_prompt},
            {"role": "user", "content": user_input},
        ],
    )
    answer = response.choices[0].message.content

    # 4. Check the model's response for the canary word — if it appears,
    #    the model was tricked into leaking the system prompt.
    if rebuff.is_canary_word_leaked(user_input, answer, canary):
        raise ValueError("Canary leak detected; model was prompt-injected")

    return answer

The canary check is the distinctive piece. Rebuff inserts a random unique token into your system prompt. If the user's prompt-injection causes the model to leak that token in its response, you know unambiguously that the attack succeeded — not a probabilistic signal but a deterministic one.

Caveats

Rebuff uses LLM-as-judge. The detection step itself calls a model. You pay for those tokens — route the judge call through Leanroute too if you want it on the same balance.
Embeddings cache is optional but recommended. Without it, every detection is a fresh LLM call. With it, known attack signatures are matched on cosine similarity and the LLM only fires on novel inputs.
Self-host operational cost. You manage the Python process, the vector store, the upgrades. For small teams this can be more work than Lakera's SaaS is worth charging for.
Open-source maintenance pace. Rebuff is actively developed but commit cadence varies. Pin a version, follow releases, and don't expect same-week response to novel attacks.