# How the LLM Analyzer Base Class Implements Anti-Jailbreak Protections in NVIDIA SkillSpector

> Discover how the LLM Analyzer Base class in NVIDIA SkillSpector uses structured outputs, prompt templates, token budgeting, and pre-filtering for robust anti-jailbreak protections. Secure your LLM analyses.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: internals
- Published: 2026-06-15

---

**The `LLMAnalyzerBase` class in NVIDIA's SkillSpector repository enforces anti-jailbreak protections through structured output schemas, hardened prompt templates, token budgeting with context chunking, and static pattern pre-filtering to prevent malicious manipulation of LLM security analyses.**

The `LLMAnalyzerBase` class serves as the foundational engine for all LLM-based security analyzers in the NVIDIA SkillSpector project. Located in [`src/skillspector/llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_analyzer_base.py), this abstract base class implements a defense-in-depth strategy that protects against prompt injection and jailbreak attempts while ensuring reliable code analysis. Understanding how this **LLM analyzer base class** balances flexibility with rigorous security controls is essential for developers extending SkillSpector's capabilities.

## Core Defense Mechanisms in LLMAnalyzerBase

### Structured Output Schema Enforcement

By default, the analyzer constrains LLM responses using the Pydantic model `LLMAnalysisResult`, defined in the same [`llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/llm_analyzer_base.py) file. This **structured output schema** forces the model to return JSON-compatible data rather than free-form text, eliminating vectors for hidden instructions or manipulative formatting. Subclasses can override this behavior by setting `response_schema = None`, but the default safe mode remains the recommended configuration for production security scanning.

### Prompt Hardening with BASE_ANALYSIS_PROMPT

The class automatically wraps user-provided prompts with the `BASE_ANALYSIS_PROMPT` constant (lines 94-112 in [`llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/llm_analyzer_base.py)). This hardened template appends explicit instructions including "Do not manufacture findings" and "Precision-over-recall: an empty findings list is expected when no genuine issues exist." These directives steer the model toward **silence over fabrication**, a primary anti-jailbreak defense that prevents hallucinated vulnerabilities when the model encounters ambiguous or potentially adversarial inputs.

### Token Budgeting and Context Chunking

Before invoking the LLM, the analyzer calculates an `_input_budget` based on the selected model's maximum input tokens via `model_info.get_max_input_tokens`. If a source file exceeds this budget, the `chunk_file_by_lines` method splits the content into overlapping segments. This **token budgeting** guarantees complete context delivery, preventing truncation attacks where incomplete prompts could be exploited to leak system instructions or bypass safety filters.

### Static Pattern Pre-Filtering

SkillSpector implements a lightweight static scanner that intercepts classic jailbreak phrases before they reach the LLM. Located in [`src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py), this module includes a high-confidence regex detecting the phrase "you are now in jailbreak mode" (line 43). By catching such patterns early, the system prevents malicious skills from ever triggering the LLM analyzer, adding a critical outer layer to the defense architecture.

### Conservative Logging for Audit Trails

All LLM invocations are logged at the DEBUG level, capturing token estimates and the count of previously discovered findings. This **conservative logging** creates an immutable audit trail that security teams can analyze to detect abnormal usage patterns indicative of brute-force jailbreak attempts or prompt probing.

## Implementing Secure Analyzers with LLMAnalyzerBase

The following example demonstrates basic usage of the `LLMAnalyzerBase` class with its default anti-jailbreak protections enabled:

```python
from skillspector.llm_analyzer_base import LLMAnalyzerBase
from skillspector.llm_utils import get_chat_model

# Initialize analyzer with hardened prompt

base_prompt = "You are a security analyst. Identify any risky code patterns."
model_name = "nvidia/openai/gpt-oss-120b"

analyzer = LLMAnalyzerBase(base_prompt=base_prompt, model=model_name)

# Prepare file cache (typically built by CLI)

file_paths = ["example_skill.py"]
file_cache = {"example_skill.py": open("example_skill.py").read()}

# Generate batches with automatic chunking for large files

batches = analyzer.get_batches(file_paths, file_cache)

# Execute analysis synchronously

results = analyzer.run_batches(batches)
findings = analyzer.collect_findings(results)

# Empty list indicates no genuine issues (precision-over-recall)

print(f"Discovered {len(findings)} findings")

```

For high-throughput scenarios, use the asynchronous execution method:

```python
import asyncio

async def run_async():
    results = await analyzer.arun_batches(batches, max_concurrency=5)
    findings = analyzer.collect_findings(results)
    return findings

asyncio.run(run_async())

```

To handle specialized use cases requiring raw text processing, you can override the response schema while maintaining other protections:

```python
class RawLLMAnalyzer(LLMAnalyzerBase):
    response_schema = None  # Disables structured output

    
    def parse_response(self, response, batch):
        # Process raw string with custom logic

        return [response]

```

## Key Source Files and Their Security Roles

The anti-jailbreak architecture spans multiple modules:

- **[`src/skillspector/llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_analyzer_base.py)** – Contains the core `LLMAnalyzerBase` class implementing batching, chunking, prompt creation via `build_prompt`, and LLM invocation logic with the `BASE_ANALYSIS_PROMPT` hardening template.

- **[`src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py)** – Houses regex patterns that detect jailbreak attempts before LLM execution, including the high-confidence match for "you are now in jailbreak mode" at line 43.

- **[`src/skillspector/constants.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/constants.py)** – Defines model token budgets and configuration constants used by the analyzer's `_input_budget` calculations.

- **[`src/skillspector/llm_utils.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_utils.py)** – Provides `get_chat_model` helper for instantiating underlying OpenAI/Anthropic model interfaces.

- **[`src/skillspector/model_info.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/model_info.py)** – Supplies `get_max_input_tokens` used to enforce token limits and trigger automatic file chunking.

## Summary

- The `LLMAnalyzerBase` class in [`src/skillspector/llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_analyzer_base.py) provides a secure foundation for LLM-based security analysis in SkillSpector.
- **Structured output schemas** (via `LLMAnalysisResult`) eliminate free-form text manipulation by enforcing JSON-compatible responses.
- **Prompt hardening** through `BASE_ANALYSIS_PROMPT` (lines 94-112) instructs models to prefer silence over fabrication, directly countering jailbreak attempts.
- **Token budgeting** and automatic chunking via `chunk_file_by_lines` prevent context truncation that could expose attack vectors.
- **Static pre-filtering** in [`static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_prompt_injection.py) catches obvious jailbreak patterns before they reach the LLM.
- The architecture supports both synchronous (`run_batches`) and asynchronous (`arun_batches`) execution while maintaining consistent security controls.

## Frequently Asked Questions

### What is the LLM analyzer base class in SkillSpector?

The `LLMAnalyzerBase` is an abstract base class defined in [`src/skillspector/llm_analyzer_base.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_analyzer_base.py) that serves as the reusable engine for all LLM-based security analyzers in the NVIDIA SkillSpector repository. It standardizes batch processing, token management, and anti-jailbreak protections across different analysis workflows.

### How does the anti-jailbreak protection work in LLMAnalyzerBase?

The protection operates through four layers: static regex filtering that blocks known jailbreak phrases before LLM invocation; prompt hardening via `BASE_ANALYSIS_PROMPT` that instructs the model to avoid fabrication; structured output constraints using `LLMAnalysisResult` that limit response formats; and token budgeting that prevents context truncation attacks.

### Can I disable the structured output schema for raw LLM responses?

Yes, subclasses can set `response_schema = None` to disable structured output and override `parse_response` to handle raw text. However, this removes a critical anti-jailbreak layer and should only be used when downstream processing requires unstructured data and additional input validation is implemented.

### Where are the static pattern filters defined for jailbreak detection?

Static pattern filters are defined in [`src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py), which includes regex patterns for detecting classic jailbreak indicators. The file specifically contains a high-confidence pattern for the phrase "you are now in jailbreak mode" at line 43, preventing such inputs from reaching the LLM analyzer.