How the LLM Analyzer Base Class Implements Anti-Jailbreak Protections in NVIDIA SkillSpector

The LLMAnalyzerBase class in NVIDIA's SkillSpector repository enforces anti-jailbreak protections through structured output schemas, hardened prompt templates, token budgeting with context chunking, and static pattern pre-filtering to prevent malicious manipulation of LLM security analyses.

The LLMAnalyzerBase class serves as the foundational engine for all LLM-based security analyzers in the NVIDIA SkillSpector project. Located in src/skillspector/llm_analyzer_base.py, this abstract base class implements a defense-in-depth strategy that protects against prompt injection and jailbreak attempts while ensuring reliable code analysis. Understanding how this LLM analyzer base class balances flexibility with rigorous security controls is essential for developers extending SkillSpector's capabilities.

Core Defense Mechanisms in LLMAnalyzerBase

Structured Output Schema Enforcement

By default, the analyzer constrains LLM responses using the Pydantic model LLMAnalysisResult, defined in the same llm_analyzer_base.py file. This structured output schema forces the model to return JSON-compatible data rather than free-form text, eliminating vectors for hidden instructions or manipulative formatting. Subclasses can override this behavior by setting response_schema = None, but the default safe mode remains the recommended configuration for production security scanning.

Prompt Hardening with BASE_ANALYSIS_PROMPT

The class automatically wraps user-provided prompts with the BASE_ANALYSIS_PROMPT constant (lines 94-112 in llm_analyzer_base.py). This hardened template appends explicit instructions including "Do not manufacture findings" and "Precision-over-recall: an empty findings list is expected when no genuine issues exist." These directives steer the model toward silence over fabrication, a primary anti-jailbreak defense that prevents hallucinated vulnerabilities when the model encounters ambiguous or potentially adversarial inputs.

Token Budgeting and Context Chunking

Before invoking the LLM, the analyzer calculates an _input_budget based on the selected model's maximum input tokens via model_info.get_max_input_tokens. If a source file exceeds this budget, the chunk_file_by_lines method splits the content into overlapping segments. This token budgeting guarantees complete context delivery, preventing truncation attacks where incomplete prompts could be exploited to leak system instructions or bypass safety filters.

Static Pattern Pre-Filtering

SkillSpector implements a lightweight static scanner that intercepts classic jailbreak phrases before they reach the LLM. Located in src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py, this module includes a high-confidence regex detecting the phrase "you are now in jailbreak mode" (line 43). By catching such patterns early, the system prevents malicious skills from ever triggering the LLM analyzer, adding a critical outer layer to the defense architecture.

Conservative Logging for Audit Trails

All LLM invocations are logged at the DEBUG level, capturing token estimates and the count of previously discovered findings. This conservative logging creates an immutable audit trail that security teams can analyze to detect abnormal usage patterns indicative of brute-force jailbreak attempts or prompt probing.

Implementing Secure Analyzers with LLMAnalyzerBase

The following example demonstrates basic usage of the LLMAnalyzerBase class with its default anti-jailbreak protections enabled:

from skillspector.llm_analyzer_base import LLMAnalyzerBase
from skillspector.llm_utils import get_chat_model

# Initialize analyzer with hardened prompt

base_prompt = "You are a security analyst. Identify any risky code patterns."
model_name = "nvidia/openai/gpt-oss-120b"

analyzer = LLMAnalyzerBase(base_prompt=base_prompt, model=model_name)

# Prepare file cache (typically built by CLI)

file_paths = ["example_skill.py"]
file_cache = {"example_skill.py": open("example_skill.py").read()}

# Generate batches with automatic chunking for large files

batches = analyzer.get_batches(file_paths, file_cache)

# Execute analysis synchronously

results = analyzer.run_batches(batches)
findings = analyzer.collect_findings(results)

# Empty list indicates no genuine issues (precision-over-recall)

print(f"Discovered {len(findings)} findings")

For high-throughput scenarios, use the asynchronous execution method:

import asyncio

async def run_async():
    results = await analyzer.arun_batches(batches, max_concurrency=5)
    findings = analyzer.collect_findings(results)
    return findings

asyncio.run(run_async())

To handle specialized use cases requiring raw text processing, you can override the response schema while maintaining other protections:

class RawLLMAnalyzer(LLMAnalyzerBase):
    response_schema = None  # Disables structured output

    
    def parse_response(self, response, batch):
        # Process raw string with custom logic

        return [response]

Key Source Files and Their Security Roles

The anti-jailbreak architecture spans multiple modules:

• src/skillspector/llm_analyzer_base.py – Contains the core LLMAnalyzerBase class implementing batching, chunking, prompt creation via build_prompt, and LLM invocation logic with the BASE_ANALYSIS_PROMPT hardening template.

• src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py – Houses regex patterns that detect jailbreak attempts before LLM execution, including the high-confidence match for "you are now in jailbreak mode" at line 43.

• src/skillspector/constants.py – Defines model token budgets and configuration constants used by the analyzer's _input_budget calculations.

• src/skillspector/llm_utils.py – Provides get_chat_model helper for instantiating underlying OpenAI/Anthropic model interfaces.

• src/skillspector/model_info.py – Supplies get_max_input_tokens used to enforce token limits and trigger automatic file chunking.

Summary

• The LLMAnalyzerBase class in src/skillspector/llm_analyzer_base.py provides a secure foundation for LLM-based security analysis in SkillSpector.
• Structured output schemas (via LLMAnalysisResult) eliminate free-form text manipulation by enforcing JSON-compatible responses.
• Prompt hardening through BASE_ANALYSIS_PROMPT (lines 94-112) instructs models to prefer silence over fabrication, directly countering jailbreak attempts.
• Token budgeting and automatic chunking via chunk_file_by_lines prevent context truncation that could expose attack vectors.
• Static pre-filtering in static_patterns_prompt_injection.py catches obvious jailbreak patterns before they reach the LLM.
• The architecture supports both synchronous (run_batches) and asynchronous (arun_batches) execution while maintaining consistent security controls.

Frequently Asked Questions

What is the LLM analyzer base class in SkillSpector?

The LLMAnalyzerBase is an abstract base class defined in src/skillspector/llm_analyzer_base.py that serves as the reusable engine for all LLM-based security analyzers in the NVIDIA SkillSpector repository. It standardizes batch processing, token management, and anti-jailbreak protections across different analysis workflows.

How does the anti-jailbreak protection work in LLMAnalyzerBase?

The protection operates through four layers: static regex filtering that blocks known jailbreak phrases before LLM invocation; prompt hardening via BASE_ANALYSIS_PROMPT that instructs the model to avoid fabrication; structured output constraints using LLMAnalysisResult that limit response formats; and token budgeting that prevents context truncation attacks.

Can I disable the structured output schema for raw LLM responses?

Yes, subclasses can set response_schema = None to disable structured output and override parse_response to handle raw text. However, this removes a critical anti-jailbreak layer and should only be used when downstream processing requires unstructured data and additional input validation is implemented.

Where are the static pattern filters defined for jailbreak detection?

Static pattern filters are defined in src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py, which includes regex patterns for detecting classic jailbreak indicators. The file specifically contains a high-confidence pattern for the phrase "you are now in jailbreak mode" at line 43, preventing such inputs from reaching the LLM analyzer.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}