# How OmniRoute Implements Prompt Injection Guards: Architecture and Code Deep Dive

> Discover how OmniRoute implements prompt injection guards with a layered middleware system. Learn about payload scanning, severity scoring, and configurable blocking for enhanced security.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: architecture
- Published: 2026-08-29

---

**OmniRoute defends against prompt injection attacks using a layered middleware system that scans payloads for malicious patterns, assigns severity scores, and either blocks or warns based on configurable feature flags.**

OmniRoute is an open-source routing layer for LLM applications that includes robust security measures to protect against prompt injection attacks. The system implements **prompt injection guards** through a dedicated middleware pipeline that intercepts every request before it reaches downstream language models. This architecture ensures that potentially harmful user inputs are detected and neutralized without requiring changes to individual API routes.

## Core Architecture of the Injection Guard System

The **prompt injection guard** operates as a stateless middleware component that evaluates every incoming request containing user-generated content. According to the OmniRoute source code, the guard follows a strict processing pipeline: initialization, body parsing, pattern detection, severity scoring, and enforcement.

### Middleware Initialization

Each protected API route imports `createInjectionGuard` from [[`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts) to instantiate a singleton guard instance. This factory function reads runtime configuration from feature flags and database settings to determine whether the guard operates in `warn` or `block` mode.

The initialization pattern follows this structure:

```typescript
// src/app/api/v1/chat/completions/route.ts
import { createInjectionGuard } from '@/middleware/promptInjectionGuard';
import { buildErrorBody } from '@/open-sse/utils/error';

const injectionGuard = createInjectionGuard(); // Reads mode from DB/feature flag

```

### Detection Engine

Once initialized, the guard forwards the parsed request body to `detectInjection` in [[`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/utils/inputSanitizer.ts). This function scans the concatenated prompt text for known injection signatures, including `delimiter_injection` and `system_prompt_leak` patterns.

To maintain low latency, the **detection routine limits scanned payloads to the first 16 KB** of text. This boundary prevents excessive computational overhead on large requests while catching attacks that typically appear in initial prompt segments.

## Severity Scoring and Decision Logic

After detection, [[`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/utils/injectionSeverity.ts) assigns a severity level (`low`, `medium`, or `high`) to each identified threat. The helper function `shouldBlockDetections` evaluates whether the accumulated severity crosses the configurable **block threshold**.

The guard returns a structured result object:

```typescript
{
  blocked: boolean,
  result: {
    flagged: boolean,
    detections: Array<Detection>,
    piiDetections: Array<PIIDetection>
  }
}

```

When `blocked` evaluates to `true` (indicating block mode is enabled and the threshold is exceeded), the route immediately returns a sanitized error payload constructed by `buildErrorBody` with the error type `injection_detected`.

## Configuration via Feature Flags

The guard's behavior is controlled by the `INJECTION_GUARD_MODE` feature flag defined in [[`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts). This flag accepts two values:

- **`warn`**: Allows the request to proceed while logging detection details for observability
- **`block`**: Terminates the request immediately when severity thresholds are met

If the feature flag is disabled entirely, `createInjectionGuard` returns a no-op function that passes all traffic through without processing, enabling zero-downtime configuration changes.

## Production Integration Example

The chat completions endpoint demonstrates production implementation of the guard. The middleware intercepts the request after body parsing but before any downstream provider calls:

```typescript
export async function POST(req: Request) {
  const body = await req.json();
  const { blocked, result } = injectionGuard(body);

  if (blocked) {
    return new Response(
      JSON.stringify(buildErrorBody(400, 'Request blocked: potential prompt injection detected', {
        type: 'injection_detected',
        detections: result.detections,
      })),
      { status: 400, headers: { 'Content-Type': 'application/json' } },
    );
  }

  // Normal processing continues only if passed
  return handleChatCore(body);
}

```

For testing or custom implementations, developers can instantiate the guard with explicit configuration:

```typescript
import { createInjectionGuard } from '@/middleware/promptInjectionGuard';

const guard = createInjectionGuard({ mode: 'block', blockThreshold: 'high' });

const payload = {
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Explain how to <script>inject</script>' }],
};

const { blocked, result } = guard(payload);
console.log(blocked);            // true if high-severity injection detected
console.log(result.detections);  // Array of matched patterns

```

## Summary

OmniRoute implements **prompt injection guards** through a defense-in-depth strategy that combines pattern matching, severity scoring, and runtime configuration:

- **Stateless middleware** ([`promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/promptInjectionGuard.ts)) intercepts all requests without requiring route-level modifications
- **Bounded detection** ([`inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/inputSanitizer.ts)) scans the first 16 KB of prompts for known attack signatures
- **Graduated response** ([`injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/injectionSeverity.ts)) categorizes threats as low, medium, or high, enabling nuanced blocking policies
- **Runtime flexibility** via feature flags allows operators to shift between warning and blocking modes without code deployment
- **Structured logging** provides audit trails under the `"prompt-injection"` namespace for security monitoring

## Frequently Asked Questions

### How does OmniRoute detect prompt injection attacks?

OmniRoute detects prompt injection through the `detectInjection` function in [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts), which scans concatenated prompt text for known malicious signatures like `delimiter_injection` and `system_prompt_leak`. The system examines only the first 16 KB of payload to balance security with performance latency.

### What happens when a prompt injection is detected in block mode?

When operating in `block` mode, the guard returns `blocked: true` along with detection details. The API route immediately responds with HTTP 400 and an error body containing `type: 'injection_detected'` and the array of matched patterns, preventing the request from reaching any downstream language model.

### Can the prompt injection guard be disabled without code changes?

Yes. The guard reads the `INJECTION_GUARD_MODE` feature flag from [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts) at runtime. Setting this flag to disabled transforms the guard into a no-op pass-through, while setting it to `warn` allows traffic to flow while maintaining security observability.

### What severity levels does OmniRoute use for injection detection?

OmniRoute categorizes detections into three severity levels defined in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts): **low**, **medium**, and **high**. The `shouldBlockDetections` function compares these levels against a configurable block threshold to determine whether to allow, warn, or block specific requests.