How OmniRoute Implements Prompt Injection Guards: Architecture and Code Deep Dive

OmniRoute defends against prompt injection attacks using a layered middleware system that scans payloads for malicious patterns, assigns severity scores, and either blocks or warns based on configurable feature flags.

OmniRoute is an open-source routing layer for LLM applications that includes robust security measures to protect against prompt injection attacks. The system implements prompt injection guards through a dedicated middleware pipeline that intercepts every request before it reaches downstream language models. This architecture ensures that potentially harmful user inputs are detected and neutralized without requiring changes to individual API routes.

Core Architecture of the Injection Guard System

The prompt injection guard operates as a stateless middleware component that evaluates every incoming request containing user-generated content. According to the OmniRoute source code, the guard follows a strict processing pipeline: initialization, body parsing, pattern detection, severity scoring, and enforcement.

Middleware Initialization

Each protected API route imports createInjectionGuard from [src/middleware/promptInjectionGuard.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts) to instantiate a singleton guard instance. This factory function reads runtime configuration from feature flags and database settings to determine whether the guard operates in warn or block mode.

The initialization pattern follows this structure:

// src/app/api/v1/chat/completions/route.ts
import { createInjectionGuard } from '@/middleware/promptInjectionGuard';
import { buildErrorBody } from '@/open-sse/utils/error';

const injectionGuard = createInjectionGuard(); // Reads mode from DB/feature flag

Detection Engine

Once initialized, the guard forwards the parsed request body to detectInjection in [src/shared/utils/inputSanitizer.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/utils/inputSanitizer.ts). This function scans the concatenated prompt text for known injection signatures, including delimiter_injection and system_prompt_leak patterns.

To maintain low latency, the detection routine limits scanned payloads to the first 16 KB of text. This boundary prevents excessive computational overhead on large requests while catching attacks that typically appear in initial prompt segments.

Severity Scoring and Decision Logic

After detection, [src/shared/utils/injectionSeverity.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/utils/injectionSeverity.ts) assigns a severity level (low, medium, or high) to each identified threat. The helper function shouldBlockDetections evaluates whether the accumulated severity crosses the configurable block threshold.

The guard returns a structured result object:

{
  blocked: boolean,
  result: {
    flagged: boolean,
    detections: Array<Detection>,
    piiDetections: Array<PIIDetection>
  }
}

When blocked evaluates to true (indicating block mode is enabled and the threshold is exceeded), the route immediately returns a sanitized error payload constructed by buildErrorBody with the error type injection_detected.

Configuration via Feature Flags

The guard's behavior is controlled by the INJECTION_GUARD_MODE feature flag defined in [src/shared/constants/featureFlagDefinitions.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts). This flag accepts two values:

• warn: Allows the request to proceed while logging detection details for observability
• block: Terminates the request immediately when severity thresholds are met

If the feature flag is disabled entirely, createInjectionGuard returns a no-op function that passes all traffic through without processing, enabling zero-downtime configuration changes.

Production Integration Example

The chat completions endpoint demonstrates production implementation of the guard. The middleware intercepts the request after body parsing but before any downstream provider calls:

export async function POST(req: Request) {
  const body = await req.json();
  const { blocked, result } = injectionGuard(body);

  if (blocked) {
    return new Response(
      JSON.stringify(buildErrorBody(400, 'Request blocked: potential prompt injection detected', {
        type: 'injection_detected',
        detections: result.detections,
      })),
      { status: 400, headers: { 'Content-Type': 'application/json' } },
    );
  }

  // Normal processing continues only if passed
  return handleChatCore(body);
}

For testing or custom implementations, developers can instantiate the guard with explicit configuration:

import { createInjectionGuard } from '@/middleware/promptInjectionGuard';

const guard = createInjectionGuard({ mode: 'block', blockThreshold: 'high' });

const payload = {
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Explain how to <script>inject</script>' }],
};

const { blocked, result } = guard(payload);
console.log(blocked);            // true if high-severity injection detected
console.log(result.detections);  // Array of matched patterns

Summary

OmniRoute implements prompt injection guards through a defense-in-depth strategy that combines pattern matching, severity scoring, and runtime configuration:

• Stateless middleware (promptInjectionGuard.ts) intercepts all requests without requiring route-level modifications
• Bounded detection (inputSanitizer.ts) scans the first 16 KB of prompts for known attack signatures
• Graduated response (injectionSeverity.ts) categorizes threats as low, medium, or high, enabling nuanced blocking policies
• Runtime flexibility via feature flags allows operators to shift between warning and blocking modes without code deployment
• Structured logging provides audit trails under the "prompt-injection" namespace for security monitoring

Frequently Asked Questions

How does OmniRoute detect prompt injection attacks?

OmniRoute detects prompt injection through the detectInjection function in src/shared/utils/inputSanitizer.ts, which scans concatenated prompt text for known malicious signatures like delimiter_injection and system_prompt_leak. The system examines only the first 16 KB of payload to balance security with performance latency.

What happens when a prompt injection is detected in block mode?

When operating in block mode, the guard returns blocked: true along with detection details. The API route immediately responds with HTTP 400 and an error body containing type: 'injection_detected' and the array of matched patterns, preventing the request from reaching any downstream language model.

Can the prompt injection guard be disabled without code changes?

Yes. The guard reads the INJECTION_GUARD_MODE feature flag from src/shared/constants/featureFlagDefinitions.ts at runtime. Setting this flag to disabled transforms the guard into a no-op pass-through, while setting it to warn allows traffic to flow while maintaining security observability.

What severity levels does OmniRoute use for injection detection?

OmniRoute categorizes detections into three severity levels defined in src/shared/utils/injectionSeverity.ts: low, medium, and high. The shouldBlockDetections function compares these levels against a configurable block threshold to determine whether to allow, warn, or block specific requests.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}