# How OmniRoute Guards Against Prompt Injection: Architecture and Configuration

> Discover how OmniRoute's two-layer guardrail system prevents prompt injection. Learn about its architecture and configuration for robust LLM security.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: architecture
- Published: 2026-08-23

---

**OmniRoute employs a configurable two-layer guardrail system that scans the first 16KB of concatenated prompts using heuristic regex patterns to detect and block, warn, or log potential injection attempts before they reach upstream LLM providers.**

Prompt injection attacks represent a critical security vector for LLM applications, attempting to override system instructions through malicious user input. The open-source **OmniRoute** repository (`diegosouzapw/OmniRoute`) implements a **fail-closed, tunable defense mechanism** that inspects every request before it reaches the provider. This article examines the technical implementation of how OmniRoute guards against prompt injection through its middleware architecture, severity classification system, and runtime configuration options.

## Two-Layer Guardrail Architecture

OmniRoute’s injection protection operates as a **request-side input sanitizer** that intercepts traffic before upstream transmission.

### The Middleware Scanner

Located in [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts), the guardrail concatenates all user messages and system prompts, then applies heuristic regular-expression checks against the combined payload. The middleware supports four operational modes determined by the `INJECTION_GUARD_MODE` feature flag:

- **block**: Returns HTTP 400 with rejection message
- **warn**: Logs detection without blocking
- **off**: Passes all traffic without scanning
- **redact**: Records event only (legacy mode, does not modify payload)

### Severity Classification

The detection logic resides in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts), which categorizes pattern matches into three tiers: *low*, *medium*, or *high* severity. The `INPUT_SANITIZER_BLOCK_THRESHOLD` environment variable determines which severity level triggers enforcement actions, allowing operators to tune sensitivity based on their risk tolerance.

## Runtime Configuration and Feature Flags

OmniRoute supports dynamic reconfiguration without redeployment through its feature-flag system documented in [`docs/reference/FEATURE_FLAGS.md`](https://github.com/diegosouzapw/OmniRoute/blob/main/docs/reference/FEATURE_FLAGS.md).

Operators control the guardrail through three environment variables:

```bash
export INPUT_SANITIZER_ENABLED=true
export INPUT_SANITIZER_MODE=block        # options: off, warn, block, redact

export INPUT_SANITIZER_BLOCK_THRESHOLD=high   # low | medium | high

```

These settings can be overridden at runtime via database-persisted flags, enabling immediate response to emerging attack patterns without service interruption.

## Performance Safeguards

To prevent resource exhaustion attacks, the scanner implements a hard ceiling on inspection scope. The `MAX_INJECTION_SCAN_BYTES` constant limits analysis to the **first 16KB** of the concatenated prompt. This boundary ensures CPU-intensive scanning cannot be exploited through oversized payloads while maintaining effectiveness against injection attempts that typically appear early in prompt structures.

## Per-Request Opt-Out Mechanism

Certain use cases—such as advanced RAG pipelines—may intentionally contain injection-like patterns. For these scenarios, OmniRoute allows callers to bypass the guardrail for individual requests by including the header:

```http
x-omniroute-disabled-guardrails: true

```

This header instructs [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts) to skip detection for that specific transaction, providing flexibility without compromising global security posture.

## Integration with Downstream Guardrails

The prompt injection guard executes **before** other security layers, specifically preceding the PII-masking guard in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) and the vision-bridge guard. This ordering guarantees that malicious system-prompt injections are intercepted prior to any downstream processing or data transformation, ensuring that sensitive information masking occurs only on sanitized content.

When detection triggers in `block` mode, the middleware returns:

```json
{
  "error": {
    "code": 400,
    "message": "Prompt injection detected – request rejected"
  }
}

```

## Summary

- OmniRoute implements a **two-layer defense** through middleware scanning and severity classification.
- The system caps inspection at **16KB** (`MAX_INJECTION_SCAN_BYTES`) to prevent DoS attacks.
- Four operational modes (**block**, **warn**, **off**, **redact**) provide configurable response strategies.
- Runtime configuration via **environment variables** and database flags enables dynamic adjustment without redeployment.
- Per-request bypass via **`x-omniroute-disabled-guardrails: true`** header supports legitimate edge cases.
- Execution occurs **before** PII masking and other guardrails, ensuring early threat detection.

## Frequently Asked Questions

### What triggers the prompt injection detection in OmniRoute?

The system concatenates all user messages and system prompts, then applies heuristic regular-expression patterns defined in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts). Matches are classified as low, medium, or high severity based on the pattern characteristics and context within the first 16KB of the payload.

### Can I disable the injection guard for specific requests?

Yes. Send the HTTP header `x-omniroute-disabled-guardrails: true` with your request. This instructs the middleware in [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts) to skip scanning for that transaction, which is useful for RAG implementations or testing scenarios where injection-like patterns are intentional.

### How does OmniRoute handle large prompts that might impact scanning performance?

The guardrail implements a safeguard through `MAX_INJECTION_SCAN_BYTES`, limiting analysis to the first 16KB of the concatenated prompt. This prevents CPU exhaustion from oversized payloads while capturing the majority of real-world injection attempts that appear near the beginning of prompts.

### What is the difference between "warn" and "redact" modes in the injection guard?

In **warn** mode, the system logs the detection event but allows the request to proceed to the LLM provider. In **redact** mode (legacy), the system records the event without modifying the payload or blocking the request, functioning purely as an audit mechanism without active intervention.