# How OmniRoute Handles Prompt Injection Guardrails: A Layered Defense Architecture

> OmniRoute defends LLM endpoints against prompt injection with a configurable, multi-layer guardrail system integrated into its request pipeline. Learn how this layered defense architecture works.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: architecture
- Published: 2026-08-10

---

**OmniRoute protects its LLM endpoints against prompt injection attacks using a configurable, multi-layer guardrail system built directly into the request-handling pipeline.**

This open-source routing layer for LLM providers implements defense-in-depth against prompt injection through pattern-based detection, configurable thresholds, and middleware enforcement. According to the OmniRoute source code, the guardrail system is designed as a best-effort mechanism that balances security with legitimate traffic flow.

## Guardrail Architecture Overview

The prompt injection defense consists of five integrated layers, each implemented in specific source files across the codebase.

### Feature-Flag Control

Deployments toggle guard behavior via the `INJECTION_GUARD_MODE` flag defined in [`src/shared/constants/featureFlagDefinitions.ts#L41`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/shared/constants/featureFlagDefinitions.ts#L41). Valid values are:

- `off` — disables detection entirely
- `low` — permissive threshold, minimal pattern matches required
- `medium` — balanced detection sensitivity
- `high` — strict threshold, maximum pattern matches required

This flag enables gradual rollouts and environment-specific configurations without code changes.

### Pattern Detection Engine

The core detection logic lives in [`src/lib/guardrails/promptInjection.ts#L31`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/lib/guardrails/promptInjection.ts#L31). The `DEFAULT_GUARD_PATTERNS` array contains regular-expression signatures targeting common injection constructs:

- Phrases like "system-prompt" or "ignore above instructions"
- Delimiter manipulation attempts
- Instruction override patterns

Patterns are normalized with global and case-insensitive flags via `normalizePatternEntry()`, then compiled for efficient reuse.

### Threshold Evaluation and Modes

Detection results are evaluated against the configured threshold in [`src/lib/guardrails/promptInjection.ts#L109`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/lib/guardrails/promptInjection.ts#L109). The system supports two operational modes:

- **Block mode** — requests exceeding threshold receive HTTP 400 with sanitized error body
- **Log-only mode** — detections are recorded but request proceeds normally

Mode selection derives from the feature flag, allowing passive monitoring before active enforcement.

### Middleware Integration

The [`src/middleware/promptInjectionGuard.ts#L24`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/middleware/promptInjectionGuard.ts#L24) file implements Express-style middleware that wraps the evaluation logic. When triggered, `buildErrorBody(400, "Request blocked: …")` returns a generic response that leaks no internal pattern details to potential attackers.

### Route-Level Deployment

Every LLM endpoint imports this middleware, as shown in [`src/app/api/v1/chat/completions/route.ts#L176`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/app/api/v1/chat/completions/route.ts#L176). Coverage extends to:

- `/v1/chat/completions`
- `/v1/completions`
- Image generation and editing endpoints

This guarantees consistent protection across the entire API surface without per-route reimplementation.

## Detection Pipeline: How Evaluation Works

The prompt injection guard follows a four-stage pipeline for each request:

1. **Normalization** — `normalizePatternEntry()` converts string or RegExp patterns into compiled, case-insensitive global expressions.

2. **Scanning** — `detectWithPatterns(text, patterns)` executes all compiled patterns against the request payload, aggregating matches into a detection array.

3. **Threshold evaluation** — `shouldBlock(detections, threshold)` compares match count against the `low`/`medium`/`high` threshold derived from the feature flag.

4. **Decision** — `evaluatePromptInjection(options, context, text)` synthesizes mode, threshold, and enabled status into a `PromptInjectionGuardrailDecision` object with `allow` or `block` outcome.

### Observability and Logging

When detection triggers, [`src/lib/guardrails/promptInjection.ts#L221`](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/lib/guardrails/promptInjection.ts#L221) emits structured logs at `warn` level containing:

- Request ID for correlation
- Matched pattern identifiers
- Applied operational mode

This supports incident response and false-positive analysis without exposing detection internals.

## Request Flow Diagram

```

Incoming HTTP request
        ↓
Next.js API route (e.g., src/app/api/v1/chat/completions/route.ts)
        ↓
promptInjectionGuard middleware 
        │
        ├─ evaluatePromptInjection(...)
        ├─ if block → buildErrorBody(400, "Request blocked: …")
        └─ else → continue to handler
        ↓
Handler executes provider request (open-sse/... executors)

```

All production routes follow this pattern, establishing uniform enforcement.

## Implementation Examples

### Manual Guard Evaluation

Use the core function directly for custom processing pipelines:

```typescript
import { evaluatePromptInjection } from "@/lib/guardrails/promptInjection";
import { getFeatureFlag } from "@/lib/db/featureFlags";

async function checkPromptInjection(reqBody: string) {
  const options = {
    mode: await getFeatureFlag("INJECTION_GUARD_MODE"),
    // guard uses DEFAULT_GUARD_PATTERNS internally
  };
  const decision = await evaluatePromptInjection(
    options,
    { requestId: "abc123" },
    reqBody
  );
  if (decision.block) {
    throw new Error("Prompt injection detected");
  }
  return decision;
}

```

### Middleware Integration in New Routes

Add protection to custom endpoints with minimal boilerplate:

```typescript
import { promptInjectionGuard } from "@/middleware/promptInjectionGuard";
import { handler } from "@/open-sse/handlers/chatCore";

export async function POST(req: Request) {
  // Guard runs first; throws 400 if injection detected
  await promptInjectionGuard(req);
  // Normal processing continues
  return handler(req);
}

```

## Key Source Files

| File | Purpose |
|------|---------|
| [[`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/lib/guardrails/promptInjection.ts) | Core detection, threshold logic, logging |
| [[`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/middleware/promptInjectionGuard.ts) | HTTP middleware wrapper |
| [[`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/shared/constants/featureFlagDefinitions.ts) | `INJECTION_GUARD_MODE` flag definition |
| [[`src/app/api/v1/chat/completions/route.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/app/api/v1/chat/completions/route.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/src/app/api/v1/chat/completions/route.ts) | Production route integration example |
| [[`tests/unit/guardrails-registry.test.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/tests/unit/guardrails-registry.test.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.50/tests/unit/guardrails-registry.test.ts) | Validation test suite |

## Limitations and Design Rationale

The guardrail system is explicitly **best-effort**. It targets known injection signatures rather than attempting complete adversarial robustness. This trade-off acknowledges:

- The computational cost of deep semantic analysis
- The evolving nature of prompt injection techniques
- The need to preserve latency for legitimate requests

The test suite in [`guardrails-registry.test.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/guardrails-registry.test.ts) verifies that "suspicious content in block mode" is rejected while normal traffic flows unimpeded.

## Summary

- **OmniRoute implements prompt injection guardrails through a layered architecture** combining feature flags, regex pattern detection, configurable thresholds, and middleware enforcement.

- **Detection occurs in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts)** using normalized patterns against request payloads, with decisions rendered by `evaluatePromptInjection()`.

- **Enforcement is universal** via `promptInjectionGuard` middleware applied to all LLM endpoints including chat completions and image routes.

- **Operational flexibility** allows `low`/`medium`/`high` sensitivity levels and `block`/`log-only` modes without deployment changes.

- **Observability is built-in** through structured logging of detections with request IDs for downstream analysis.

## Frequently Asked Questions

### How do I disable prompt injection detection in OmniRoute?

Set the `INJECTION_GUARD_MODE` feature flag to `off` in your deployment configuration. This flag is defined in [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts) and read at request time via `getFeatureFlag()`. The change takes effect immediately without restarting services.

### What patterns does OmniRoute use to detect prompt injection?

The system uses the `DEFAULT_GUARD_PATTERNS` array in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts), which includes signatures for common attack vectors like "ignore previous instructions" and "system prompt override" phrases. These are regular expressions normalized for case-insensitive matching.

### Can I add custom detection patterns to the guardrail?

The source-defined `DEFAULT_GUARD_PATTERNS` is currently fixed, but you can extend detection by wrapping `evaluatePromptInjection()` with additional pattern matching before or after the built-in evaluation. Custom implementations should follow the same normalization pattern using `normalizePatternEntry()`.

### Does prompt injection detection impact API latency?

The regex-based scanning adds minimal overhead for typical request sizes. Pattern compilation occurs at initialization, not per-request. For latency-sensitive deployments, `log-only` mode permits detection without blocking delays, or the guard can be disabled entirely via feature flag.