The prompt-injection classifier

A model, rather than a pattern, judging whether a request is being manipulated.
How it runs
The classifier runs in parallel with the upstream call, so it does not add latency to
your developers' requests. In Activity you can see how long it took — the millisecond
badge in the Signals column — and the score it produced.
The sensitivity dial
Policy → AI risk classifier sensitivity, three positions:
Low — only the clearest cases.
Medium (recommended) — the default balance.
High — aggressive. At this setting a high-severity verdict can block the next turn
of the conversation.
The dial governs this classifier. It does not govern secret scanning: detected secrets
are handled by that detector's own action regardless of where the dial sits.
Block-next-turn
When the classifier returns a high-severity verdict under High sensitivity, the
conversation is stopped rather than the individual request — the next turn is refused.
This is the right granularity for injection, where the problem is the conversation's
context rather than one message.
Blocked conversations are listed at the bottom of the Policy screen with the developer,
tool, reason and severity, each with an Unblock button. They also clear by themselves
when they age out of your retention window.
The paid classifier tier
A second, larger classifier hosted in the EU covers a wider risk taxonomy. It is a
disclosed sub-processor — if your DPA review needs the details, ask us and we will send
the current list.