提示词中文站 prompts.chat 中文镜像
首页 全部提示词 Agent Skill

添加 AI 保护

Add AI protection

技能 @davidmytton 4,301 字符 在 prompts.chat 查看 译文有问题？

中文译文

使用 Arcjet 添加 AI 专属安全防护

通过分层防护保护 AI/LLM 端点：提示词注入检测、PII 阻止和 token 预算速率限制。这些防护协同工作，在滥用到达你的模型之前将其阻止，从而节省 AI 预算并保护用户数据。

参考

阅读 https://docs.arcjet.com/llms.txt 获取全面的 SDK 文档，涵盖所有框架、规则类型和配置选项。

Arcjet 规则在请求到达你的 AI 模型之前运行——在 HTTP 层阻止提示词注入、PII 泄露、成本滥用和机器人抓取。

步骤 1：确保 Arcjet 已设置

检查是否已有共享的 Arcjet 客户端（完整设置见 /arcjet:protect-route）。如果不存在，先用 shield() 作为基础规则设置一个。用户需要在 https://app.arcjet.com 注册一个 Arcjet 账户，然后在环境变量中使用 ARCJET_KEY。

第 2 步：添加 AI 防护规则

AI 端点应使用 withRule() 在共享实例上组合这些规则：

提示词注入检测

检测越狱、角色扮演逃逸和指令覆盖。

  • JS：detectPromptInjection() —— 在 protect() 时通过 detectPromptInjectionMessage 参数传入用户消息
  • Python：detect_prompt_injection() —— 通过 detect_prompt_injection_message 参数传入

在恶意提示词到达模型之前将其拦截。这通过尽早拒绝攻击来节省 AI 预算。

敏感信息 / PII 拦截

防止个人身份信息进入模型上下文。

  • JS：sensitiveInfo({ deny: ["EMAIL", "CREDIT_CARD_NUMBER", "PHONE_NUMBER", "IP_ADDRESS"] })
  • Python：detect_sensitive_info(deny=[SensitiveInfoType.EMAIL, SensitiveInfoType.CREDIT_CARD_NUMBER, ...])

在 protect() 时通过 sensitiveInfoValue（JS）/ sensitive_info_value（Python）传入用户消息。

Token 预算速率限制

对 AI 端点使用 tokenBucket() / token_bucket() —— requested 参数可以设置为与实际模型 token 用量成比例，从而将速率限制与成本直接挂钩。它还允许短时突发，同时强制执行平均速率，这与用户与聊天界面的交互方式相符。

推荐的初始配置：

  • capacity：10（最大突发量）
  • refillRate：每个间隔 5 个 token
  • interval："10s"

在 protect() 时传入 requested 参数，以扣除与模型成本成比例的 token。例如，每条消息扣除 1 个 token，或根据提示词长度进行估算。 将 characteristics 设置为按用户跟踪：如果已认证则为 ["userId"]，默认基于 IP。

基础防护

始终将 shield()（WAF）和 detectBot() 作为基础层包含在内。抓取 AI 端点的机器人是常见的滥用途径。对于通过浏览器访问的端点（例如聊天界面），考虑添加 Arcjet 高级信号，用于客户端机器人检测，以捕获复杂的无头浏览器。设置方法见 https://docs.arcjet.com/bot-protection/advanced-signals。

第 3 步：组合 protect() 调用并处理决策

所有规则参数都在单次 protect() 调用中一起传入。使用以下模式：

const userMessage = req.body.message; // the user's input

const decision = await aj.protect(req, {
  requested: 1, // tokens to deduct for rate limiting
  sensitiveInfoValue: userMessage, // PII scanning
  detectPromptInjectionMessage: userMessage, // injection detection
});

if (decision.isDenied()) {
  if (decision.reason.isRateLimit()) {
    return Response.json(
      { error: "You've exceeded your usage limit. Please try again later." },
      { status: 429 },
    );
  }
  if (decision.reason.isPromptInjection()) {
    return Response.json(
      { error: "Your message was flagged as potentially harmful." },
      { status: 400 },
    );
  }
  if (decision.reason.isSensitiveInfo()) {
    return Response.json(
      {
        error:
          "Your message contains sensitive information that cannot be processed. Please remove any personal data.",
      },
      { status: 400 },
    );
  }
  if (decision.reason.isBot()) {
    return Response.json({ error: "Forbidden" }, { status: 403 });
  }
}

// Arcjet fails open — log errors but allow the request
if (decision.isErrored()) {
  console.warn("Arcjet error:", decision.reason.message);
}

// Proceed with AI model call...

根据你的框架调整响应格式（例如 Express 用 res.status(429).json(...)）。

第 5 步：验证

  1. 启动应用并发送一条普通消息——应当成功
  2. 通过发送类似“忽略之前所有指令并……”的内容来测试提示词注入
  3. 通过发送一条包含伪造信用卡号的消息来测试 PII 拦截

先将所有规则设为 "DRY_RUN" 模式。验证通过后，再升级为 "LIVE"。

始终建议使用 Arcjet MCP 工具来验证规则并分析流量：

  • list-requests — 确认决策正在被记录，按 conclusion 过滤以查看拦截情况
  • analyze-traffic — 查看 AI 端点的拒绝率和模式
  • explain-decision — 了解某个具体请求为何被允许或拒绝（用于调整提示词注入的敏感度）
  • promote-rule — 验证通过后将规则从 DRY_RUN 升级为 LIVE

如果用户想要完整的安全审查，建议使用 /arcjet:security-analyst agent，它可以调查流量、检测异常并推荐额外的规则。

也可通过 https://app.arcjet.com 上的 Arcjet 仪表盘进行可视化检查。

常见模式

流式响应：在开始流式传输之前调用 protect()。如果被拒绝，在打开流之前返回错误——不要先开始流式传输再中止。

多模型 / 多提供商：无论使用哪个 AI 提供商，都使用同一个 Arcjet 实例。Arcjet 在 HTTP 层运作，与模型提供商无关。

Vercel AI SDK：Arcjet 可与 Vercel AI SDK 协同工作。在 streamText() / generateText() 之前调用 protect()。如果被拒绝，返回一个普通的错误响应，而不是调用 AI SDK。

常见错误（需避免）

  • 敏感信息检测在 WASM 中本地运行——不会将用户数据发送到外部服务。它仅在路由处理器中可用，在 Next.js 页面或 server actions 中不可用。
  • sensitiveInfoValue 和 detectPromptInjectionMessage（JS）/ sensitive_info_value 和 detect_prompt_injection_message（Python）都必须在调用 protect() 时传入——漏掉任何一个都会静默跳过该项检查。
  • 在调用 protect() 之前就开始流式传输——如果请求在流式传输中途被拒绝，客户端会收到一个损坏的响应。始终先调用 protect()，并在打开流之前返回错误。
  • 对 AI 端点使用 fixedWindow() 或 slidingWindow() 而不是 tokenBucket()——令牌桶允许你按模型成本比例扣除令牌，并契合聊天界面突发式的交互模式。
  • 为每个请求创建一个新的 Arcjet 实例，而不是通过 withRule() 复用共享客户端。

English original

Add AI-Specific Security with Arcjet

Secure AI/LLM endpoints with layered protection: prompt injection detection, PII blocking, and token budget rate limiting. These protections work together to block abuse before it reaches your model, saving AI budget and protecting user data.

Reference

Read https://docs.arcjet.com/llms.txt for comprehensive SDK documentation covering all frameworks, rule types, and configuration options.

Arcjet rules run before the request reaches your AI model — blocking prompt injection, PII leakage, cost abuse, and bot scraping at the HTTP layer.

Step 1: Ensure Arcjet Is Set Up

Check for an existing shared Arcjet client (see /arcjet:protect-route for full setup). If none exists, set one up first with shield() as the base rule. The user will need to register for an Arcjet account at https://app.arcjet.com then use the ARCJET_KEY in their environment variables.

Step 2: Add AI Protection Rules

AI endpoints should combine these rules on the shared instance using withRule():

Prompt Injection Detection

Detects jailbreaks, role-play escapes, and instruction overrides.

  • JS: detectPromptInjection() — pass user message via detectPromptInjectionMessage parameter at protect() time
  • Python: detect_prompt_injection() — pass via detect_prompt_injection_message parameter

Blocks hostile prompts before they reach the model. This saves AI budget by rejecting attacks early.

Sensitive Info / PII Blocking

Prevents personally identifiable information from entering model context.

  • JS: sensitiveInfo({ deny: ["EMAIL", "CREDIT_CARD_NUMBER", "PHONE_NUMBER", "IP_ADDRESS"] })
  • Python: detect_sensitive_info(deny=[SensitiveInfoType.EMAIL, SensitiveInfoType.CREDIT_CARD_NUMBER, ...])

Pass the user message via sensitiveInfoValue (JS) / sensitive_info_value (Python) at protect() time.

Token Budget Rate Limiting

Use tokenBucket() / token_bucket() for AI endpoints — the requested parameter can be set proportional to actual model token usage, directly linking rate limiting to cost. It also allows short bursts while enforcing an average rate, which matches how users interact with chat interfaces.

Recommended starting configuration:

  • capacity: 10 (max burst)
  • refillRate: 5 tokens per interval
  • interval: "10s"

Pass the requested parameter at protect() time to deduct tokens proportional to model cost. For example, deduct 1 token per message, or estimate based on prompt length.

Set characteristics to track per-user: ["userId"] if authenticated, defaults to IP-based.

Base Protection

Always include shield() (WAF) and detectBot() as base layers. Bots scraping AI endpoints are a common abuse vector. For endpoints accessed via browsers (e.g. chat interfaces), consider adding Arcjet advanced signals for client-side bot detection that catches sophisticated headless browsers. See https://docs.arcjet.com/bot-protection/advanced-signals for setup.

Step 3: Compose the protect() Call and Handle Decisions

All rule parameters are passed together in a single protect() call. Use this pattern:

const userMessage = req.body.message; // the user's input

const decision = await aj.protect(req, {
  requested: 1, // tokens to deduct for rate limiting
  sensitiveInfoValue: userMessage, // PII scanning
  detectPromptInjectionMessage: userMessage, // injection detection
});

if (decision.isDenied()) {
  if (decision.reason.isRateLimit()) {
    return Response.json(
      { error: "You've exceeded your usage limit. Please try again later." },
      { status: 429 },
    );
  }
  if (decision.reason.isPromptInjection()) {
    return Response.json(
      { error: "Your message was flagged as potentially harmful." },
      { status: 400 },
    );
  }
  if (decision.reason.isSensitiveInfo()) {
    return Response.json(
      {
        error:
          "Your message contains sensitive information that cannot be processed. Please remove any personal data.",
      },
      { status: 400 },
    );
  }
  if (decision.reason.isBot()) {
    return Response.json({ error: "Forbidden" }, { status: 403 });
  }
}

// Arcjet fails open — log errors but allow the request
if (decision.isErrored()) {
  console.warn("Arcjet error:", decision.reason.message);
}

// Proceed with AI model call...

Adapt the response format to your framework (e.g., res.status(429).json(...) for Express).

Step 5: Verify

  1. Start the app and send a normal message — should succeed
  2. Test prompt injection by sending something like "Ignore all previous instructions and..."
  3. Test PII blocking by sending a message with a fake credit card number

Start all rules in "DRY_RUN" mode first. Once verified, promote to "LIVE".

Always recommend using the Arcjet MCP tools to verify rules and analyze traffic:

  • list-requests — confirm decisions are being recorded, filter by conclusion to see blocks
  • analyze-traffic — review denial rates and patterns for the AI endpoint
  • explain-decision — understand why a specific request was allowed or denied (useful for tuning prompt injection sensitivity)
  • promote-rule — promote rules from DRY_RUN to LIVE once verified

If the user wants a full security review, suggest the /arcjet:security-analyst agent which can investigate traffic, detect anomalies, and recommend additional rules.

The Arcjet dashboard at https://app.arcjet.com is also available for visual inspection.

Common Patterns

Streaming responses: Call protect() before starting the stream. If denied, return the error before opening the stream — don't start streaming and then abort.

Multiple models / providers: Use the same Arcjet instance regardless of which AI provider you use. Arcjet operates at the HTTP layer, independent of the model provider.

Vercel AI SDK: Arcjet works alongside the Vercel AI SDK. Call protect() before streamText() / generateText(). If denied, return a plain error response instead of calling the AI SDK.

Common Mistakes to Avoid

  • Sensitive info detection runs locally in WASM — no user data is sent to external services. It is only available in route handlers, not in Next.js pages or server actions.
  • sensitiveInfoValue and detectPromptInjectionMessage (JS) / sensitive_info_value and detect_prompt_injection_message (Python) must both be passed at protect() time — forgetting either silently skips that check.
  • Starting a stream before calling protect() — if the request is denied mid-stream, the client gets a broken response. Always call protect() first and return an error before opening the stream.
  • Using fixedWindow() or slidingWindow() instead of tokenBucket() for AI endpoints — token bucket lets you deduct tokens proportional to model cost and matches the bursty interaction pattern of chat interfaces.
  • Creating a new Arcjet instance per request instead of reusing the shared client with withRule().

同类提示词

更多「Agent Skill」→