What is an LLM vulnerability scanner?

An LLM vulnerability scanner sends batteries of adversarial probes — jailbreaks, prompt injections, PII extraction attempts, harmful-content requests — at a target LLM and grades the responses. The output is a vulnerability + optimization report with per-probe evidence, severity, and a prioritized fix list.

Which LLMs can I scan with FilterPrompt?

OpenAI, Anthropic, Google Gemini, Azure OpenAI, plus any OpenAI-compatible endpoint — Ollama, Groq, Mistral, Together AI, OpenRouter, Perplexity, Hugging Face, vLLM, or your own custom endpoint. Bring your own keys per tenant.

What kinds of vulnerabilities does FilterPrompt test for?

Jailbreaks (DAN, role hijack, translation smuggling), direct and indirect prompt injection, system-prompt extraction, harmful-content compliance, PII / secret leakage, bias & fairness, RAG poisoning, agent/tool abuse, output quality, and robustness — categories map to the OWASP LLM Top 10.

How are probes graded?

Each probe declares an evaluator: regex match, refusal-check, contains-check, or an AI judge (Gemini 3 Flash). Pass/fail comes with severity, category, the exact prompt sent, the model's full response, and the evaluator's reason — fully auditable.

How much does a scan cost?

1 credit per probe executed. New accounts get 1 welcome credit on signup. Pay-as-you-go credit packs after that — credits never expire. Connecting LLMs and creating tenants is free.

FilterPrompt Benchmark Methodology

Open, reproducible methodology behind FilterPrompt's published detection accuracy and latency claims. Below: the datasets, the evaluation harness, the per-attack-family results, the false positive rate on benign traffic, and the latency budget across pipeline stages.

Headline numbers

Macro-F1 across 5 attack families on holdout: 0.992
Recall on direct prompt injection: 0.997
Recall on indirect prompt injection (RAG-style payloads): 0.984
Recall on jailbreak / role-play attacks: 0.989
Recall on tool-call injection: 0.991
Recall on data-exfiltration prompts: 0.998
False positive rate on benign control set (production traffic, manually verified): 0.4%
Median end-to-end firewall latency: under 100ms
p95 end-to-end firewall latency: 142ms

Datasets

Public injection corpora — JailbreakBench, PromptInject, Garak attack sets
Proprietary red-team dataset — 18,427 labeled adversarial prompts collected from internal red teaming and bug-bounty submissions, balanced across the 5 attack families above
PII corpus — 9,200 synthetic and redacted real-world spans across 12 entity types (emails, phones, SSNs, passport numbers, tax IDs, IBAN, SWIFT, Luhn-validated cards, API keys, JWTs, AWS / GCP / Azure credentials, private keys)
Benign control set — 24,000 sampled production prompts from consenting tenants, manually reviewed and confirmed non-adversarial; used to measure false positive rate

Evaluation harness

The harness is a deterministic Python runner that loads each labeled split, sends every prompt through a configurable detection stack, and records per-rule verdicts, aggregated risk scores, and per-stage latency. The same harness produces the per-release report. The full pipeline runs in under 12 minutes on a single c7i.4xlarge for the complete 51,000-row evaluation set.

Per-attack-family results

We report precision, recall, and F1 per attack family — not just an aggregate — because attack mix varies wildly across deployments. A RAG-heavy product cares most about indirect injection; a chat product cares most about jailbreaks; an agent product cares most about tool-call injection. Reporting per-family lets readers pick the number that matches their threat model.

Latency budget

Auth + tenant resolution: median 4ms
IP check (global + tenant blocklist + auto-ban counter): median 6ms
Quota check (rate limit + monthly cap): median 3ms
Pattern rules (regex / keyword corpus): p95 0.9ms
Structural validators (role / boundary / canary): p95 1.1ms
PII pre-filter (12 entity types + custom regex): median 11ms
ML detector ensemble (Detoxify + XGBoost): p95 38ms
Upstream call (excluded from firewall budget): median 1.4s for GPT-4o on a 200-token prompt
PII post-filter on response: median 9ms
Audit log write: deferred (background), 0ms blocking

False positive rate methodology

We measure FPR on the benign control set with the full detection stack enabled at production thresholds. Every flagged-as-positive sample in the control set is manually reviewed by two analysts; only items both analysts agree are non-adversarial count toward the FPR denominator. The 0.4% headline number reflects the FPR at the default risk-score threshold; tuning the threshold lower trades some recall for a sub-0.1% FPR if your deployment cannot tolerate any false blocks.

Reproducibility

The eval harness is scripted and parameterized — running it against any FilterPrompt provider config produces a deterministic report with the same per-family precision/recall/F1 layout shown above. We publish the harness output with each major release so customers and auditors can verify the headline numbers themselves. Public corpora used in the benchmark are linked above; the proprietary red-team dataset is available under NDA for security audits and academic research.

What's intentionally not benchmarked

Detection on entirely novel attack families that didn't exist when the model was trained. We rely on the ML ensemble for generalization there, but we don't claim a number we can't measure. Each release ships with a 'novel-attack soak test' against fresh adversarial prompts collected in the prior month; the results are reported separately and not folded into the headline accuracy.