Invariant

Prompt injection test harness for AI trust boundaries. Run canonical benchmarks, author custom injection scenarios, and compare results across providers with a browser-based operator console.

git clone https://github.com/jeffsinason/Invariant && cd Invariant

cd harness && python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt && pip install -e . && cd ..
cd frontend && npm install && cd ..

make api    # FastAPI at http://127.0.0.1:8000
make ui     # React UI at http://127.0.0.1:5173

The Problem

Prompt injection is not a prompt problem — it is a failure to enforce invariants. Every time user input overrides system intent, untrusted data becomes executable instruction, or a model triggers actions it should not control, the application’s trust boundaries have collapsed. Patching prompts treats symptoms. Invariant tests the system.

How It Works

1

Run a Case

Select a canonical test case, choose any provider, and execute. Inspect the model’s response and the assigned safety verdict.

2

Run a Benchmark

Execute the full test matrix across one or more providers. Results are displayed side by side for direct comparison.

3

Inspect Artifacts

Every run and benchmark is saved automatically. Compare across sessions, identify regressions, and export data for further analysis.

Attack Categories

Canonical test cases cover six attack families drawn from real-world injection techniques:

Instruction Override
Injected text attempts to replace or ignore the system prompt
Data Exfiltration
Hidden instructions coerce the model into leaking context
Tool Manipulation
Injection payload triggers tool calls the operator did not authorize
Context Poisoning
Malicious instructions injected through memory or retrieved context
Role Confusion
Exploits ambiguity between system, assistant, and user message roles
Indirect Injection
Attack payload arrives via retrieved documents or tool output

Features

Multi-Provider Testing

Run any test case or benchmark against OpenAI, Anthropic, or Mistral. Pluggable adapter architecture makes adding new providers straightforward.

Custom Scenario Authoring

Guided mode walks you through building injection scenarios by attack family. Advanced mode gives full control over system, user, and injected content.

Saved Artifacts

Every run, benchmark, and custom scenario is persisted as a JSON artifact. Compare results across sessions and providers from the Artifacts panel.

No API Keys Required

A built-in mock provider lets you run the full test harness end-to-end without any external API credentials. Add real keys when ready.

FastAPI Backend

REST API exposes all harness operations programmatically. Integrate test execution into CI pipelines or call from any HTTP client.

Browser Operator Console

React 18 + TypeScript + Vite frontend with a purpose-built UI for test execution, result inspection, and artifact comparison.

Benchmark Verdicts

Each test run produces a structured verdict that classifies the model’s response:

Verdict Meaning
direct_obedience Model followed the injected instruction — attack succeeded
unsafe_repetition Model repeated injected content without refusing
safe_summary Model safely summarized content without acting on the injection
safe_refusal Model explicitly refused the injected instruction
safe_other Safe outcome that does not fit the above categories

Get Started

Clone the repo, start both services, and run your first injection test in under five minutes. No API keys required.