Detection Methods

Dome registers 36 detection methods across Security, Moderation, Privacy, Integrity, Generic, and Policy categories.

Security

Security Detectors identify prompt injections, jailbreak attempts, and encoded or obfuscated payloads.

`prompt-injection-deberta-v3-base`

DeBERTa v3 classifier for prompt injection detection.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`truncation`	`bool`	`True`	Truncate each model window to `max_length`.
`max_length`	`int`	`512`	Token limit per window.
`window_stride`	`int`	`256`	Token step between windows.

Class: DebertaPromptInjectionModel
Model: protectai/deberta-v3-base-prompt-injection-v2

`prompt-injection-deberta-finetuned-11122024`

Fine-tuned DeBERTa classifier for prompt injection detection.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`truncation`	`bool`	`True`	Truncate each model window to `max_length`.
`max_length`	`int`	`512`	Token limit per window.
`window_stride`	`int`	`256`	Token step between windows.

Class: DebertaTuned60PromptInjectionModel
Model: vijil/pi_deberta_finetuned_11122024

`prompt-injection-mbert`

ModernBERT classifier for prompt injection detection.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`score_threshold`	`float`	`0.5`	Injection probability at which the Detector starts flagging content.
`truncation`	`bool`	`True`	Truncate each model window to `max_length`.
`max_length`	`int`	`8192`	Token limit per window.
`window_stride`	`int`	`4096`	Token step between windows.

Class: MBertPromptInjectionModel
Model: vijil/vijil_dome_prompt_injection_detection
Text processor: answerdotai/ModernBERT-base

`prompt-injection-mbert-safeguard`

Prompt injection classification through an OpenAI-compatible chat completions endpoint. The default endpoint uses GPT-OSS-Safeguard-20B through the groq provider.

Input: Text or a structured payload flattened to its query string.
Execution: API-only detection; the Detector truncates oversize input by character count.
Requires: The local extra for current registration and an API key.

Parameter	Type	Default	Description
`api_key`	`str \| None`	`None`	API key; falls back to the environment variable named by `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Environment variable fallback for `api_key`.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	OpenAI-compatible base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Model sent to the endpoint.
`temperature`	`float`	`0.0`	Sampling temperature.
`max_tokens`	`int`	`2000`	Response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Reasoning setting; use `None` to omit it.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.
`max_input_chars`	`int \| None`	`400000`	Character limit before the request; use `None` to disable it.

Keep max_tokens large enough for reasoning models to return a verdict. The current parser treats an empty response as safe.

Class: PImbertSafeguard

`prompt-injection-mbert-hybrid`

Runs a fast ModernBERT stage first and sends low-confidence results to a Safeguard endpoint. The fast stage can run locally or through a direct inference endpoint.

Input: Text or a structured payload flattened to its query string.
Execution: Fast-stage classification with conditional API escalation.
Requires: The local extra; Safeguard credentials are optional because the method falls back to the fast verdict.

Parameter	Type	Default	Description
`vijil_inference_url`	`str \| None`	`None`	`Vijil` inference base URL for the fast stage; `/v1/chat/completions` must return a numeric score.
`vijil_inference_model`	`str \| None`	`None`	Override the direct fast-stage model.
`vijil_inference_api_key`	`str \| None`	`None`	Direct inference key; falls back to `VIJIL_INFERENCE_API_KEY`.
`confidence_threshold`	`float`	`0.85`	Fast-stage confidence below which the Detector calls the Safeguard.
`score_threshold`	`float`	`0.5`	Fast-stage injection threshold.
`truncation`	`bool`	`True`	Truncate local fast-stage windows.
`max_length`	`int`	`8192`	Token limit per local fast-stage window.
`window_stride`	`int`	`4096`	Token step between local fast-stage windows.
`api_key`	`str \| None`	`None`	Safeguard key; falls back to `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Safeguard key environment variable.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	Safeguard base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Safeguard model.
`temperature`	`float`	`0.0`	Safeguard sampling temperature.
`max_tokens`	`int`	`2000`	Safeguard response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Safeguard reasoning setting.
`timeout_seconds`	`float`	`10.0`	Safeguard request timeout.
`max_input_chars`	`int \| None`	`400000`	Character limit before escalation.

Class: PImbertHybrid
Local model: vijil/vijil_dome_prompt_injection_detection

`prompt-injection-mbert-remote`

Runs the ModernBERT prompt injection model through a Vijil inference deployment. The client calls /v1/chat/completions and expects a numeric score in the response message content.

Input: Text or a structured payload flattened to its query string.
Execution: Direct HTTP inference; this method does not use automatic routing.
Requires: The local extra for current registration and vijil_inference_url.

Parameter	Type	Default	Description
`vijil_inference_url`	`str`	Required	`Vijil` inference base URL.
`vijil_inference_model`	`str \| None`	`None`	Model override; otherwise uses the registered prompt injection model.
`vijil_inference_api_key`	`str \| None`	`None`	API key; falls back to `VIJIL_INFERENCE_API_KEY`.
`score_threshold`	`float`	`0.5`	Score at which the Detector starts flagging content.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.

Class: MBertPromptInjectionRemote
Default model: vijil/vijil_dome_prompt_injection_detection

`security-promptguard`

Meta Prompt Guard classifier for jailbreak and prompt injection detection.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model.
Requires: The local extra.

Parameter	Type	Default	Description
`score_threshold`	`float`	`0.5`	Jailbreak probability at which the Detector starts flagging content.
`truncation`	`bool`	`True`	Truncate each model window.
`max_length`	`int`	`512`	Token limit per window.
`window_stride`	`int`	`256`	Token step between windows.

Class: PromptGuardSecurityModel
Model: meta-llama/Prompt-Guard-86M

`security-llm`

Prompt-engineered security classification through LiteLLM.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra and credentials for the selected provider.

Parameter	Type	Default	Description
`hub_name`	`str`	`VIJIL_LLM_HUB` or `"openai"`	Provider: `openai`, `together`, or `groq`.
`model_name`	`str`	`VIJIL_LLM_MODEL` or `"gpt-4-turbo"`	Provider model name.
`api_key`	`str \| None`	`None`	Provider API key.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.

Class: LlmSecurity

`security-embeddings`

Compares content embeddings with a bundled corpus of known jailbreaks.

Input: Text or a structured payload flattened to its query string.
Execution: Local embedding and nearest-neighbor search.
Requires: The local extra. The embeddings extra is also required when in_mem=False.

Parameter	Type	Default	Description
`engine`	`str`	`"SentenceTransformers"`	Embedding engine.
`model`	`str`	`"all-MiniLM-L6-v2"`	Embedding model.
`threshold`	`float`	`0.7`	Similarity above which the Detector flags content.
`in_mem`	`bool`	`True`	Use the in-memory index instead of Annoy.

Class: JailbreakEmbeddingsDetector

`jb-length-per-perplexity`

Flags jailbreaks using the ratio between input length and GPT-2 perplexity.

Input: Text or a structured payload flattened to its query string.
Execution: Local model heuristic.
Requires: The local extra.

Parameter	Type	Default	Description
`model_id`	`str`	`"gpt2-large"`	Hugging Face model used for perplexity.
`batch_size`	`int`	`16`	Stored batch-size setting.
`stride_length`	`int`	`512`	Stride used during perplexity calculation.
`threshold`	`float`	`89.79`	Length-to-perplexity threshold.

Class: LengthPerPerplexityModel

`jb-prefix-suffix-perplexity`

Calculates perplexity separately for the beginning and end of the input.

Input: Text or a structured payload flattened to its query string.
Execution: Local model heuristic.
Requires: The local extra.

Parameter	Type	Default	Description
`model_id`	`str`	`"gpt2-large"`	Hugging Face model used for perplexity.
`batch_size`	`int`	`16`	Stored batch-size setting.
`stride_length`	`int`	`512`	Stride used during perplexity calculation.
`prefix_threshold`	`float`	`1845.65`	Prefix perplexity threshold.
`suffix_threshold`	`float`	`1845.65`	Suffix perplexity threshold.
`prefix_length`	`int`	`20`	Number of prefix words.
`suffix_length`	`int`	`20`	Number of suffix words.

Class: PrefixSuffixPerplexityModel

`encoding-heuristics`

Detects encoded or obfuscated payloads with local rules.

Input: Text or a structured payload flattened to its query string.
Execution: Local rules.
Requires: The core install.

Parameter	Type	Default	Description
`threshold_map`	`dict`	See below	Per-encoding threshold overrides.

Encoding Type	Default Threshold
`base64`	`0.7`
`rot13`	`0.7`
`ascii_escape`	`0.05`
`hex_encoding`	`0.15`
`url_encoding`	`0.15`
`cyrillic_homoglyphs`	`0.05`
`mixed_scripts`	`0.05`
`zero_width`	`0.01`
`excessive_whitespace`	`0.4`

Class: EncodingHeuristicsDetector

Moderation

Moderation Detectors identify toxic, harmful, stereotyped, or otherwise inappropriate content.

`moderation-deberta`

DeBERTa classifier for toxicity scoring.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`truncation`	`bool`	`True`	Truncate each model window.
`max_length`	`int`	`208`	Token limit per window.
`window_stride`	`int`	`104`	Token step between windows.
`device`	`str \| None`	`None`	Torch device; automatically selects CUDA when available.

Class: ToxicityDeberta
Model: cooperleong00/deberta-v3-large_toxicity-scorer

`moderation-mbert`

ModernBERT classifier for toxic content.

Input: Text or a structured payload flattened to its query string.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`score_threshold`	`float`	`0.5`	Toxicity probability at which the Detector starts flagging content.
`truncation`	`bool`	`True`	Truncate each model window.
`max_length`	`int`	`8192`	Token limit per window.
`window_stride`	`int`	`4096`	Token step between windows.

Class: MBertToxicContentModel
Model: vijil/vijil_dome_toxic_content_detection
Text processor: answerdotai/ModernBERT-base

`moderation-mbert-safeguard`

Toxicity classification through an OpenAI-compatible chat completions endpoint. The default endpoint uses GPT-OSS-Safeguard-20B through the groq provider.

Input: Text or a structured payload flattened to its query string.
Execution: API-only detection; the Detector truncates oversize input by character count.
Requires: The local extra for current registration and an API key.

Parameter	Type	Default	Description
`api_key`	`str \| None`	`None`	API key; falls back to the environment variable named by `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Environment variable fallback for `api_key`.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	OpenAI-compatible base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Model sent to the endpoint.
`temperature`	`float`	`0.0`	Sampling temperature.
`max_tokens`	`int`	`2000`	Response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Reasoning setting; use `None` to omit it.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.
`max_input_chars`	`int \| None`	`400000`	Character limit before the request; use `None` to disable it.

Keep max_tokens large enough for reasoning models to return a verdict. The current parser treats an empty response as safe.

Class: ModerationMbertSafeguard

`moderation-mbert-hybrid`

Runs a fast ModernBERT toxicity stage first and sends low-confidence results to a Safeguard endpoint. The fast stage can run locally or through a direct inference endpoint.

Input: Text or a structured payload flattened to its query string.
Execution: Fast-stage classification with conditional API escalation.
Requires: The local extra; Safeguard credentials are optional because the method falls back to the fast verdict.

Parameter	Type	Default	Description
`vijil_inference_url`	`str \| None`	`None`	`Vijil` inference base URL for the fast stage; `/v1/chat/completions` must return a numeric score.
`vijil_inference_model`	`str \| None`	`None`	Override the direct fast-stage model.
`vijil_inference_api_key`	`str \| None`	`None`	Direct inference key; falls back to `VIJIL_INFERENCE_API_KEY`.
`confidence_threshold`	`float`	`0.85`	Fast-stage confidence below which the Detector calls the Safeguard.
`score_threshold`	`float`	`0.5`	Fast-stage toxicity threshold.
`truncation`	`bool`	`True`	Truncate local fast-stage windows.
`max_length`	`int`	`8192`	Token limit per local fast-stage window.
`window_stride`	`int`	`4096`	Token step between local fast-stage windows.
`api_key`	`str \| None`	`None`	Safeguard key; falls back to `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Safeguard key environment variable.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	Safeguard base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Safeguard model.
`temperature`	`float`	`0.0`	Safeguard sampling temperature.
`max_tokens`	`int`	`2000`	Safeguard response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Safeguard reasoning setting.
`timeout_seconds`	`float`	`10.0`	Safeguard request timeout.
`max_input_chars`	`int \| None`	`400000`	Character limit before escalation.

Class: ModerationMbertHybrid
Local model: vijil/vijil_dome_toxic_content_detection

`moderation-mbert-remote`

Runs the ModernBERT toxicity model through a Vijil inference deployment. The client calls /v1/chat/completions and expects a numeric score in the response message content.

Input: Text or a structured payload flattened to its query string.
Execution: Direct HTTP inference; this method does not use automatic routing.
Requires: The local extra for current registration and vijil_inference_url.

Parameter	Type	Default	Description
`vijil_inference_url`	`str`	Required	`Vijil` inference base URL.
`vijil_inference_model`	`str \| None`	`None`	Model override; otherwise uses the registered toxicity model.
`vijil_inference_api_key`	`str \| None`	`None`	API key; falls back to `VIJIL_INFERENCE_API_KEY`.
`score_threshold`	`float`	`0.5`	Score at which the Detector starts flagging content.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.

Class: MBertToxicContentRemote
Default model: vijil/vijil_dome_toxic_content_detection

`moderations-oai-api`

Calls the OpenAI Moderation API and uses either the provider’s flagged verdict or configured per-category thresholds.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API.
Requires: The llm extra and OPENAI_API_KEY.

Parameter	Type	Default	Description
`score_threshold_dict`	`dict \| None`	`None`	Map provider category names to custom score thresholds.

Without score_threshold_dict, the Detector uses the provider’s flagged value. Category keys must match those returned by the configured OpenAI Moderation API.

Class: OpenAIModerations
Default model: text-moderation-latest

`moderation-perspective-api`

Calls the Google Perspective API for toxicity and related attributes.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API.
Requires: The google extra and a Perspective API key.

Parameter	Type	Default	Description
`api_key`	`str \| None`	`None`	Google API key; falls back to `PERSPECTIVE_API_KEY`.
`attributes`	`dict`	`{"TOXICITY": {}}`	Attributes requested from Perspective.
`score_threshold`	`dict`	`{"TOXICITY": 0.5}`	Per-attribute thresholds.

Class: PerspectiveAPI

`moderation-prompt-engineering`

Prompt-engineered moderation classification through LiteLLM.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra and credentials for the selected provider.

Parameter	Type	Default	Description
`hub_name`	`str`	`VIJIL_LLM_HUB` or `"openai"`	Provider: `openai`, `together`, or `groq`.
`model_name`	`str`	`VIJIL_LLM_MODEL` or `"gpt-4-turbo"`	Provider model name.
`api_key`	`str \| None`	`None`	Provider API key.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.

Class: LlmModerations

`moderation-flashtext`

Matches configured keywords and phrases with FlashText.

Input: Text or a structured payload flattened to its query string.
Execution: Local keyword matching.
Requires: The core install.

Parameter	Type	Default	Description
`banlist_filepaths`	`list[str] \| None`	`None`	Ban-list files; without a value, the Detector loads the bundled list.

Class: KWBanList

`stereotype-eeoc-fast`

ModernBERT classifier for stereotypes and harmful generalizations about EEOC protected classes. This Detector classifies one payload; it does not perform counterfactual comparisons across a set of prompts.

Input: Uses prompt [SEP] response when both fields are present; the Detector treats plain text as the prompt.
Execution: Local chunked model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`model_name`	`str`	`"vijil/stereotype-eeoc-detector"`	Classifier model.
`tokenizer_name`	`str`	`"answerdotai/ModernBERT-base"`	Text-processing model.
`score_threshold`	`float`	`0.90`	Stereotype probability at which the Detector starts flagging content.
`max_length`	`int`	`512`	Token limit per chunk.

Class: StereotypeEEOCFast
Model: vijil/stereotype-eeoc-detector

`stereotype-eeoc-safeguard`

EEOC stereotype classification through an OpenAI-compatible chat completions endpoint. The default endpoint uses GPT-OSS-Safeguard-20B through the groq provider.

Input: Text or the complete structured payload query string.
Execution: API-only detection; the Detector truncates oversize input by character count.
Requires: The local extra for current registration and an API key.

Parameter	Type	Default	Description
`api_key`	`str \| None`	`None`	API key; falls back to the environment variable named by `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Environment variable fallback for `api_key`.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	OpenAI-compatible base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Model sent to the endpoint.
`temperature`	`float`	`0.0`	Sampling temperature.
`max_tokens`	`int`	`2000`	Response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Reasoning setting; use `None` to omit it.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.
`max_input_chars`	`int \| None`	`400000`	Character limit before the request; use `None` to disable it.

Keep max_tokens large enough for reasoning models to return a verdict. The current parser treats an empty response as safe.

Class: StereotypeEEOCSafeguard

`stereotype-eeoc-hybrid`

Runs the fast EEOC classifier first and sends low-confidence results to a Safeguard endpoint. The fast stage can run locally or through a direct inference endpoint.

Input: Uses the structured prompt and response when available.
Execution: Fast-stage classification with conditional API escalation.
Requires: The local extra; Safeguard credentials are optional because the method falls back to the fast verdict.

Parameter	Type	Default	Description
`vijil_inference_url`	`str \| None`	`None`	`Vijil` inference base URL for the fast stage; `/v1/chat/completions` must return a numeric score.
`vijil_inference_model`	`str \| None`	`None`	Override the direct fast-stage model.
`vijil_inference_api_key`	`str \| None`	`None`	Direct inference key; falls back to `VIJIL_INFERENCE_API_KEY`.
`confidence_threshold`	`float`	`0.85`	Fast-stage confidence below which the Detector calls the Safeguard.
`model_name`	`str`	`"vijil/stereotype-eeoc-detector"`	Local fast-stage model.
`tokenizer_name`	`str`	`"answerdotai/ModernBERT-base"`	Local fast-stage text processor.
`score_threshold`	`float`	Local: `0.90`; direct: `0.5`	Fast-stage stereotype threshold.
`max_length`	`int`	`512`	Token limit per local fast-stage chunk.
`api_key`	`str \| None`	`None`	Safeguard key; falls back to `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Safeguard key environment variable.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	Safeguard base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Safeguard model.
`temperature`	`float`	`0.0`	Safeguard sampling temperature.
`max_tokens`	`int`	`2000`	Safeguard response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Safeguard reasoning setting.
`timeout_seconds`	`float`	`10.0`	Safeguard request timeout.
`max_input_chars`	`int \| None`	`400000`	Character limit before escalation.

Class: StereotypeEEOCHybrid
Local model: vijil/stereotype-eeoc-detector

`stereotype-eeoc-remote`

Runs the EEOC stereotype model through a Vijil inference deployment. The client calls /v1/chat/completions and expects a numeric score in the response message content.

Input: Text or the complete structured payload query string.
Execution: Direct HTTP inference; this method does not use automatic routing.
Requires: The local extra for current registration and vijil_inference_url.

Parameter	Type	Default	Description
`vijil_inference_url`	`str`	Required	`Vijil` inference base URL.
`vijil_inference_model`	`str \| None`	`None`	Model override; otherwise uses the registered stereotype model.
`vijil_inference_api_key`	`str \| None`	`None`	API key; falls back to `VIJIL_INFERENCE_API_KEY`.
`score_threshold`	`float`	`0.5`	Score at which the Detector starts flagging content.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.

Class: StereotypeEEOCRemote
Default model: vijil/stereotype-eeoc-detector

`prompt-harmfulness-fast`

ModernBERT classifier for prompts that request harmful, dangerous, or illegal content. Use this Detector in input Guards.

Input: Uses only prompt when present; otherwise uses text. The Detector ignores any response field.
Execution: Local sliding-window model, or automatic inference routing.
Requires: The local extra for local execution.

Parameter	Type	Default	Description
`model_name`	`str`	`"vijil/prompt-harmfulness-detector"`	Classifier model.
`tokenizer_name`	`str`	`"answerdotai/ModernBERT-base"`	Text-processing model.
`score_threshold`	`float`	`0.95`	Harmfulness probability at which the Detector starts flagging the prompt.
`max_length`	`int`	`512`	Token limit per window.
`window_stride`	`int`	`256`	Token step between windows.

Class: PromptHarmfulnessFast
Model: vijil/prompt-harmfulness-detector

`prompt-harmfulness-safeguard`

Prompt harmfulness classification through an OpenAI-compatible chat completions endpoint. The default endpoint uses GPT-OSS-Safeguard-20B through the groq provider. Use this Detector in input Guards.

Input: Uses only prompt when present; otherwise uses text. The Detector ignores any response field.
Execution: API-only detection; the Detector truncates oversize input by character count.
Requires: The local extra for current registration and an API key.

Parameter	Type	Default	Description
`api_key`	`str \| None`	`None`	API key; falls back to the environment variable named by `api_key_name`.
`api_key_name`	`str`	`"GROQ_API_KEY"`	Environment variable fallback for `api_key`.
`base_url`	`str`	`"https://api.groq.com/openai/v1"`	OpenAI-compatible base URL.
`model`	`str`	`"openai/gpt-oss-safeguard-20b"`	Model sent to the endpoint.
`temperature`	`float`	`0.0`	Sampling temperature.
`max_tokens`	`int`	`2000`	Response token budget.
`reasoning_effort`	`str \| None`	`"low"`	Reasoning setting; use `None` to omit it.
`timeout_seconds`	`float`	`10.0`	Request timeout in seconds.
`max_input_chars`	`int \| None`	`400000`	Character limit before the request; use `None` to disable it.

Keep max_tokens large enough for reasoning models to return a verdict. The current parser treats an empty response as safe.

Class: PromptHarmfulnessSafeguard

Privacy

Privacy Detectors identify PII and credentials. Both built-in Privacy Detectors can sanitize content instead of leaving it flagged.

`privacy-presidio`

Uses Microsoft Presidio for PII analysis and redaction.

Input: Text or a structured payload flattened to its query string.
Execution: Local PII analysis, or automatic inference routing.
Requires: The pii extra for local execution.

Parameter	Type	Default	Description
`score_threshold`	`float`	`0.5`	Confidence above which an entity is PII.
`anonymize`	`bool`	`True`	Return sanitized content instead of a flagged result.
`allow_list_files`	`list[str] \| None`	`None`	Files containing values excluded from detection.
`redaction_style`	`str`	`"labeled"`	`"labeled"` replacements or `"masked"` characters.

When anonymize=True, the Detector returns the sanitized response with hit=False. Set anonymize=False when the Guard must block detected PII.

Class: PresidioDetector

`detect-secrets`

Uses 25 Detect Secrets plugins to identify API keys, tokens, private keys, and other credential formats.

Input: Text or a structured payload flattened to its query string.
Execution: Local pattern matching.
Requires: The core install.

Parameter	Type	Default	Description
`censor`	`bool`	`True`	Return censored content instead of a flagged result.

When censor=True, the Detector replaces detected values and returns hit=False. Set censor=False when the Guard must block detected secrets.

Class: SecretDetector

Integrity

Integrity Detectors compare content with reference context. Pass context in the Detector configuration or in DomePayload.context; the payload value takes precedence.

`hhem-hallucination`

Uses HHEM to score factual consistency between content and context.

Input: Content plus reference context.
Execution: Local model.
Requires: The local extra and reference context.

Parameter	Type	Default	Description
`context`	`str`	`""`	Fallback reference context.
`factual_consistency_score_threshold`	`float`	`0.5`	The Detector flags scores below this value.
`trust_remote_code`	`bool`	`True`	Allow remote model code when loading the model.

Class: HhemHallucinationModel
Model: vectara/hallucination_evaluation_model
Text processor: google/flan-t5-base

`fact-check-roberta`

Uses RoBERTa to detect contradictions between content and reference context. It does not flag unsupported claims unless the context contradicts them.

Input: Content plus reference context.
Execution: Local model.
Requires: The local extra and reference context.

Parameter	Type	Default	Description
`context`	`str`	`""`	Fallback reference context.

Class: RobertaFactCheckModel
Model: Dzeniks/roberta-fact-check

`hallucination-llm`

Uses a prompt-engineered LLM to assess content against reference context.

Input: Content plus reference context.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra, provider credentials, and reference context.

Parameter	Type	Default	Description
`hub_name`	`str`	`VIJIL_LLM_HUB` or `"openai"`	Provider: `openai`, `together`, or `groq`.
`model_name`	`str`	`VIJIL_LLM_MODEL` or `"gpt-4-turbo"`	Provider model name.
`api_key`	`str \| None`	`None`	Provider API key.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.
`context`	`str \| None`	`None`	Fallback reference context.

Class: LlmHallucination

`fact-check-llm`

Uses a prompt-engineered LLM to fact-check content against reference context.

Input: Content plus reference context.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra, provider credentials, and reference context.

Parameter	Type	Default	Description
`hub_name`	`str`	`VIJIL_LLM_HUB` or `"openai"`	Provider: `openai`, `together`, or `groq`.
`model_name`	`str`	`VIJIL_LLM_MODEL` or `"gpt-4-turbo"`	Provider model name.
`api_key`	`str \| None`	`None`	Provider API key.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.
`context`	`str \| None`	`None`	Fallback reference context.

Class: LlmFactcheck

Generic

Generic Detectors apply configurable LLM classification to use cases that do not fit a specialized category.

`generic-llm`

Uses a caller-provided system prompt and trigger words to classify content through LiteLLM.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra and credentials for the selected provider.

Parameter	Type	Default	Description
`sys_prompt_template`	`str`	Required	System prompt template; use `$query_string` to insert the input.
`trigger_word_list`	`list[str]`	Required	Lowercase response text fragments that mark a hit.
`hub_name`	`str`	`VIJIL_LLM_HUB` or `"openai"`	Provider: `openai`, `together`, or `groq`.
`model_name`	`str`	`VIJIL_LLM_MODEL` or `"gpt-4-turbo"`	Provider model name.
`api_key`	`str \| None`	`None`	Provider API key.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.

Class: GenericLLMDetector

`policy-gpt-oss-safeguard`

Classifies content against one policy supplied as a Markdown file or inline Markdown.

Input: Text or a structured payload flattened to its query string.
Execution: Provider API, or automatic inference routing.
Requires: The llm extra, exactly one policy source, and provider credentials.

Parameter	Type	Default	Description
`policy_file`	`str \| None`	`None`	Path to policy Markdown. Mutually exclusive with `policy_content`.
`policy_content`	`str \| None`	`None`	Inline policy Markdown. Mutually exclusive with `policy_file`.
`hub_name`	`str`	`"groq"`	LLM provider.
`model_name`	`str`	`VIJIL_SAFEGUARD_MODEL` or `"openai/gpt-oss-safeguard-20b"`	Safeguard model.
`output_format`	`str`	`"policy_ref"`	`"binary"`, `"policy_ref"`, or `"with_rationale"`.
`reasoning_effort`	`str`	`"medium"`	`"low"`, `"medium"`, or `"high"`.
`api_key`	`str \| None`	`None`	Provider API key; `groq` falls back to `GROQ_API_KEY`.
`timeout`	`int`	`60`	Request timeout in seconds.
`max_retries`	`int`	`3`	Request retry limit.
`max_input_chars`	`int \| None`	`None`	Character limit before the request.

Class: PolicyGptOssSafeguard

Policy

Policy Detectors check content against policy sections.

`policy-sections`

Creates one PolicyGptOssSafeguard instance per matching section and checks the sections concurrently. Callers can provide sections directly or load them from S3.

Input: Text or a structured payload flattened to its query string.
Execution: Parallel provider API calls with optional FAISS retrieval.
Requires: The llm extra. S3 loading requires s3; RAG requires s3 and embeddings.

With RAG, the default OpenAI embedding engine reads OPENAI_API_KEY. SentenceTransformers also requires the local extra. FastEmbed requires a separate pip install fastembed because no Dome extra includes it. Provide either policy_sections or both policy_s3_bucket and policy_s3_key. Do not provide both sources.

Parameter	Type	Default	Description
`policy_s3_bucket`	`str \| None`	`None`	S3 bucket containing policy sections.
`policy_s3_key`	`str \| None`	`None`	S3 object key for the policy sections JSON.
`policy_sections`	`list[dict] \| None`	`None`	Direct section objects with `section_id`, `content`, and `applies_to`.
`applies_to`	`str \| list[str]`	`"input"`	Keep sections for `input`, `output`, or both.
`max_parallel_sections`	`int \| None`	`10`	Concurrent policy-section limit.
`model_name`	`str`	`VIJIL_SAFEGUARD_MODEL` or `"openai/gpt-oss-safeguard-20b"`	Model used for each section.
`reasoning_effort`	`str`	`"medium"`	`"low"`, `"medium"`, or `"high"`.
`hub_name`	`str`	`"groq"`	LLM provider used for each section.
`timeout`	`int \| None`	`60`	Request timeout in seconds.
`max_retries`	`int \| None`	`3`	Request retry limit.
`api_key`	`str \| None`	`None`	Provider API key.
`aws_access_key_id`	`str \| None`	`None`	Optional AWS access key override.
`aws_secret_access_key`	`str \| None`	`None`	Optional AWS secret key override.
`aws_session_token`	`str \| None`	`None`	Optional AWS session token.
`region_name`	`str \| None`	`None`	Optional AWS region override.
`cache_dir`	`str \| None`	`None`	Local cache directory; defaults under `~/.cache/vijil-dome`.
`use_rag`	`bool`	`False`	Retrieve relevant sections from a prebuilt FAISS index.
`faiss_s3_key`	`str \| None`	`None`	S3 key for the FAISS index; required with RAG.
`section_ids_s3_key`	`str \| None`	`None`	S3 key for the section-ID mapping; required with RAG.
`top_k`	`int`	`5`	RAG result limit.
`similarity_threshold`	`float`	`0.0`	RAG similarity lower bound.
`embedding_model`	`str`	`"text-embedding-ada-002"`	Query embedding model.
`embedding_engine`	`str`	`"OpenAI"`	`"OpenAI"`, `"FastEmbed"`, or `"SentenceTransformers"`.

If RAG initialization fails, the current implementation logs a warning and falls back to evaluating all matching sections.

Class: PolicySectionsDetector

Configuration Examples

Canonical methods marked for automatic inference routing accept route = "auto" | "local" | "remote"; auto is the default and uses DOME_INFERENCE_URL when configured. Without an explicit route, DOME_LOCAL_DETECTORS can keep a comma-separated list of method names local. Remote routing uses threshold, which defaults to 0.5, while local methods use parameters such as score_threshold. Every method accepts max_batch_concurrency, which defaults to 5. Explicit *-remote methods and hybrid fast stages use vijil_inference_* instead of this routing layer.

Local Model

[prompt-injection]
type = "security"
methods = ["prompt-injection-mbert"]

[prompt-injection.prompt-injection-mbert]
route = "local"
score_threshold = 0.7
max_batch_concurrency = 4

Automatic Inference Service

Set DOME_INFERENCE_URL, then require remote execution for a remote-capable canonical method:

[prompt-injection]
type = "security"
methods = ["prompt-injection-mbert"]

[prompt-injection.prompt-injection-mbert]
route = "remote"
threshold = 0.7

This path calls DOME_INFERENCE_URL/v1/detect. It does not use the explicit prompt-injection-mbert-remote method.

Prompt Harmfulness

config = {
    "input-guards": ["harmful-prompt"],
    "harmful-prompt": {
        "type": "moderation",
        "methods": ["prompt-harmfulness-fast"],
        "prompt-harmfulness-fast": {
            "route": "local",
            "score_threshold": 0.95,
        },
    },
}

Direct Policy Sections

config = {
    "input-guards": ["policy-input"],
    "policy-input": {
        "type": "policy",
        "methods": ["policy-sections"],
        "policy-sections": {
            "policy_sections": [
                {
                    "section_id": "customer-data",
                    "content": "Do not reveal customer personal data.",
                    "applies_to": ["input"],
                }
            ],
            "applies_to": "input",
            "hub_name": "groq",
        },
    },
}

Sliding Window Behavior

Local DeBERTa, ModernBERT, Prompt Guard, and prompt harmfulness Detectors split inputs that exceed their configured max_length:

The Detector processes inputs that fit in one window unchanged.
window_stride controls the token step and overlap between windows.
Any positive window flags the complete input.
Score-based Detectors report the highest score across windows.
Optimized detect_batch() implementations flatten windows into one model call and then combine results for each original input.

The stereotype Detector uses its own [SEP]-centered chunking strategy and does not expose window_stride.

​Security

​prompt-injection-deberta-v3-base

​prompt-injection-deberta-finetuned-11122024

​prompt-injection-mbert

​prompt-injection-mbert-safeguard

​prompt-injection-mbert-hybrid

​prompt-injection-mbert-remote

​security-promptguard

​security-llm

​security-embeddings

​jb-length-per-perplexity

​jb-prefix-suffix-perplexity

​encoding-heuristics

​Moderation

​moderation-deberta

​moderation-mbert

​moderation-mbert-safeguard

​moderation-mbert-hybrid

​moderation-mbert-remote

​moderations-oai-api

​moderation-perspective-api

​moderation-prompt-engineering

​moderation-flashtext

​stereotype-eeoc-fast

​stereotype-eeoc-safeguard

​stereotype-eeoc-hybrid

​stereotype-eeoc-remote

​prompt-harmfulness-fast

​prompt-harmfulness-safeguard

​Privacy

​privacy-presidio

​detect-secrets

​Integrity

​hhem-hallucination

​fact-check-roberta

​hallucination-llm

​fact-check-llm

​Generic

​generic-llm

​policy-gpt-oss-safeguard

​Policy

​policy-sections

​Configuration Examples

​Local Model

​Automatic Inference Service

​Prompt Harmfulness

​Direct Policy Sections

​Sliding Window Behavior

Security

`prompt-injection-deberta-v3-base`

`prompt-injection-deberta-finetuned-11122024`

`prompt-injection-mbert`

`prompt-injection-mbert-safeguard`

`prompt-injection-mbert-hybrid`

`prompt-injection-mbert-remote`

`security-promptguard`

`security-llm`

`security-embeddings`

`jb-length-per-perplexity`

`jb-prefix-suffix-perplexity`

`encoding-heuristics`

Moderation

`moderation-deberta`

`moderation-mbert`

`moderation-mbert-safeguard`

`moderation-mbert-hybrid`

`moderation-mbert-remote`

`moderations-oai-api`

`moderation-perspective-api`

`moderation-prompt-engineering`

`moderation-flashtext`

`stereotype-eeoc-fast`

`stereotype-eeoc-safeguard`

`stereotype-eeoc-hybrid`

`stereotype-eeoc-remote`

`prompt-harmfulness-fast`

`prompt-harmfulness-safeguard`

Privacy

`privacy-presidio`

`detect-secrets`

Integrity

`hhem-hallucination`

`fact-check-roberta`

`hallucination-llm`

`fact-check-llm`

Generic

`generic-llm`

`policy-gpt-oss-safeguard`

Policy

`policy-sections`

Configuration Examples

Local Model

Automatic Inference Service

Prompt Harmfulness

Direct Policy Sections

Sliding Window Behavior