{"data":{"slug":"liu00222-open-prompt-injection","name":"Open-Prompt-Injection","tagline":"Benchmark and toolkit for prompt injection attacks and defenses in LLMs","github_url":"https://github.com/liu00222/Open-Prompt-Injection","owner":"liu00222","repo":"Open-Prompt-Injection","owner_avatar_url":"https://avatars.githubusercontent.com/u/42081599?v=4","primary_language":"Python","stars":503,"forks":81,"topics":["llm","llm-security","llms","prompt-injection","prompt-injection-tool","security-and-privacy"],"archived":false,"github_pushed_at":"2026-09-27T14:35:14+00:00","maintenance_label":"Very active","stars_delta_30d":33,"url":"https://www.graphcanon.com/tools/liu00222-open-prompt-injection","markdown_url":"https://www.graphcanon.com/tools/liu00222-open-prompt-injection.md","api_url":"https://www.graphcanon.com/api/graphcanon/tools/liu00222-open-prompt-injection","graph_url":"https://www.graphcanon.com/api/graphcanon/graph?tool=liu00222-open-prompt-injection","description":"This repository provides a benchmark for prompt injection attacks and defenses in LLMs","homepage_url":null,"license":"MIT","open_issues":2,"watchers":3,"ai_summary":"Open-Prompt-Injection offers an open-source suite for implementing, evaluating, and extending prompt injection attacks, defense mechanisms, and integrating them into applications and agents.","readme_excerpt":"# Open-Prompt-Injection\n\n\n## Introduction\n\nThis repository is an open-source toolkit for prompt injection attacks and defenses. It enables implementation, evaluation, and extension of attacks, defenses, and LLM-integrated applications and agents. For a deeper dive into prompt injection, see [these slides](https://people.duke.edu/~zg70/code/PromptInjection.pdf), an extended version of a presentation given at the Safer with Google Summit 2025. \n\n\n\n## Required Python packages\n\nPre-requisite: [conda](https://www.anaconda.com/docs/getting-started/miniconda/install)\n\nInstall the environment using the following command: \n\n```\nconda env create -f environment.yml --name my_custom_env\n```\n\nThen activate the environment:\n\n```\nconda activate my_custom_env\n```\n\n## Usage\n\n### A simple demo\n\nBefore you start, go to './configs/model\\_configs/palm2\\_config.json' and replace the API keys with your real keys. Please refer to Google's official site for how to obtain an API key for PaLM2. For Meta's Llama models and OpenAI's GPT models, please also refer to their websites for registration details. \n\nThe following code snippet creates a model and queries the model with the prompt \"Write a poem about monkeys\":\n\n```python\nimport OpenPromptInjection as PI\nfrom OpenPromptInjection.utils import open_config\n\nmodel_config_path = './configs/model_configs/palm2_config.json'\nmodel_config = open_config(config_path=model_config_path)\nmodel = PI.create_model(config=model_config)\nmodel.print_model_info()\n\nmsg = \"Write a poem about monkeys\"\nprint(model.query(msg))\n```\n\n### Combined attack\n\nThe following code snippet evaluates the ASV of the scenario where the target task is sentiment analysis (i.e., the target data is sst2), the injected task is spam detection (i.e., the injected data is spam detection), the model is PaLM2, and no defense is applied:\n\n```python\nimport OpenPromptInjection as PI\nfrom OpenPromptInjection.utils import open_config\n\n# Create the target task\ntarget_task = PI.create_task(open_config(config_path='./configs/task_configs/sst2_config.json'), 100)\n\n# Create the model\nmodel_config = open_config(config_path='./configs/model_configs/palm2_config.json')\nmodel = PI.create_model(config=model_config)\n\n# Create the injected task\ninject_task = PI.create_task(open_config(config_path='./configs/task_configs/sms_spam_config.json'), 100, for_injection=True)\nattacker = PI.create_attacker('combine', inject_task)\n\n# Create the LLM-integrated App\ntarget_app = PI.create_app(target_task, model, defense='no')\n\n# Queries the model with the attacked data prompt and save the responses\nattack_responses = list()\nfor i, (data_prompt, ground_truth_label) in enumerate(target_app):\n    data_prompt_after_attack = attacker.inject(data_prompt, i, target_task=target_task.task)\n    response = target_app.query(data_prompt_after_attack, verbose=1, idx=i, total=len(target_app))\n    attack_responses.append(response)\n\n# Create an evaluator to calculate the ASV\nevaluator = PI.create_evaluator(\n    target_task_responses=None, \n    target_task=target_task,\n    injected_task_responses=None, \n    injected_task=attacker.task,\n    attack_responses=attack_responses\n)\n\nprint(f\"ASV = {evaluator.asv}\")\n```\n\nTo evaluate another defense (or attack strategy, target task, etc.), clients can change the config files and the path passed into the factory methods. \n\nTo run the experiments reported in the paper, please execute:\n\n```\npython3 run.py\n```\nThe experiment matrix is declared in `configs/experiment_matrix.json`. A different\nmatrix can be supplied with `--matrix-config`. Validate paths and print every\ncommand without starting model processes with:\n\n```\npython3 run.py --dry-run\n```\n\nBy default, a failed model query stops its experiment immediately. To retry each\nfailed query up to three times with exponential backoff, use:\n\n```\npython3 run.py --max-retries 3\n```\n\nThis script calls `main.py`, tracks each child process directly, and returns a\nnon-zero exit status if any experiment fails. Response","github_created_at":"2023-10-19T04:15:27+00:00","created_at":"2026-07-11T23:40:03.770177+00:00","updated_at":"2026-10-04T06:00:50.93836+00:00","categories":[{"slug":"evaluation-observability","name":"Evaluation & Observability","url":"https://www.graphcanon.com/categories/evaluation-observability","markdown_url":"https://www.graphcanon.com/categories/evaluation-observability.md","api_url":"https://www.graphcanon.com/api/graphcanon/categories/evaluation-observability"},{"slug":"llm-frameworks","name":"LLM Frameworks","url":"https://www.graphcanon.com/categories/llm-frameworks","markdown_url":"https://www.graphcanon.com/categories/llm-frameworks.md","api_url":"https://www.graphcanon.com/api/graphcanon/categories/llm-frameworks"}],"tags":[{"slug":"llm","name":"llm"},{"slug":"llm-security","name":"llm-security"},{"slug":"prompt-injection","name":"prompt-injection"},{"slug":"security-and-privacy","name":"security-and-privacy"}],"trust":{"provenance":{"is_fork":false,"github_id":707020503,"owner_type":"User","methodology":"github_public_v1","parent_repo":null,"near_duplicate_slugs":[]},"computed_at":"2026-10-04T06:00:50.201Z","maintenance":{"label":"Very active","score":96,"methodology":"github_public_v1","releases_90d":0,"days_since_push":6,"last_release_at":null,"stars_delta_30d":33,"open_issues_delta_30d":-12},"security_summary":{"status":"no_lockfile","scanner":null,"low_count":0,"high_count":0,"last_scan_at":"2026-07-11T23:40:05.376Z","medium_count":0,"scan_profile":"none","critical_count":0}},"capability_facts":{"scan":{"source":"repo_scan","observed_at":"2026-10-04T06:00:50.671Z"},"languages":{"value":["python"],"source":"github.language","observed_at":"2026-10-04T06:00:50.671Z"},"license_spdx":{"value":"MIT","source":"github.license","observed_at":"2026-10-04T06:00:50.671Z"}},"decision_facts":{"hosting":null,"pricing":null,"requirements":null,"constraints":null,"when_to_use":["You prioritize security testing specifically for prompt injection vulnerabilities in your LLM applications.","Your project involves evaluating or extending defense mechanisms against prompt injection."],"when_not_to_use":["You require broader, more generalized security features not centered on prompt injection attacks.","Your project does not involve working with Google PaLM2 or other specific models like Meta's Llama and OpenAI's GPT."],"source":"enrich:decision_facts","observed_at":"2026-07-17T01:19:24.493Z"},"constraint_facets":null,"decision_summary":[{"label":"Adopt for","value":"Open-Prompt-Injection is a Python-based toolkit for benchmarking prompt injection attacks on LLMs, offering customization through config files and support for various LLM APIs."}]}}