Add AI-Specific Security with Arcjet

Secure AI/LLM endpoints with layered protection: prompt injection detection, PII blocking, and token budget rate limiting. These protections work together to block abuse before it reaches your model, saving AI budget and protecting user data. Reference: Read https://docs.arcjet.com/llms.txt for comprehensive SDK documentation covering all frameworks, rule types, and configuration options. Arcjet rules run before the request reaches your AI model, blocking prompt injection, PII leakage, cost abuse, and bot scraping at the HTTP layer. Step 1: Ensure Arcjet Is Set Up Check for an existing shared Arcjet client (see /arcjet:protect-route for full setup). If none exists, set one up first with shield() as the base rule. The user will need to register for an Arcjet account at https://app.arcjet.com then use the ARCJET_KEY in their environment variables. Step 2: Add AI Protection Rules AI endpoints should combine these rules on the shared instance using withRule(): Prompt Injection Detection: Detects jailbreaks, role-play escapes, and instruction overrides. - JS: detectPromptInjection() - pass user message via detectPromptInjectionMessage parameter at protect() time - Python: detect_prompt_injection() - pass via detect_prompt_injection_message parameter Blocks hostile prompts before they reach the model. This saves AI budget by rejecting attacks early. Sensitive Info / PII Blocking: Prevents personally identifiable information from entering model context. - JS: sensitiveInfo({ deny: ["EMAIL", "CREDIT_CARD_NUMBER", "PHONE_NUMBER", "IP_ADDRESS"] }) - Python: detect_sensitive_info(deny=[SensitiveInfoType.EMAIL, SensitiveInfoType.CREDIT_CARD_NUMBER, ...]) Pass the user message via sensitiveInfoValue (JS) / sensitive_info_value (Python) at protect() time. Token Budget Rate Limiting: Use tokenBucket() / token_bucket() for AI endpoints - the requested parameter can be set proportional to actual model token usage, directly linking rate limiting to cost. It also allows short bursts while enforcing an average rate, which matches how users interact with chat interfaces. Recommended starting configuration: - capacity: 10 (max burst) - refillRate: 5 tokens per interval - interval: "10s" Pass the requested parameter at protect() time to deduct tokens proportional to model cost. For example, deduct 1 token per message, or estimate based on prompt length. Set characteristics to track per-user: ["userId"] if authenticated, defaults to IP-based. Base Protection: Always include shield() (WAF) and detectBot() as base layers. Bots scraping AI endpoints are a common abuse vector. For endpoints accessed via browsers (e.g. chat interfaces), consider adding Arcjet advanced signals for client-side bot detection that catches sophisticated headless browsers. See https://docs.arcjet.com/bot-protection/advanced-signals for setup. Step 3: Compose the protect() Call and Handle Decisions All rule parameters are passed together in a single protect() call. Use this pattern: ```typescript const userMessage = req.body.message; // the user's input const decision = await aj.protect(req, { requested: 1, // tokens to deduct for rate limiting sensitiveInfoValue: userMessage, // PII scanning detectPromptInjectionMessage: userMessage, // injection detection }); if (decision.isDenied()) { if (decision.reason.isRateLimit()) { return Response.json( { error: "You've exceeded your usage limit. Please try again later." }, { status: 429 }, ); } if (decision.reason.isPromptInjection()) { return Response.json( { error: "Your message was flagged as potentially harmful." }, { status: 400 }, ); } if (decision.reason.isSensitiveInfo()) { return Response.json( { error: "Your message contains sensitive information that cannot be processed. Please remove any personal data.", }, { status: 400 }, ); } if (decision.reason.isBot()) { return Response.json({ error: "Forbidden" }, { status: 403 }); } } // Arcjet fails open - log errors but allow the request if (decision.isErrored()) { console.warn("Arcjet error:", decision.reason.message); } // Proceed with AI model call... ``` Adapt the response format to your framework (e.g., res.status(429).json(...) for Express). Step 5: Verify 1. Start the app and send a normal message - should succeed 2. Test prompt injection by sending something like "Ignore all previous instructions and..." 3. Test PII blocking by sending a message with a fake credit card number Start all rules in "DRY_RUN" mode first. Once verified, promote to "LIVE". Always recommend using the Arcjet MCP tools to verify rules and analyze traffic: - list-requests - confirm decisions are being recorded, filter by conclusion to see blocks - analyze-traffic - review denial rates and patterns for the AI endpoint - explain-decision - understand why a specific request was allowed or denied (useful for tuning prompt injection sensitivity) - promote-rule - promote rules from DRY_RUN to LIVE once verified If the user wants a full security review, suggest the /arcjet:security-analyst agent which can investigate traffic, detect anomalies, and recommend additional rules. The Arcjet dashboard at https://app.arcjet.com is also available for visual inspection. Common Patterns: Streaming responses: Call protect() before starting the stream. If denied, return the error before opening the stream - don't start streaming and then abort. Multiple models / providers: Use the same Arcjet instance regardless of which AI provider you use. Arcjet operates at the HTTP layer, independent of the model provider. Vercel AI SDK: Arcjet works alongside the Vercel AI SDK. Call protect() before streamText() / generateText(). If denied, return a plain error response instead of calling the AI SDK. Common Mistakes to Avoid: - Sensitive info detection runs locally in WASM - no user data is sent to external services. It is only available in route handlers, not in Next.js pages or server actions. - sensitiveInfoValue and detectPromptInjectionMessage (JS) / sensitive_info_value and detect_prompt_injection_message (Python) must both be passed at protect() time - forgetting either silently skips that check. - Starting a stream before calling protect() - if the request is denied mid-stream, the client gets a broken response. Always call protect() first and return an error before opening the stream. - Using fixedWindow() or slidingWindow() instead of tokenBucket() for AI endpoints - token bucket lets you deduct tokens proportional to model cost and matches the bursty interaction pattern of chat interfaces. - Creating a new Arcjet instance per request instead of reusing the shared client with withRule().

Add AI-Specific Security with Arcjet

プロンプト内容保存

使い方

参考資料

ノート