← Safety

RebuffRebuff

Protect AI

开源Open source 混合Hybrid partial lifecycle: archived 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

当日未取到官方正文：docs.rebuff.ai 与 playground.rebuff.ai 均无响应，只读到仓库内 docs 目录的文件名
除 OpenAI 之外的 LLM 提供方是否可用
启发式层的具体规则集与可定制范围（官方路线图把「User Defined Detection Strategies」留在未完成）
向量库容量、保留时长与清理机制
数据处理与隐私条款、是否有遥测
Python SDK 与 TS SDK 的实际能力差距（README 与官方 tests 徽章显示两套测试，未逐条核验）
大陆直连与备案状态（cn 块记为 unknown）

No official body text obtained on the day: docs.rebuff.ai and playground.rebuff.ai both returned no response, only the filenames inside the repository's docs directory were readable
Whether LLM providers other than OpenAI can be used
The concrete heuristic rule set and how far it can be customised ("User Defined Detection Strategies" is still unchecked on the official roadmap)
Vector-store capacity, retention period and cleanup mechanism
Data-processing and privacy terms, and whether any telemetry exists
The real capability gap between the Python SDK and the TS SDK (badges show two test suites; not verified item by item)
Mainland direct reachability and filing status (recorded as unknown in the cn block)

Protect AI 开源的「自硬化」提示注入检测器：启发式 + 专用 LLM 判定 + 历史攻击向量库 + canary 词泄漏回检四层叠在一起，泄漏一次就把那次的 embedding 存下来用于下次识别。它是嵌在你应用里的 SDK 与可自托管的服务，不是替你运行模型的网关。

适合与不适合When to use it, when not to

适合给自己产品的输入加一层注入告警、并顺手做泄漏自检的团队，也适合把攻击样本累积成向量库做研究复现。不适合需要维护承诺与合规条款的生产链路（仓库已归档），也不适合必须完全离线的部署—— 官方路线图的 Local-only mode 至今未勾选，README 的 SDK 初始化就要 OpenAI 与 Pinecone 凭据。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　Protect AI（GitHub 组织 Protect AI，主体为美国公司），非国产产品。Protect AI (GitHub organisation "Protect AI", a US-based company); not a domestic product.
国内使用Direct access: 直连未核验direct unknown　当日核验了 GitHub 与 PyPI 在通用网络下的可达性；docs 域名无响应，未做大陆直连实测。GitHub and PyPI reachability were checked on the general network today; the docs domain returned no response. No mainland direct-access test was run.
备案状态CAC filing: 备案未核验filing unknown：当日未检索网信办公示名单，无官方依据判定备案状态；该产品不面向大陆公众提供服务。The CAC public registry was not searched on the verification day, so filing status has no official basis; the product does not serve the mainland public.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 官方 README 的四层里有一层就是「用一个专用 LLM 分析进来的 prompt」，因此模型是显式配置项： RebuffSdk(openai_apikey, pinecone_apikey, pinecone_index, openai_model)，其中 openai_model 可选、默认 gpt-3.5-turbo。向量侧官方给的是 Pinecone，自托管段落允许换成 Chroma。除 OpenAI 之外的 LLM 提供方官方未说明。
One of the four layers the README declares is literally "use a dedicated LLM to analyse incoming prompts", so the model is an explicit configuration item: RebuffSdk(openai_apikey, pinecone_apikey, pinecone_index, openai_model), where openai_model is optional and defaults to gpt-3.5-turbo. On the vector side the official text gives Pinecone, with Chroma allowed in the self-hosting section. LLM providers other than OpenAI are not stated officially.
运行位置Where it runs: 两条路径都在你侧：pip install rebuff 的 SDK 跑在你自己的应用进程里；自托管 Playground/API server 是 Node 应用，按 README 在 server/ 目录 npm install 后 npm run dev，起在 http://localhost:3000，并需要先把 SQL 库与向量库按 Supabase / Pinecone 搭起来。官方 hosted playground 域名当日未取到正文。
Both paths sit on your side: the pip install rebuff SDK runs inside your application process, and the self-hosted Playground/API server is a Node app — the README has you work in server/, run npm install then npm run dev, and it comes up at http://localhost:3000, after you stand up the SQL and vector databases via Supabase / Pinecone. No official text was reachable today for the hosted playground domain.
本地文件Local files: 官方正文的处理对象始终是 prompt 文本与 completion 文本，未声明读取工作区文件、目录或附件的能力。自托管时它需要的是数据库与向量库连接，而不是对你仓库的访问——文件级能力官方未说明。
The object of processing in the official text is always prompt text and completion text; no ability to read workspace files, directories or attachments is declared. What the self-hosted form needs is database and vector-store connectivity rather than access to your repository. File-level capability is not stated officially.
关机后的任务Tasks after shutdown: SDK 形态随宿主应用进程生死；自托管 server 形态是常驻服务（带 Supabase 与向量库）。官方未说明任务队列、定时复检或关机续跑类机制。
The SDK form lives and dies with the host application; the self-hosted server form is a resident service backed by Supabase and a vector database. Task queues, scheduled re-checks and continuation after shutdown are not stated officially.
工具与扩展Tools & extensions: 官方 README 声明的四层检测是 Heuristics、LLM-based detection、VectorDB、Canary tokens； SDK 面是 detect_injection、add_canary_word、is_canaryword_leaked 三个入口。官方路线图勾选了 JavaScript/TypeScript SDK，把「Python SDK 与 TS 对等」留在未完成项。MCP 或其他扩展接入方式官方未说明。
The four declared layers are Heuristics, LLM-based detection, VectorDB and Canary tokens; the SDK surface is three entry points — detect_injection, add_canary_word, is_canaryword_leaked. The official roadmap checks off the JavaScript/TypeScript SDK and leaves "Python SDK parity" unchecked. MCP or other extension points are not stated officially.
上下文与记忆Context & memory: 它的「记忆」就是向量库：官方描述为把历史攻击的 embedding 存进 VectorDB 以识别相似攻击，并在 canary 泄漏时把该输入 prompt 的 embedding 写回，形成 attack signature learning。库容量、保留时长与清理策略官方未说明。
Its "memory" is the vector store: the official description is embedding previous attacks in the VectorDB to recognise similar ones, and when a canary leaks, writing the embedding of that input prompt back — the roadmap calls this attack signature learning. Store capacity, retention period and cleanup policy are not stated officially.
权限与限制Permissions & limits: 许可 Apache-2.0（见 license 字段）。数据流向由配置决定：官方示例要求传入 OpenAI 与 Pinecone 凭据，即被检测文本会交给所配置的外部服务；官方正文当日未给出隐私或数据处理条款。自托管环境变量清单里另有 MASTER_API_KEY、MASTER_CREDIT_AMOUNT、BILLING_RATE_INT_10K，说明 server 侧自带额度与按请求扣减的概念（README 给出该整数的换算口径，本站不展开数字）。合规认证与训练用途官方未说明。
Licensed Apache-2.0 (see the license field). Data flow is determined by configuration: the official example requires an OpenAI key and a Pinecone key, meaning the text under inspection is handed to the external services you configure; no privacy or data-processing terms were found in the official text reached today. The self-hosting environment list also includes MASTER_API_KEY, MASTER_CREDIT_AMOUNT and BILLING_RATE_INT_10K, i.e. the server ships with a credit and per-request deduction concept (the README states an integer conversion rule for it). Compliance certifications and training use are not stated officially.
适合什么任务Best for: 适合在自家应用里加一层提示注入告警与 canary 泄漏自检、并把攻击样本沉淀成向量的研究与工程试验。不适合需要维护承诺、需要明确数据处理条款、或需要完全离线运行的场景：仓库已归档，且「Local-only mode」在官方路线图里仍是未完成项。
Fits research and engineering experiments that add an injection alert plus canary-leak self-check inside your own app and accumulate attack samples in a vector store. Does not fit production pipelines that need a maintenance commitment or explicit data-processing terms — the repository is archived — nor fully offline deployments: "Local-only mode" is still an unchecked roadmap item and the documented SDK needs OpenAI and Pinecone credentials.

头号误解Top misconception

把四层防御理解成保障承诺：README 的 Disclaimer 自述仍是原型，不能提供完全防护
以为可以纯本地跑：Local-only mode 至今是官方路线图未勾选项，检测层默认要外部 LLM
以为 Python SDK 与 TS SDK 对等：官方路线图把 Python 对等项列为未完成

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
changelog	Rebuff · 仓库提交历史（最后提交 2024-01-25；无独立 changelog 页）Rebuff · repository commit history (last commit 2024-01-25; no standalone changelog page)	https://github.com/protectai/rebuff/commits/main
changelog	PyPI · rebuff（0.1.1，2024-01-20 发布；发布记录充当变更记录）PyPI · rebuff (0.1.1, released 2024-01-20; release records stand in for a changelog)	https://pypi.org/project/rebuff/
repo	Rebuff · 仓库 README（四层检测、SDK 用法与自托管配置）Rebuff · repository README (four detection layers, SDK usage and self-hosting configuration)	https://github.com/protectai/rebuff
docs	Rebuff · 仓库 docs 目录（how-it-works / quickstart / self-hosting）Rebuff · repository docs directory (how-it-works / quickstart / self-hosting)	https://github.com/protectai/rebuff/tree/main/docs
docs	Rebuff · 官方 LICENSE（Apache-2.0 全文）Rebuff · official LICENSE (full Apache-2.0 text)	https://github.com/protectai/rebuff/blob/main/LICENSE

官方口径与未核到项Official record and unverified items

本站未做端到端实测：没有安装 SDK、没有起过自托管 server、也没有构造过 canary 泄漏样例。本页结论只来自官方 README、LICENSE、仓库 docs 目录清单与 PyPI / GitHub 元数据（2026-11-06 抓取）；官方文档站域名当日无响应，故 docs.rebuff.ai 的正文未纳入。

This site has not run end-to-end tests: the SDK was not installed, the self-hosted server was not started, and no canary-leak sample was constructed. Conclusions come only from the official README, the LICENSE, the file listing of the repository's docs directory and PyPI / GitHub metadata (all 2026-11-06). The documentation-site domain returned no response that day, so docs.rebuff.ai content is not included.

官方声明的能力面Capability surface as declared officially

README（2026-11-06 抓取）对四层的原样表述：Heuristics 在输入到达 LLM 前过滤可疑内容； LLM-based detection 用专用 LLM 分析 prompt 并识别攻击；VectorDB 存历史攻击 embedding 以拦相似攻击； Canary tokens 在 prompt 里加令牌以检测泄漏，并据此刻录本次输入的 embedding 防未来攻击。

Disclaimer 原文：

Rebuff is still a prototype and cannot provide 100% protection against prompt injection attacks!

这句话是选型的第一读项：它是官方对自己能力边界的定性，本站不引任何检出或绕过数字。

The README (fetched 2026-11-06) describes the four layers as: Heuristics filter suspicious input before it reaches the LLM; LLM-based detection uses a dedicated LLM to analyse prompts and identify possible attacks; VectorDB stores embeddings of previous attacks to block similar ones; Canary tokens are added to prompts to detect leakage, which lets the framework store the embedding of the incoming prompt and prevent future attacks.

The Disclaimer, original wording:

Rebuff is still a prototype and cannot provide 100% protection against prompt injection attacks!

This sentence is the first thing to read when choosing: it is the vendor's own qualitative statement about its capability boundary. This site quotes no detection or bypass figures.

部署前提（官方自托管口径）Deployment prerequisites (official self-hosting terms)

README 的自托管一节要求先备齐 Supabase、OpenAI 与向量库（Pinecone，或按文档换 Chroma），再在 server/ 目录准备 .env.local，其中包含 OPENAI_API_KEY、MASTER_API_KEY、BILLING_RATE_INT_10K、 MASTER_CREDIT_AMOUNT、Supabase anon key 与 URL、Pinecone key / environment / index name、 SUPABASE_SERVICE_KEY 与 REBUFF_API，之后 npm install 与 npm run dev，服务落在 http://localhost:3000。其中 BILLING_RATE_INT_10K 的官方解释是每请求扣减的额度单位，README 另行给出该整数的换算口径（本站不展开数字）。

The self-hosting section requires Supabase, OpenAI and a vector database (Pinecone, or Chroma per the docs) set up first; then a .env.local in server/ carrying OPENAI_API_KEY, MASTER_API_KEY, BILLING_RATE_INT_10K, MASTER_CREDIT_AMOUNT, the Supabase anon key and URL, the Pinecone key / environment / index name, SUPABASE_SERVICE_KEY and REBUFF_API; afterwards npm install and npm run dev, which serves at http://localhost:3000. The README explains BILLING_RATE_INT_10K as the credit amount deducted per request and states an integer conversion rule for it; this site does not carry the figure.

归档状态Archive status

仓库 archived 标志为真；最后提交 2024-01-25，最后推送 2024-08-07，PyPI 版本停在 0.1.1（2024-01-20）。据此 lifecycle 记 archived、confidence 上限 partial：本页描述的是它定格时的能力面，不代表当前可用状态。

The repository's archived flag is true; the last commit is 2024-01-25, the last push 2024-08-07, and PyPI stops at 0.1.1 (2024-01-20). The entry therefore records lifecycle archived with confidence capped at partial: what is described here is the capability surface as it froze, not a statement that it currently works.