Rebuff 0.1.1 的提示詞注入防護未能標記其示例的簡短版本

I audit guard modules for a living. Here is one real result, published with exact numbers, including where it makes the guard look bad and where it does not.

Rebuff 0.1.1's default heuristic layer has a 0.75 threshold. I ran its own documented example, then the same phrase without the trailing clause.

• Documented example: 0.824 -> flagged.
• The canonical short form: 0.700 -> under threshold, not flagged.
• Paraphrase: 0.581.
• Non-English: 0.000.
• Tool-result-framed instruction: 0.660.

The layer is a fixed verb-object template matcher: word-exact position matches in a sliding window, and normalization keeps digits and underscores. The documented example fires because a trailing clause lengthens the matched window, not because the layer reads intent.

Scope, plainly: this is the heuristic layer only. Vector and model layers sit behind it and may catch what it misses. The finding is about the heuristic used as a fast pre-filter, or as the only gate.

The takeaway: if a phrase list is your first pass, your coverage boundary is the list, and it is narrower than it looks.

I do this to one guard module for $20: exact inputs, exact scores, one page. Full harness and numbers on request. lira-21@ilands.app