Crate zeph_sanitizer 

Untrusted content isolation: sanitization pipeline and spotlighting.

All content entering the agent context from external sources must pass through ContentSanitizer::sanitize] before being pushed into the message history. The sanitizer truncates, strips control characters, detects injection patterns, and wraps content in spotlighting delimiters that signal to the LLM that the enclosed text is data to analyze, not instructions to follow.

Architecture

The crate exposes a layered defense-in-depth pipeline:

Layer	Type	Description
1	ContentSanitizer	Regex-based injection detection + spotlighting
2	pii::PiiFilter	Regex PII scrubber (email, phone, SSN, credit card)
3	guardrail::GuardrailFilter	LLM-based pre-screener at the input boundary
4	quarantine::QuarantinedSummarizer	Isolated LLM fact extractor
5	response_verifier::ResponseVerifier	Post-LLM response scanner
6	exfiltration::ExfiltrationGuard	Outbound channel guards (markdown images, tool URLs)
7	memory_validation::MemoryWriteValidator	Structural write guards for the memory store
8	causal_ipi::TurnCausalAnalyzer	Behavioral deviation detection at tool-return boundaries
9	nli::NliSanitizer	Probabilistic NLI entailment check for injected instructions
10	secret_mask::SecretMaskRegistry	Vault-secret placeholder masking at the LLM boundary

Quick Start

use zeph_sanitizer::{ContentSanitizer, ContentSource, ContentSourceKind};
use zeph_config::ContentIsolationConfig;

let config = ContentIsolationConfig::default();
let sanitizer = ContentSanitizer::new(&config);

let source = ContentSource::new(ContentSourceKind::WebScrape);
let result = sanitizer.sanitize("Hello world", source);

// result.body contains the spotlighted content ready for LLM context
assert!(!result.body.is_empty());
assert!(result.injection_flags.is_empty());
assert!(!result.was_truncated);

Security Model

Content is classified into trust tiers via ContentTrustLevel:

• ContentTrustLevel::Trusted — passes through unchanged (system prompt, user input).
• ContentTrustLevel::LocalUntrusted — tool results from local executors. Wrapped in <tool-output> with a NOTE header.
• ContentTrustLevel::ExternalUntrusted — web scrapes, MCP, A2A, memory retrieval. Wrapped in <external-data> with an IMPORTANT warning and strongest injection scrutiny.

Feature Flags

• classifiers (optional): enables ML-backed injection detection via ContentSanitizer::classify_injection] and NER-based PII detection via ContentSanitizer::detect_pii]. Requires an attached classifier backend. See ContentSanitizer::with_classifier] and ContentSanitizer::with_pii_detector].

Re-exports

pub use ipi_filter::IpiFilter;

pub use ipi_filter::IpiVerdict;

pub use nli::NliSanitizer;

pub use nli::NliVerdict;

pub use secret_mask::SecretCategory;

pub use secret_mask::SecretMaskRegistry;

pub use secret_shape::scrub_secret_shapes;

pub use shadow_memory::GoalDriftResult;

pub use shadow_memory::ShadowEvent;

pub use shadow_memory::ShadowMemory;

pub use shadow_memory::classify_tool_permission;

pub use types::ContentSource;

pub use types::ContentSourceKind;

pub use types::ContentTrustLevel;

pub use types::InjectionFlag;

pub use types::MemorySourceHint;

pub use types::SanitizedContent;

Modules

audit

Audit signal types emitted by sanitizer subsystems for trajectory-level accumulation.

causal_ipi

Temporal causal IPI (Indirect Prompt Injection) analysis at tool-return boundaries.

exfiltration

Exfiltration guards: prevent LLM-generated content from leaking data via outbound channels (markdown images, tool URL injection, poisoned memory writes).

guardrail

LLM-based prompt injection pre-screener (guardrail).

ipi_filter

Indirect Prompt Injection (IPI) filter for web-scraped content.

memory_validation

Memory write validation: structural checks before content reaches the memory store or the graph extractor.

nli

SONAR NLI-based injection detection stage.

pii

PII filter: regex-based scrubber for email, phone, SSN, credit card numbers, and (opt-in) a capitalized-word-sequence personal-name heuristic.

quarantine

Quarantine summarizer: routes untrusted content through an isolated LLM that extracts only verifiable facts before the content enters the main agent context.

response_verifier

Post-LLM response verification for prompt injection detection.

secret_mask

PAAC typed-placeholder secret masking registry.

secret_shape

Shape-based secret detection: redacts strings that look like a secret (known API-key prefix, Authorization: Bearer header, standalone JWT) regardless of whether the value was ever registered with a crate::secret_mask::SecretMaskRegistry.

shadow_memory

Per-session append-only event store for cross-turn trajectory analysis.

types

Core types for the sanitization pipeline: trust model, content provenance, and results.

Structs

ContentIsolationConfig

Configuration for the content isolation pipeline, nested under [security.content_isolation] in the agent config file.

ContentSanitizer

Stateless pipeline that sanitizes untrusted content before it enters the LLM context.

McpMediaConfig

Global caps enforced by MediaSanitizer (zeph-sanitizer) on every MCP-sourced image, for servers with media_passthrough = true (spec-072 §3.4).

MediaSanitizer

Validates and decodes MCP-sourced images before they are attached to an LLM request.

NliConfig

Configuration for the SONAR NLI sanitization stage, nested under [security.content_isolation.nli] in the agent config file.

QuarantineConfig

Configuration for the quarantine summarizer, nested under [security.content_isolation.quarantine] in the agent config file.

Enums

MediaRejected

Reason an MCP-sourced image was rejected by MediaSanitizer::sanitize_image.