Rust firewall scans LLM prompts for injection and PII in a claimed 12 microseconds

A local guard for every prompt

A developer posting as tim860 on dev.to has released promptfirewall, an open-source Rust library that screens LLM prompts for both sensitive data and injection attacks before they reach a model provider. According to the post, a combined scan covering eight types of personally identifiable information plus injection analysis finishes in roughly 11.9 microseconds, runs entirely locally with two dependencies, and makes no network calls.

The library targets the two failure modes the author sees in every LLM application: users pasting SSNs, card numbers or API keys into prompts that then travel to OpenAI, Anthropic or Google, and attackers embedding lines like "ignore previous instructions" that steer agents off course. Existing tools, the post argues, are slow or heavy: Microsoft Presidio is quoted at around 200 ms per scan, LLM Guard at around 300 ms with 47 or more Python dependencies including PyTorch, and Lakera is a paid cloud API that requires data to leave your infrastructure. These comparison figures are the author's own, not independent results.

Detection without machine learning

PII detection deliberately skips named entity recognition. Identifiers — SSNs, credit cards, IBANs, emails, phone numbers, IPs, AWS keys and generic API keys — are matched with regexes, then filtered through structural checks: card numbers must pass the Luhn test, IBANs must satisfy the ISO 7064 mod-97-10 checksum, and SSNs are rejected when the area code is 000, 666 or in the 900-plus range. The rationale is that for redaction, false positives are worse than misses, because over-redaction erodes trust in the pipeline.

Injection detection stacks three layers. The first is a bank of more than 35 weighted regex patterns grouped by attack category — instruction override, role hijacking, system prompt extraction, fake system tokens such as <|im_start|>, jailbreak keywords, base64 decoding requests, delimiter confusion and structured injection. The second is a TF-IDF classifier over a 50-term vocabulary with inverse document frequency weights manually curated from the deepset/prompt-injections dataset, scoring cosine similarity against a pre-computed centroid of injection language. The third applies Shannon entropy over 64-character sliding windows to catch encoded payloads, measures the non-ASCII character ratio to flag homoglyph attacks built on Cyrillic lookalikes, and inspects nested JSON for injected role or system keys.

The layers are fused with a composite formula — the maximum of heuristic times 0.9, TF-IDF times 0.7 and entropy times 0.5 — with a 1.15 boost when at least two layers fire above 0.3, capped at 1.0. The default blocking threshold is 0.7 and is tunable per deployment.

Reported performance and bindings

The numbers come from criterion benchmarks in release mode on Apple M-series hardware, and the post invites reproduction via cargo bench. A PII-only scan finding an SSN and a card number took 952 nanoseconds; six PII types in 900 bytes took 10.3 microseconds; calls from Python via PyO3 cost about 2.2 microseconds each and from Node.js via napi-rs about 4 microseconds. From these the author derives speedups of roughly 15,000x over Presidio and 25,000x over LLM Guard. One caveat: the per-layer latencies quoted in the post — roughly 50 microseconds for heuristics, 200 for TF-IDF and 100 for entropy — add up to far more than the 11.9-microsecond end-to-end figure, and no third-party benchmarks exist yet, so the headline claim awaits independent reproduction.

Distribution covers the ecosystems where LLM applications actually run: the package installs from pip and npm as promptfirewall-rs, and from cargo as promptfirewall. The library ships FastAPI middleware that blocks unsafe POST, PUT and PATCH requests with a 400 response, plus an equivalent Express guard, and the scan function can redact matched identifiers with placeholders before text is forwarded. The project is dual-licensed MIT/Apache-2.0, with the repository published on GitHub under TimurRakhmatullin86.

Stated limitations

The author is unusually direct about trade-offs. PII recall covers only structured identifiers — there is no name or address detection, since NER is estimated to add 10 to 100 ms of latency. The heuristic-plus-TF-IDF stack is estimated to catch 80 to 90 percent of known injection patterns, below what a fine-tuned transformer achieves, at a fraction of the latency. GPU acceleration is absent by design, because the goal is zero infrastructure requirements.

Why it matters

Most prompt-injection defences live in cloud APIs or heavyweight ML pipelines, which confines them to the edges of a system where latency is easy to absorb. A scanner this cheap changes where filtering can sit: inline on every user message, retrieved document and tool output inside an agent loop, rather than sampled at the perimeter. Local execution also means credentials can be redacted before data leaves the organisation, a relevant property for GDPR-constrained deployments. The candid limitation list is a signal in itself: a deterministic, checksum-validated filter is a complement to, not a replacement for, model-based detection — and the architectural claim is now public for others to benchmark.