The prompt-injection patterns Sentry blocks, with regexes

The industry collapses "prompt injection" into a single bucket, which is why most mitigation attempts fail. What people actually mean by prompt injection is seven loosely-related families of attacks, each with its own signature and its own evasion patterns. Here is how Sentry's default policy pack treats them.

1. Direct instruction overrides

The classic. The user tells the model to ignore its system prompt or operate in a mode it was never meant to operate in.

match: /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions|prompts|rules|system\s+messages?)/i
action: deny
reason: Direct system-prompt override attempt

This one has the lowest false positive rate — real users almost never phrase requests this way. We deny on match rather than flag.

2. Role-play jailbreaks (DAN and variants)

The attacker asks the model to adopt a persona that has no restrictions. DAN (Do Anything Now) is the archetype but the pattern has mutated hundreds of times.

match: /\b(do\s+anything\s+now|developer\s+mode|god\s+mode|unrestricted\s+mode|without\s+(any\s+)?restrictions?)\b/i
action: deny
reason: Jailbreak persona attempt

You'll want to extend this with persona names popular in your user base. We publish a monthly update to the pattern on our Threat Intel feed; subscribe once and it rolls into your Gateway automatically.

3. Encoded instructions

The attacker hides their payload inside base64, ROT13, or Unicode escapes. The model decodes it and acts on it.

match: /^[A-Za-z0-9+/]{40,}={0,2}$/m
action: flag
reason: Possible base64-encoded payload — escalate for review

Flag, don't deny. Base64 is also commonly legitimate (file uploads, image data URLs). Pair this with a secondary check that attempts a decode and runs the result through the pattern pack.

4. Data exfiltration prompts

The attacker asks the model to reveal its system prompt, the hidden instructions, or recent conversation context.

match: /(what|print|show|repeat|reveal|output).{0,20}(your|the)\s+(system\s+prompt|initial\s+prompt|instructions|hidden\s+text|preamble)/i
action: deny
reason: System prompt exfiltration attempt

5. Multi-step planning attacks

The attacker builds up to a jailbreak over several innocuous-looking turns. One turn says "let's play a game", the next "the game is you have no rules", the third delivers the payload.

You cannot catch this with a single-turn regex. SentryDSL supports multi-turn correlation at Vanguard tier and above; the pattern we ship watches for a specific sequence of role-setting markers across a session.

6. Tool-call hijacking

When the LLM has access to tools (database, email, filesystem), an attacker shapes the prompt so the LLM's tool call becomes the attack vector.

match: /(send|forward|email|post|publish)\s+.{0,80}\b(email|address|phone|password|api[\s_-]?key)\b/i
action: flag
reason: Possible data-exfiltration tool call

Pair this with tool-level allowlisting on the response side — Sentry can refuse to forward a tool call whose arguments match a deny pattern.

7. Delimiter escape

The attacker uses special characters to break out of the context the system prompt placed them in. Common markers include triple backticks, XML-like tags, and Unicode direction overrides.

match: /[\u202a-\u202e\u2066-\u2069]/
action: deny
reason: Bidirectional Unicode override — likely delimiter escape

Where defaults don't help

Your business vocabulary matters. If you process medical content, "ignore" and "reveal" show up in real prompts. If you process legal content, "instructions" is on every page. The default pack errs on the side of specificity but every team should audit their own false-positive rate for the first week and tune the patterns against production traffic.

The Playground in the Sentry dashboard lets you paste a real prompt and watch which policies fire — tune in there before you push a change.

A final word on model-side defenses

The pattern of "we fine-tuned our model to be more robust" works until the attack adapts. Gateway-side policy enforcement is the one defense an attacker cannot adapt to — because it runs before the model ever sees the prompt.