Prompt injection defence
LiveUser-pasted text is sanitised before reaching the LLM.
- ✓Thirteen injection patterns, graded medium, high and critical
- ✓High and critical spans are defanged in place and relabelled as quoted text, not an instruction
- ✓Control characters and zero-width and bidirectional Unicode stripped
- ✓Document content wrapped in explicit delimiters with an untrusted-content rule appended to the system prompt, on the paths that separate it out — the contract pipeline and the public scanner among them
What it is.
Prompt injection — where adversarial text in a document tries to hijack the AI ('ignore previous instructions and …') — is a real attack class. LexVio sanitises user-pasted text and uploaded document content through a hardened input layer before it reaches the LLM.
Document content is also clearly labelled to the model as 'untrusted input', so the model treats it as data, not instructions.
Three steps.
End to end.
Upload or paste. Text extraction kicks off.
Known injection patterns are neutralised. Suspicious patterns are flagged.
Document content is wrapped in clear delimiters and labelled as untrusted input. The model knows not to follow instructions inside it.
What you get.
- ✓Thirteen injection patterns, graded medium, high and critical
- ✓High and critical spans are defanged in place and relabelled as quoted text, not an instruction
- ✓Control characters and zero-width and bidirectional Unicode stripped
- ✓Document content wrapped in explicit delimiters with an untrusted-content rule appended to the system prompt, on the paths that separate it out — the contract pipeline and the public scanner among them
- ✓Detections recorded server-side for our own monitoring
Quick answers.
No defence is perfect, and this one has a limitation we will name: every pattern is English. An injection written in another language will not match them, though the delimiter-and-labelling layer still applies.
Yes, since October 2026. AI Administration › AI Security lists prompt-injection detections, blocked requests and refusals with a kind and a label. The prompt itself is never stored — only a fingerprint of it.
Sanitisation runs on user text on every call. The explicit untrusted-content wrapper applies where a caller separates document content from the instruction — the contract pipeline and the public scanner do; not every call site does.
More in AI Controls & Guardrails.
Every citation comes back with a verdict — verified, ambiguous or unresolved — and a match on title alone is never verified.
Each legal claim we hold about a jurisdiction is checked against that government's own legislation service — and where it cannot be, the answer is "unverified", not silence.
We do not train models on customer content. There is no opt-in, because there is no training programme.
A monthly AI token quota per plan, an 80% warning by email and in-app, and a hard stop at 100%.