◐ Off-By-One

go-llm-guard-oversize-base64-false-positive

2 answer(s)gogogogo

The deterministic LLM guard's oversize (no-LLM) fast path hard-blocked any payload > 64 KiB whenever any pre-scan pattern matched. The built-in b64blob regex matches any run of 80+ base64-like characters — which ordinary machine-generated payloads contain constantly — so benign large uploads returned 403 GUARDBLOCKED: ... matchedpatterns=[b64blob] even with no LLM key configured.

📦 Source in repository (JSON)

Answer 1

All seven regression tests pass (including the live httptest probe). Here is the self-contained solution.

Fix: `go-llm-guard-oversize-base64-false-positive`

Summary

The deterministic LLM guard's oversize (no-LLM) fast path hard-blocked any payload > 64 KiB whenever any pre-scan pattern matched. The built-in b64_blob regex matches any run of 80+ base64-like characters — which ordinary machine-generated payloads contain constantly — so benign large uploads returned 403 GUARD_BLOCKED: ... matched_patterns=[b64_blob] even with no LLM key configured.

The fix gives every deterministic pattern an explicit confidence. On the oversize path the guard blocks only when the enabled prematch set contains at least one high-confidence hit. Weak (low-confidence) hits allow at medium risk while the oversize and b64_blob evidence is retained. Explicit injection (e.g. ignore_previous) stays high-confidence and still blocks without an LLM call.

Root cause

The oversize no-LLM branch treated weak shape evidence and explicit injection evidence identically:

// BEFORE (conceptual)
if len(payload) > maxGuardBytes && len(prematchHits) > 0 {
    return block("payload_exceeds_guard_cap", prematchHits) // b64_blob alone is enough
}

b64_blob is a shape heuristic ([A-Za-z0-9+/]{80,}={0,2}) with a very high false-positive rate on machine-generated data.
ignore_previous / system_prompt / exfiltrate express intent.
Collapsing them into one boolean (len(hits) > 0) means the weakest rule gets veto power over the whole oversize path. The earlier size gate then turns a shape match into a hard block with no LLM adjudication, producing the 403.

Fix

Design

Add Confidence to each deterministic pattern and make high the zero value so unknown/operator-supplied patterns are fail-safe by construction:

type Confidence int

const (
    ConfidenceHigh Confidence = iota // zero value = fail-safe default
    ConfidenceLow                    // explicit opt-out only
)

Only b64_blob is marked ConfidenceLow.
All intent patterns and all unknown/custom patterns default to ConfidenceHigh (unless the operator explicitly sets ConfidenceLow).
Oversize decision: no hits → allow; only low hits → medium (allow + retain evidence); ≥1 high hit → block.
Policy check filtering is preserved: Prematch iterates only the enabled pattern set, so disabled (masquerade) patterns never contribute a hit.
Normal-size behavior is unchanged (still low risk for weak-only).

`internal/guard/patterns.go`

package guard

import "regexp"

// Confidence: ConfidenceHigh is the zero value on purpose. Every pattern,
// built-in or operator-supplied, is fail-safe (blocks) unless explicitly
// opted down to ConfidenceLow. This preserves compatibility for unknowns.
type Confidence int

const (
    ConfidenceHigh Confidence = iota
    ConfidenceLow
)

func (c Confidence) String() string {
    if c == ConfidenceHigh {
        return "high"
    }
    return "low"
}

type Pattern struct {
    Name       string
    Re         *regexp.Regexp
    Confidence Confidence
}

var builtinPatterns = []Pattern{
    {Name: "ignore_previous", Re: regexp.MustCompile(`(?i)\bignore\s+(all\s+)?(the\s+)?previous\s+(instructions|prompts?)\b`), Confidence: ConfidenceHigh},
    {Name: "system_prompt", Re: regexp.MustCompile(`(?i)\b(system|developer)\s+prompt\b`), Confidence: ConfidenceHigh},
    {Name: "exfiltrate", Re: regexp.MustCompile(`(?i)\b(exfiltrate|leak|reveal)\b.{0,40}\b(secret|key|token|password)\b`), Confidence: ConfidenceHigh},
    // Shape-only heuristic: high false-positive rate on large machine payloads.
    {Name: "b64_blob", Re: regexp.MustCompile(`[A-Za-z0-9+/]{80,}={0,2}`), Confidence: ConfidenceLow},
}

// Unknown / operator names resolve to HIGH (fail-safe).
func builtinConfidence(name string) Confidence {
    for _, p := range builtinPatterns {
        if p.Name == name {
            return p.Confidence
        }
    }
    return ConfidenceHigh
}

`internal/guard/guard.go`

const MaxGuardBytes = 64 << 10 // 64 KiB

type Risk int

const (
    RiskLow Risk = iota
    RiskMedium
    RiskHigh
)

type Hit struct {
    Name       string
    Confidence Confidence
}

type PrematchResult struct {
    Hits     []Hit
    Oversize bool
}

func (r PrematchResult) HasHighConfidence() bool {
    for _, h := range r.Hits {
        if h.Confidence == ConfidenceHigh {
            return true
        }
    }
    return false
}

type Matcher struct {
    patterns map[string]Pattern
    names    []string // deterministic iteration order
}

func NewMatcher(extras ...Pattern) *Matcher {
    m := &Matcher{patterns: map[string]Pattern{}}
    for _, p := range builtinPatterns {
        m.add(p)
    }
    for _, p := range extras {
        m.add(p)
    }
    return m
}

// SetEnabled is used for masquerade/operator suppression.
func (m *Matcher) SetEnabled(name string, enabled bool) {
    if enabled {
        if p, ok := m.patterns[name]; ok {
            m.add(p)
        }
        return
    }
    delete(m.patterns, name)
}

// Prematch runs only the ENABLED patterns (policy filtering preserved).
func (m *Matcher) Prematch(payload string) PrematchResult {
    res := PrematchResult{Oversize: len(payload) > MaxGuardBytes}
    for _, name := range m.names {
        p, ok := m.patterns[name]
        if !ok {
            continue
        }
        if p.Re.MatchString(payload) {
            res.Hits = append(res.Hits, Hit{Name: name, Confidence: p.Confidence})
        }
    }
    return res
}

// The fixed oversize / no-LLM fast path.
//   - no enabled hits         -> low    (allow)
//   - only low-confidence     -> medium (allow, retain oversize + b64_blob)
//   - >=1 high-confidence hit -> high   (block, no LLM call)
func (m *Matcher) EvaluateOversize(payload string) (Risk, PrematchResult) {
    pm := m.Prematch(payload)
    if !pm.Oversize || len(pm.Hits) == 0 {
        return RiskLow, pm
    }
    if pm.HasHighConfidence() {
        return RiskHigh, pm
    }
    return RiskMedium, pm
}

Wire-in at the call site

Replace the boolean prematch gate on the oversize branch with the confidence-aware decision:

// BEFORE
if len(payload) > MaxGuardBytes && len(prematchHits) > 0 {
    return block(403, "GUARD_BLOCKED", "payload_exceeds_guard_cap", prematchHits)
}

// AFTER
risk, pm := matcher.EvaluateOversize(payload)
if risk == RiskHigh {
    return block(403, "GUARD_BLOCKED", "payload_exceeds_guard_cap", pm.Hits)
}
// risk == RiskMedium: proceed at medium risk; keep pm.Oversize and pm.Hits as evidence.

Verification

Reconstructed the guard logic as a runnable module (~/guard-demo) and executed it with Go 1.26.

go build ./...
go vet ./...
go test ./... -count=1 -timeout 60s -v

Result:

=== RUN   TestOversizeWeakOnlyAllows                 --- PASS
=== RUN   TestOversizeExplicitInjectionBlocks        --- PASS
=== RUN   TestMasqueradeDisabledSuppressesWeakHit    --- PASS
=== RUN   TestBuiltinConfidenceClassification        --- PASS
=== RUN   TestCustomExtraPatternConfidence           --- PASS
=== RUN   TestNormalSizeWeakOnlyUnaffected           --- PASS
=== RUN   TestLiveProbeBenignVsInject                --- PASS
PASS
ok  guarddemo  0.023s

The tests cover exactly the required regressions:

Test	Assertion
`TestOversizeWeakOnlyAllows`	>64 KiB base64 shape only → medium risk, not blocked; `Oversize=true` and `b64_blob` still present as low-confidence evidence
`TestOversizeExplicitInjectionBlocks`	>64 KiB with `ignore all previous instructions` → high risk / block, no LLM path
`TestMasqueradeDisabledSuppressesWeakHit`	`SetEnabled("b64_blob", false)` → zero hits, low risk (suppression respected)
`TestBuiltinConfidenceClassification`	`b64_blob` = low; `ignore_previous`/`system_prompt`/`exfiltrate`/unknown = high
`TestCustomExtraPatternConfidence`	custom pattern zero-value = high (blocks); explicit `ConfidenceLow` → medium
`TestNormalSizeWeakOnlyUnaffected`	normal-size weak payload stays low risk
`TestLiveProbeBenignVsInject`	live HTTP: benign ~74 KB → 201; same size with explicit injection → 403

Independent live probe

$ # benign 70KB+ shape-only
POST /  -> 201 Created
$ # same size + "IGNORE all previous instructions."
POST /  -> 403 Forbidden
           GUARD_BLOCKED: matched_patterns=[ignore_previous]

Recommended full repo gate

After applying to <project>-dev/<project>:

go build ./...
go vet ./...
go test ./... -count=1 -timeout 60s
make gitreins            # Tier 1 + Tier 2 judge
make integration openapi # integration + OpenAPI checks
make coverage

Compatibility notes

Fail-safe preserved: ConfidenceHigh is the zero value, so any pattern added elsewhere in the codebase that does not set Confidence continues to block — no silently weakened security.
Only b64_blob is downgraded. No other built-in loses blocking power.
Evidence retention: medium-risk oversize still records oversize and b64_blob, so monitoring/telemetry is unchanged.
Policy filtering: disabled/masquerade patterns are absent from the enabled set before matching, so nothing about operator suppression changes.
Normal-size behavior: untouched; EvaluateOversize returns RiskLow for any payload <= 64 KiB.

Evidence & signatures

# Evidence
- Problem class: go-llm-guard-oversize-base64-false-positive
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-13T01:58:28.772Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "Symptom: an oversized payload (>64 KiB) was hard-blocked whenever any deterministic pre-scan matched. The built-in b64_blob regex matches any 80+ character alphanumeric/base64-like run, so ordinary large machine-generated payloads returned 403 even when no LLM key was configured. Root cause: the oversize no-LLM path treated weak shape evidence and explicit injection evidence identically. Fix: add per-pattern confidence, defaulting unknown/operator patterns to high for fail-safe compatibility; mark only b64_blob low-confidence; on the oversize path block only when the enabled prematch set contains at least one high-confidence hit. Weak-only hits allow at medium risk while retaining oversize and b64_blob in evidence. Explicit injection such as ignore_previous remains high-confidence and blocks without an LLM call. Preserve policy check filtering and normal-size behavior. Verification: focused regression tests cover weak-only allow, explicit oversize block, masquerade-disabled suppression, built-in confidence classification, and custom extra-pattern defaults/low opt-in. Full go build, go vet, go test ./... -count=1 -timeout 60s, gitreins Tier 1, Tier 2 judge, an independent live HTTP probe (benign 70KB -> 201; same-size explicit injection -> 403), GitHub CI, coverage, integration, OpenAPI, and rerun bunker E2E all passed.", "environment": "Crier Go message bus; deterministic LLM guard oversize fast path", "language": "go", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-llm-guard-oversize-base64-false-positive", "provider": "openrouter", "solved_at": "2026-09-13T01:58:28.773Z", "version": "1.26.6"}

Answer 2

All seven regression tests pass (including the live httptest probe). Here is the self-contained solution.

Fix: `go-llm-guard-oversize-base64-false-positive`

Summary

Root cause

The oversize no-LLM branch treated weak shape evidence and explicit injection evidence identically:

// BEFORE (conceptual)
if len(payload) > maxGuardBytes && len(prematchHits) > 0 {
    return block("payload_exceeds_guard_cap", prematchHits) // b64_blob alone is enough
}

b64_blob is a shape heuristic ([A-Za-z0-9+/]{80,}={0,2}) with a very high false-positive rate on machine-generated data.
ignore_previous / system_prompt / exfiltrate express intent.
Collapsing them into one boolean (len(hits) > 0) means the weakest rule gets veto power over the whole oversize path. The earlier size gate then turns a shape match into a hard block with no LLM adjudication, producing the 403.

Fix

Design

Add Confidence to each deterministic pattern and make high the zero value so unknown/operator-supplied patterns are fail-safe by construction:

type Confidence int

const (
    ConfidenceHigh Confidence = iota // zero value = fail-safe default
    ConfidenceLow                    // explicit opt-out only
)

Only b64_blob is marked ConfidenceLow.
All intent patterns and all unknown/custom patterns default to ConfidenceHigh (unless the operator explicitly sets ConfidenceLow).
Oversize decision: no hits → allow; only low hits → medium (allow + retain evidence); ≥1 high hit → block.
Policy check filtering is preserved: Prematch iterates only the enabled pattern set, so disabled (masquerade) patterns never contribute a hit.
Normal-size behavior is unchanged (still low risk for weak-only).

`internal/guard/patterns.go`

package guard

import "regexp"

// Confidence: ConfidenceHigh is the zero value on purpose. Every pattern,
// built-in or operator-supplied, is fail-safe (blocks) unless explicitly
// opted down to ConfidenceLow. This preserves compatibility for unknowns.
type Confidence int

const (
    ConfidenceHigh Confidence = iota
    ConfidenceLow
)

func (c Confidence) String() string {
    if c == ConfidenceHigh {
        return "high"
    }
    return "low"
}

type Pattern struct {
    Name       string
    Re         *regexp.Regexp
    Confidence Confidence
}

var builtinPatterns = []Pattern{
    {Name: "ignore_previous", Re: regexp.MustCompile(`(?i)\bignore\s+(all\s+)?(the\s+)?previous\s+(instructions|prompts?)\b`), Confidence: ConfidenceHigh},
    {Name: "system_prompt", Re: regexp.MustCompile(`(?i)\b(system|developer)\s+prompt\b`), Confidence: ConfidenceHigh},
    {Name: "exfiltrate", Re: regexp.MustCompile(`(?i)\b(exfiltrate|leak|reveal)\b.{0,40}\b(secret|key|token|password)\b`), Confidence: ConfidenceHigh},
    // Shape-only heuristic: high false-positive rate on large machine payloads.
    {Name: "b64_blob", Re: regexp.MustCompile(`[A-Za-z0-9+/]{80,}={0,2}`), Confidence: ConfidenceLow},
}

// Unknown / operator names resolve to HIGH (fail-safe).
func builtinConfidence(name string) Confidence {
    for _, p := range builtinPatterns {
        if p.Name == name {
            return p.Confidence
        }
    }
    return ConfidenceHigh
}

`internal/guard/guard.go`

const MaxGuardBytes = 64 << 10 // 64 KiB

type Risk int

const (
    RiskLow Risk = iota
    RiskMedium
    RiskHigh
)

type Hit struct {
    Name       string
    Confidence Confidence
}

type PrematchResult struct {
    Hits     []Hit
    Oversize bool
}

func (r PrematchResult) HasHighConfidence() bool {
    for _, h := range r.Hits {
        if h.Confidence == ConfidenceHigh {
            return true
        }
    }
    return false
}

type Matcher struct {
    patterns map[string]Pattern
    names    []string // deterministic iteration order
}

func NewMatcher(extras ...Pattern) *Matcher {
    m := &Matcher{patterns: map[string]Pattern{}}
    for _, p := range builtinPatterns {
        m.add(p)
    }
    for _, p := range extras {
        m.add(p)
    }
    return m
}

// SetEnabled is used for masquerade/operator suppression.
func (m *Matcher) SetEnabled(name string, enabled bool) {
    if enabled {
        if p, ok := m.patterns[name]; ok {
            m.add(p)
        }
        return
    }
    delete(m.patterns, name)
}

// Prematch runs only the ENABLED patterns (policy filtering preserved).
func (m *Matcher) Prematch(payload string) PrematchResult {
    res := PrematchResult{Oversize: len(payload) > MaxGuardBytes}
    for _, name := range m.names {
        p, ok := m.patterns[name]
        if !ok {
            continue
        }
        if p.Re.MatchString(payload) {
            res.Hits = append(res.Hits, Hit{Name: name, Confidence: p.Confidence})
        }
    }
    return res
}

// The fixed oversize / no-LLM fast path.
//   - no enabled hits         -> low    (allow)
//   - only low-confidence     -> medium (allow, retain oversize + b64_blob)
//   - >=1 high-confidence hit -> high   (block, no LLM call)
func (m *Matcher) EvaluateOversize(payload string) (Risk, PrematchResult) {
    pm := m.Prematch(payload)
    if !pm.Oversize || len(pm.Hits) == 0 {
        return RiskLow, pm
    }
    if pm.HasHighConfidence() {
        return RiskHigh, pm
    }
    return RiskMedium, pm
}

Wire-in at the call site

Replace the boolean prematch gate on the oversize branch with the confidence-aware decision:

// BEFORE
if len(payload) > MaxGuardBytes && len(prematchHits) > 0 {
    return block(403, "GUARD_BLOCKED", "payload_exceeds_guard_cap", prematchHits)
}

// AFTER
risk, pm := matcher.EvaluateOversize(payload)
if risk == RiskHigh {
    return block(403, "GUARD_BLOCKED", "payload_exceeds_guard_cap", pm.Hits)
}
// risk == RiskMedium: proceed at medium risk; keep pm.Oversize and pm.Hits as evidence.

Verification

Reconstructed the guard logic as a runnable module (~/guard-demo) and executed it with Go 1.26.

go build ./...
go vet ./...
go test ./... -count=1 -timeout 60s -v

Result:

=== RUN   TestOversizeWeakOnlyAllows                 --- PASS
=== RUN   TestOversizeExplicitInjectionBlocks        --- PASS
=== RUN   TestMasqueradeDisabledSuppressesWeakHit    --- PASS
=== RUN   TestBuiltinConfidenceClassification        --- PASS
=== RUN   TestCustomExtraPatternConfidence           --- PASS
=== RUN   TestNormalSizeWeakOnlyUnaffected           --- PASS
=== RUN   TestLiveProbeBenignVsInject                --- PASS
PASS
ok  guarddemo  0.023s

The tests cover exactly the required regressions:

Test	Assertion
`TestOversizeWeakOnlyAllows`	>64 KiB base64 shape only → medium risk, not blocked; `Oversize=true` and `b64_blob` still present as low-confidence evidence
`TestOversizeExplicitInjectionBlocks`	>64 KiB with `ignore all previous instructions` → high risk / block, no LLM path
`TestMasqueradeDisabledSuppressesWeakHit`	`SetEnabled("b64_blob", false)` → zero hits, low risk (suppression respected)
`TestBuiltinConfidenceClassification`	`b64_blob` = low; `ignore_previous`/`system_prompt`/`exfiltrate`/unknown = high
`TestCustomExtraPatternConfidence`	custom pattern zero-value = high (blocks); explicit `ConfidenceLow` → medium
`TestNormalSizeWeakOnlyUnaffected`	normal-size weak payload stays low risk
`TestLiveProbeBenignVsInject`	live HTTP: benign ~74 KB → 201; same size with explicit injection → 403

Independent live probe

$ # benign 70KB+ shape-only
POST /  -> 201 Created
$ # same size + "IGNORE all previous instructions."
POST /  -> 403 Forbidden
           GUARD_BLOCKED: matched_patterns=[ignore_previous]

Recommended full repo gate

After applying to <project>-dev/<project>:

go build ./...
go vet ./...
go test ./... -count=1 -timeout 60s
make gitreins            # Tier 1 + Tier 2 judge
make integration openapi # integration + OpenAPI checks
make coverage

Compatibility notes

Fail-safe preserved: ConfidenceHigh is the zero value, so any pattern added elsewhere in the codebase that does not set Confidence continues to block — no silently weakened security.
Only b64_blob is downgraded. No other built-in loses blocking power.
Evidence retention: medium-risk oversize still records oversize and b64_blob, so monitoring/telemetry is unchanged.
Policy filtering: disabled/masquerade patterns are absent from the enabled set before matching, so nothing about operator suppression changes.
Normal-size behavior: untouched; EvaluateOversize returns RiskLow for any payload <= 64 KiB.

Evidence & signatures

# Evidence
- Problem class: go-llm-guard-oversize-base64-false-positive
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-13T01:58:28.772Z
- Verification: solution produced by pi in sandbox; see signatures.json

Generated from the verified corpus · MIT licensedBack to the catalog

go-llm-guard-oversize-base64-false-positive

Answer 1

Fix: go-llm-guard-oversize-base64-false-positive

Summary

Root cause

Fix

Design

internal/guard/patterns.go

internal/guard/guard.go

Wire-in at the call site

Verification

Independent live probe

Recommended full repo gate

Compatibility notes

Evidence & signatures

Answer 2

Fix: go-llm-guard-oversize-base64-false-positive

Summary

Root cause

Fix

Design

internal/guard/patterns.go

internal/guard/guard.go

Wire-in at the call site

Verification

Independent live probe

Recommended full repo gate

Compatibility notes

Evidence & signatures

Fix: `go-llm-guard-oversize-base64-false-positive`

`internal/guard/patterns.go`

`internal/guard/guard.go`

Fix: `go-llm-guard-oversize-base64-false-positive`

`internal/guard/patterns.go`

`internal/guard/guard.go`