Guides

Detectors: what exists, what does not

If you are describing this library anywhere public, describe it from here. ## The numbers

If you are describing this library anywhere public, describe it from here.

The numbers

figure	value
detectors in the catalogue	30
implemented in the library	29
that run on a fresh install, with no model download	28
implemented but waiting on weights that are not published	1
catalogued but not yet implemented	1
that need nothing beyond a CPU and the base install	27
that need something more, and declare it	3
supported languages	26

status is derived from whether the detector is in the registry, not from a list somebody keeps up to date. A detector that stops loading changes this table on the next render.

needs is what a deployment must provide before the detector will run at all. Most need nothing. The ones that do declare it in the catalogue, and registry.deployment_notes(policy) returns a line naming them when a policy switches one on, so a caller finds out when they enable it rather than in production.

The detectors

detector	tier	side	status	needs	backing	budget	what it does
`disclosure`	T0	output	built	nothing beyond a CPU	rule	5 ms	Reports whether an AI disclosure is present in the output, in 26 languages, and records the affirmative as well as the absence.
`invisible_text`	T0	input, output	built	nothing beyond a CPU	rule	5 ms	Characters that are in the text but not on the screen: bidirectional controls, tag characters used to smuggle instructions, zero-width characters used to evade filters.
`secrets`	T0	input, output	built	nothing beyond a CPU	rule	1 ms	Credentials in text on its way to the model: named key formats, plus a deliberately conservative entropy rule.
`banned_terms`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Terms the deploying organisation has decided must not appear, matched correctly in 26 languages. The list is policy; none ships.
`code_present`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Source code in text that should be prose, reported as one finding per shape found: a fence, a shebang, a definition, an import, a script tag, a shell invocation. Each carries its own confidence so a policy can act on a fenced block without acting on a line that merely ends in a brace.
`encoded_payload`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Instructions or credentials hidden behind base64, hex, percent-encoding or rot13, found by decoding the run and applying the rules to what comes out. Decoding alone is never a finding: a JWT, a git hash and base64 of ordinary prose all decode and none is reported.
`gibberish`	T1	input	built	nothing beyond a CPU	classifier	225 ms	Input that is not meaningful text.
`internal_domains`	T1	output	built	nothing beyond a CPU	rule	5 ms	Internal hostnames appearing in an answer meant for someone outside, in both their Unicode and punycode spellings.
`json_schema`	T1	output	built	dependency	rule	5 ms	Output that does not satisfy a JSON Schema the policy carries. Point it at the OpenAPI meta-schema and it validates an OpenAPI document.
`language_id`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Which of the 26 supported languages the text is in, whether that is one the policy permits, and whether an answer is in the same language as the prompt. Reports uncertain rather than guessing on short or mixed text.
`markup_injection`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Markup in the text that a browser would execute rather than display, found through case folding, entity decoding and compatibility folding.
`output_format`	T1	output	built	nothing beyond a CPU	rule	5 ms	Shape assertions a policy states: JSON, HTML, URL presence, length in graphemes, word count, case, choices, ranges, a regex, reading time.
`output_leakage`	T1	output	built	nothing beyond a CPU	ner	225 ms	Personal data in the output that the user did not supply, which is the narrower and more useful question than whether any is present.
`pii`	T1	input, output	built	nothing beyond a CPU	ner	225 ms	Personal data in input or output, as named entity spans with checksum validation where the identifier has one.
`postal_code`	T1	output	built	nothing beyond a CPU	rule	5 ms	Postal codes that cannot exist in the countries the product serves: the wrong shape, or outside a published province or department range.
`repetition`	T1	output	built	nothing beyond a CPU	rule	5 ms	Sentences the answer says twice, compared over folded text so a change of case or diacritic spelling does not hide a repeat.
`sql_injection`	T1	output	built	dependency	rule	5 ms	Generated SQL that does more than the product asked for: a second statement, a forbidden statement kind, a tautology, an unexpected UNION.
`summary_support`	T1	output	built	nothing beyond a CPU	rule	5 ms	Whether each sentence of a summary appears in the source it summarises, by string overlap rather than by judgement. Useful for an extractive summary, and not a groundedness check: it says so in its own docstring.
`system_prompt_leakage`	T1	output	built	nothing beyond a CPU	rule	5 ms	Whether the answer gave away the instructions the model was operating under, by containment against the system prompt and by phrase match in 26 languages.
`token_limit`	T1	input, output	built	nothing beyond a CPU	rule	5 ms	Text longer than the token budget of the model it is going to, counted with a tokenizer the policy names and pins: a local file, whose hash is reported as the revision, or an id already carrying a commit. A bare repo id is refused, because an unpinned count cannot be reproduced.
`bias`	T2	output	built	nothing beyond a CPU	classifier	225 ms	Output carrying bias related to a protected characteristic.
`injection`	T2	input	built	nothing beyond a CPU	classifier	225 ms	Attempts to talk the model out of its instructions.
`moderation`	T2	input, output	trained	nothing beyond a CPU	classifier	150 ms	Thirteen hazard categories in one pass, from violent crime to election misinformation. Replaces the capability Llama Guard and ShieldGemma provide, with weights this project can ship.
`nsfw`	T2	input, output	built	nothing beyond a CPU	classifier	225 ms	Sexual or otherwise not-safe-for-work content.
`politeness`	T2	output	built	nothing beyond a CPU	classifier	225 ms	Whether the tone of an answer is acceptable.
`regulated_advice`	T2	output	built	nothing beyond a CPU	classifier	225 ms	Output that reads as regulated financial, legal or medical advice.
`toxicity`	T2	input, output	built	nothing beyond a CPU	classifier	225 ms	Abusive or hateful language, in input or output.
`groundedness`	T3	output	built	nothing beyond a CPU	classifier	300 ms	Whether the claims in an answer are supported by the sources it was given.
`topic_scope`	T3	input	built	nothing beyond a CPU	classifier	300 ms	Whether a request is inside the subject matter the product covers.
`url_reachability`	T3	output	built	network	rule	3000 ms	Whether links in the answer resolve to something that answers, with a deadline and a refusal to request private addresses.

What the non-core detectors ask for

requirement	meaning
`dependency`	needs a runtime dependency outside the base install
`gpu`	needs an accelerator to meet its budget; CPU will be far slower
`llm`	runs a generative model, so its verdict is only reproducible with decoding pinned, and an evidence record depends on that
`network`	reaches another machine during a scan, so a third party is in the latency path of every request and their outage becomes yours

Things that are true and are easy to get wrong

Written as a list because these are the claims most likely to end up on a page in a form that is not quite right.

Not every catalogued detector is implemented. The table above is the authority. A detector with a status other than built does not run, and the library says so loudly rather than passing silently: a policy that asks an unavailable detector to block or redact raises DetectorUnavailableError before any scan happens, rather than letting text through as if it were checked.

26 languages is a claim about the rule-based detectors and about fixtures, not about every model. Every detector has fixtures in all 26. The PII model, piiguard, was trained on nine of them: English, Romanian, Bulgarian, Hungarian, Slovenian, Croatian, German, Italian and French. The other seventeen are untested for that detector. Say nine, or say "fixtures in 26, model coverage in 9", but do not say the model covers 26.

Two languages are weaker than the rest by construction. Maltese is not in the base model's pretraining set, and Maltese and Azerbaijani national identifiers have no public checksum scheme, so identifiers in those two can only be generated format-valid.

The disclosure and system-prompt phrasing files are not reviewed by native speakers. All 26 entries in both are marked reviewed: false. They match obvious wording and will miss idiomatic wording. unreviewed_languages() returns the list.

One detector answers no security question. output_format is shape, and its own docstring says so. It exists so that sixteen upstream shape validators have one destination instead of sixteen.

Latency figures need their input attached. Every budget above is p95 at a named reference input: 87 tokens, 396 characters, one thread, CPU, INT8 weights. The exact string is REFERENCE_INPUT in tests/test_budgets.py. A millisecond figure quoted without that is not reproducible. url_reachability is the exception and its budget is a deadline it enforces on itself, because it depends on a network.

A scan runs on one thread by default. More threads are faster, and the default stays at one because a library that commandeers the machine it is embedded in is worse than one that is honestly slower. A policy can raise it.

Things that must not be said

These are not style preferences. The obligations under the EU AI Act sit with the provider or deployer of a system, not with a library, and a claim otherwise is materially misleading.

Do not write: "AI Act compliant", "makes your system compliant", "guarantees", "ensures", "certified", or the name of any specific regulation in a way that implies this library satisfies it.

Write instead: "produces an auditable record of which checks ran and what they found", "detects whether a required disclosure is present in the output", "supports the evidence requirements of your own AI governance process".

The distinction the whole project rests on: this library does not make anyone compliant with anything. It produces evidence about controls that were applied.

This page is generated from docs/detectors.md in the library repository. Read it as markdown, or edit it at the source.