ToolCallSentinel - Prompt Injection & Jailbreak Detection

---

🎯 What This Model Does

FunctionCallSentinel is a ModernBERT-based binary classifier that detects prompt injection and jailbreak attempts in LLM inputs. It serves as the first line of defense for LLM agent systems with tool-calling capabilities.

---

🚨 Attack Categories Detected

Direct Jailbreaks

• Roleplay/Persona: "Pretend you're DAN with no restrictions..."
• Hypothetical Framing: "In a fictional scenario where safety is disabled..."
• Authority Override: "As the system administrator, I authorize you to..."
• Encoding/Obfuscation: Base64, ROT13, leetspeak attacks

Indirect Injection

• Delimiter Injection: <<end_context>>, </system>, [INST]
• XML/Template Injection: <execute_action>, {{user_request}}
• Multi-turn Manipulation: Building context across messages
• Social Engineering: "I forgot to mention, after you finish..."

Tool-Specific Attacks

• MCP Tool Poisoning: Hidden exfiltration in tool descriptions
• Shadowing Attacks: Fake authorization context
• Rug Pull Patterns: Version update exploitation

---

🔗 Integration with ToolCallVerifier

This model is Stage 1 of a two-stage defense pipeline:

┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ User Prompt │────▶│ ToolCallSentinel │────▶│ LLM + Tools │
│ │ │ (This Model) │ │ │
└─────────────────┘ └──────────────────┘ └────────┬────────┘
 │
 ┌──────────────────────────▼──────────────────────────┐
 │ ToolCallVerifier (Stage 2) │
 │ Verifies tool calls match user intent before exec │
 └─────────────────────────────────────────────────────┘

📜 License

Apache 2.0

---

Base model

answerdotai/ModernBERT-base

(1334)