MCintelligentplus DocsPIGuard — ML injection classifier
DeBERTa-based prompt-injection detection, strongest on tool results
PIGuard — ML injection classifier
The PIGuard provider connects to a PIGuard sidecar — a DeBERTa-based classifier that scores text with an injection probability. Where AGT and ATR match patterns, PIGuard judges meaning: it is the strongest option for indirect injection, where hostile instructions hide inside a tool result, web page, or document the agent just read.
| Hook | Notes |
|---|---|
pre_call | Classifies user text. |
post_mcp_call | Classifies tool results — the indirect-injection case. Give the row both hooks if you want coverage on each. |
Configuration
| Field | Meaning | Example |
|---|---|---|
api_base | Sidecar base URL. Empty = provider inactive. | http://piguard:8000 |
threshold | Injection probability at or above which a hit is reported. The benchmarked clean band: attacks ≥ 0.9982, benign ≤ 0.3426 — 0.5 sits safely between. | 0.5 |
roles | Payload roles sent for classification. tool covers indirect injection. | ["user", "tool"] |
max_chars | Per-text truncation before classification. | 4000 |
timeout_ms | Set generously — e.g. 15000. The first call after a sidecar restart loads the model and takes seconds; later calls are 10–300 ms. The 1.5 s default times out on the cold start (recorded as failed_open, no block). | 15000 |
{
"api_base": "http://piguard:8000",
"threshold": 0.5,
"timeout_ms": 15000
}Reading the verdicts
A hit carries the model's probability in the score (e.g. p=0.9998 in the
excerpt) and is reported as a raw verdict; the row's Enforce switch decides
whether it blocks. In the Test Playground a log-only row shows it as
"logs only — would block if enforced", so you can validate scores against your
own traffic before enforcing.
On GPU-less deployments the sidecar runs the model on CPU: expect ~100–300 ms
per call when warm and a slow first request after each restart. Keep
timeout_ms at 15000 so cold starts record a verdict instead of an error.