Detection classes

Lumen inspects every interaction for six classes of risk. Each runs over the prompt, the response, or both, and every collector can raise every class. Each class has a local fast-path (inline, single-digit milliseconds, capable of enforcing) and a cloud heavy-path (asynchronous depth — the cloud never sits in the request path).

Prompt injection & jailbreak

Adversarial prompts that override system instructions, exfiltrate the system prompt, or bypass guardrails.

• Local: known-jailbreak signatures plus heuristics for instruction override and base64 / rot13 / homoglyph obfuscation — the payload is decoded and re-scanned, and the obfuscation itself is a signal.
• Cloud: an LLM-judge adjudicates borderline scores; paraphrase-robust and multi-turn correlation.

Sensitive-data exposure

PII, credentials and secrets, financial data, and org-confidential content in prompts or responses.

• Local: regex for structured PII (email, phone, SSN, IBAN, card PAN with Luhn validation); dictionaries for credential markers (AKIA…, xoxb-…, PEM headers); Shannon entropy for high-entropy secrets no regex enumerates — all span-accurate so Redact removes exactly the secret.
• Cloud: NER for context-dependent PII with validators.
• Per-tenant custom definitions add regex and dictionary detectors (case ids, part numbers, customer codes) with no code change.

Malicious entities

Known-bad URLs, IPs and domains — phishing links, C2 domains, malware hosts.

• Local: a memory-mapped bloom filter gives an O(1) inline membership test. A bloom hit is a candidate (no false negatives, some false positives) and logs; an exact-list hit is confirmed and can block.
• Cloud: confirms candidates against the authoritative store. The entity feed is driven from Wazuh CTI.

Toxic / harmful content

Violent, abusive, hateful, or self-harm input and output.

• Local: a multi-label classifier scores inline.
• Cloud: a larger content-safety model refines low-confidence scores and handles context, sarcasm, and multilingual input.

Language

Detects the prompt/response language and applies an optional allowlist or denylist — a permitted language never triggers regardless of confidence.

Topic violations

Configurable content-category restrictions (for example, disallow legal or medical advice). A compact category classifier scores inline for common categories; the cloud runs the full taxonomy.

Local vs cloud, summarized

Class	Local fast-path	Cloud heavy-path	Inline enforce?
Prompt injection	signatures + heuristics	LLM-judge, multi-turn	Yes
Sensitive data	regex + dictionaries + entropy	NER + validators	Yes (Redact)
Malicious entities	bloom filter (candidate)	CTI confirm	Yes (confirmed block)
Toxic / harmful	multi-label classifier	content-safety model	Yes
Language	language ID + list lookup	short-sample confirm	Yes
Topic	category classifier	full-taxonomy + judge	Partial

Fallback. The inline verdict is always the local one. Cloud findings backfill asynchronously and can raise a retroactive finding on an already-logged interaction. Per-policy timeout posture: fail-open (default — Lumen never becomes an outage in the user's AI tool) or fail-closed for high-security tenants.