# Doorman: check text for prompt injection in your browser

By Lucas Espindola · https://lucasespindola.com/doorman · in the site's terminal: `app doorman`

Doorman checks text an AI agent might read for prompt injection with Llama-Doorman-22M, a 22M-parameter classifier that runs in your browser. It tells a live instruction aimed at the agent apart from text that only quotes or mentions an attack, alone or side by side with Meta’s Llama Prompt Guard 2 (22M) or any prompt-injection classifier with ONNX weights you pick from Hugging Face, shows which part of the text drove each score, and traces the score’s circuit through the model’s own neurons and attention heads.

## How it works

1. Paste text an agent might read (a file, a web page, tool output) or pick a sample. Doorman downloads the model once and reads the text in your browser.
2. Read the score: under 0.2 is harmless, 0.2 to 0.85 unsure and 0.85 or more an attack, the cut-offs from the model card. What it reacted to scores the text again with each line or sentence taken out, to show what drove it; What drives the score traces the attack logit back through the model’s neurons, attention heads (with the token each read) and tokens, each line its share.
3. Compare with Prompt Guard 2, wrap the text as a quote, code block, test or docs note to see whether a model tells use from mention, play Spot it (14 texts an agent read on the job, to call live or quoted), or label examples into a dataset you can export as JSONL.
4. Train your own on that dataset: MiniLM turns each example into 384 numbers and a small head learns live attack from the rest, in your browser. It’s scored on each example held out, beside Doorman, with its calibration, and you can save it as a file and use it as a fast yes-or-no check in your own agent.

## Privacy and limits

- Runs in your browser with transformers.js: nothing you type or label leaves the page, and your dataset and the model you train on it stay in your browser.
- The models download once from Hugging Face and your browser caches them.
- Long text is read in windows of 256 tokens; the highest window counts.
- The circuit runs Doorman or Prompt Guard again in a forward pass written to be read inside, on the same int8 weights but without rounding each step to 8 bits, so its score can differ from the check’s by a little. It’s exact along direct paths, with each LayerNorm’s scale, the attention pattern and the pooler’s GELU held as they were.
- A classifier you pick from Hugging Face isn’t checked; 0.5 or more counts as its flagged label.

## Models

- [Llama-Doorman-22M](https://huggingface.co/PinataCloud/Llama-Doorman-22M)
- [Llama Prompt Guard 2 (22M)](https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-22M)

## More

- [How Llama-Doorman-22M was trained, on pinata.cloud](https://pinata.cloud/blog/how-we-trained-a-small-model-to-tell-a-prompt-injection-from-a-quote/)
- [The same story in the notes here](https://lucasespindola.com/notes/small-model-prompt-injection)
- [Doorman, the open-source app it powers](https://github.com/PinataCloud/doorman)