Five layers.
No single point of failure.

class PromptInjectionDetector:
    PATTERNS = [
        r"ignore\s+(previous|above|all)\s+(instructions?|rules?)",
        r"(system|admin)\s*:?\s*(override|prompt|instruction)",
        r"you\s+are\s+now\s+(DAN|evil|unrestricted|jailbroken)",
        r"\[\s*(SYSTEM|INST|SYS)\s*\]",
        r"<|\?(system|im_start|endoftext)\|?>",
        r"BEGIN\s+(OVERRIDE|NEW\s+INSTRUCTIONS)",
    ]
    ENCODING_PATTERNS = [
        r"[bB]ase64[:\s]",
        r"\\x[0-9a-fA-F]{2}",
        r"[​-‏
- ]",  # zero-width chars
    ]
    def analyze(self, text: str) -> dict:
        findings = [p for p in self.PATTERNS
                    if re.search(p, text, re.IGNORECASE)]
        return {
            "detected": len(findings) > 0,
            "risk_score": min(len(findings) * 50, 300)
        }

class MultimodalDetector:
    def analyze_mcp_tool(self, desc: str) -> dict:
        """Detect MCP tool poisoning (T11-AT-016)."""
        suspicious = [
            r"<IMPORTANT>",
            r"override|ignore|bypass",
            r"do not (tell|inform|show)",
            r"silently|secretly|covertly",
        ]
        hits = [p for p in suspicious
                if re.search(p, desc, re.I)]
        return {
            "poisoning_indicators": len(hits),
            "severity": ("CRITICAL" if len(hits) >= 3
                         else "HIGH" if hits else "LOW")
        }

class SupplyChainDetector:
    PICKLE_SIGS = [
        b"cos\nsystem",   # os.system call
        b"csubprocess",   # subprocess module
        b"c__builtin__",  # builtins access
    ]
    def scan_model_file(self, path: str) -> dict:
        with open(path, "rb") as f:
            header = f.read(8192)
        findings = [s for s in self.PICKLE_SIGS if s in header]
        return {"safe": not findings, "findings": findings}