Prompt-injection scanner for AWS Bedrock

Why Bedrock Guardrails don't close the multimodal PI gap

Bedrock Guardrails are a powerful content-safety layer. They can deny responses that match a topic (e.g., "competitor pricing"), redact PII categories (SSNs, credit card numbers), apply grounding checks against retrieved context, and block profanity or specific word lists. For text-based prompt injection — a user who types "ignore previous instructions" — a well-configured denied-topic Guardrail can intercept that in the input.

The gap opens when the injection is carried in an image. A FigStep attack renders the malicious instruction as text inside the image — characters drawn in a font that OCR misreads as benign but Claude's vision encoder reads as a clear instruction. Guardrails' input analysis reads the text fields in the request body (the "text" content blocks and the conversation history). It does not extract and analyse the rendered text inside the image bytes of an "image" content block. The Guardrail configuration does not currently include an image-PI detector — that capability is not in the Guardrails feature set.

The result: a user who submits an image with a typographic prompt injection payload passes Guardrails' input check because the injected instruction is invisible to the text-analysis path. The image content block reaches Claude's vision encoder, which reads the instruction clearly.

The boto3 intercept pattern

The correct intercept is server-side, before the request is dispatched to the Bedrock runtime endpoint. The following wrapper handles Claude-format content blocks (the anthropic_version: bedrock-2023-05-31 payload schema). The same pattern extends to Llama 3 vision and Amazon Titan Multimodal Embeddings if your pipeline uses those models for image inputs.

import boto3
import httpx
import base64
import json
import os

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
bedrock_runtime = boto3.client("bedrock-runtime", region_name="us-east-1")

def _scan_image_bytes(img_bytes: bytes, label: str) -> None:
    """Raise if the image contains a multimodal PI payload."""
    resp = httpx.post(
        "https://api.glyphward.com/v1/scan",
        json={
            "data": base64.b64encode(img_bytes).decode(),
            "modality": "image",
            "source_trust": "low",
        },
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        timeout=5,
    )
    result = resp.json()
    if result["score"] > 70:
        raise ValueError(
            f"{label}: multimodal PI score {result['score']} "
            f"(region: {result.get('region')})"
        )

def safe_invoke_claude_on_bedrock(messages: list, model_id: str = "anthropic.claude-3-sonnet-20240229-v1:0") -> dict:
    """Invoke a Claude model on Bedrock after scanning all image content blocks.

    messages: list of Anthropic-format message dicts with content arrays.
    Returns the parsed Bedrock response body.
    """
    for msg in messages:
        for i, block in enumerate(msg.get("content", [])):
            if not isinstance(block, dict):
                continue
            if block.get("type") != "image":
                continue
            src = block["source"]
            if src["type"] == "base64":
                img_bytes = base64.b64decode(src["data"])
            elif src["type"] == "url":
                img_bytes = httpx.get(src["url"], timeout=10).content
            else:
                continue
            _scan_image_bytes(img_bytes, f"message[{msg['role']}].content[{i}]")

    payload = {
        "anthropic_version": "bedrock-2023-05-31",
        "max_tokens": 1024,
        "messages": messages,
    }
    response = bedrock_runtime.invoke_model(
        modelId=model_id,
        body=json.dumps(payload),
        contentType="application/json",
        accept="application/json",
    )
    return json.loads(response["body"].read())

Drop safe_invoke_claude_on_bedrock() wherever you currently call bedrock_runtime.invoke_model() with a Claude model. The scan adds ~150–200 ms per image block; Bedrock's own network round-trip adds 300–800 ms depending on model size and prompt length. The total latency overhead is imperceptible relative to the model's inference time.

Bedrock Knowledge Bases: the indirect-PI surface

Bedrock Knowledge Bases provides fully managed RAG: you point it at an S3 bucket, it chunks and embeds the documents into a vector store (OpenSearch Serverless or Pinecone), and exposes a RetrieveAndGenerate API. The chunking pipeline handles PDFs, Word documents, HTML, and Markdown. PDFs are chunked by text extraction — the text content of each page is extracted and embedded. Embedded images inside the PDF are not independently scanned for prompt-injection payloads.

A document that enters your S3 data source with a typographic PI payload embedded in an image on one of its pages is chunked, stored in the vector store, and returned as grounding context when a user's query retrieves the relevant chunk. The retrieved context arrives in Claude's context window as a trusted "retrieved document" — the model gives it the same epistemic weight as a system instruction. This is the indirect-PI vector via Knowledge Bases.

The correct remediation is a pre-ingestion scan placed in your S3 upload pipeline. Before any document lands in the data source bucket:

1. Extract all embedded images from the PDF (using pymupdf or pdfplumber).
2. POST each image to Glyphward's /v1/scan endpoint.
3. If any image scores above threshold, quarantine the document and alert your team. Do not write it to the data source bucket.
4. Log the scan ID, document hash, and ingestion decision as your LLM03-aligned provenance record — the same evidence your SOC 2 or ISO 27001 auditor will ask for.

This is the same architecture described in the OWASP LLM03:2025 RAG corpus poisoning page — the threat model is identical; only the managed-service wrapper changes.

Bedrock Agents: multimodal inputs in agent turns

Bedrock Agents orchestrates multi-step reasoning using Claude as the underlying model. An agent turn can include a sessionState.files[] array with user-uploaded files — images, PDFs, spreadsheets — that are injected into the agent's context for the current step. These files bypass Guardrails' text-analysis path in the same way that direct InvokeModel image content blocks do.

The intercept for Bedrock Agents is at the InvokeAgent call site. Before dispatching the agent action, scan each element of inputFiles (for the older Agents API) or sessionState.files[]:

def safe_invoke_agent(agent_id: str, agent_alias_id: str, session_id: str,
                      input_text: str, input_files: list | None = None) -> str:
    """Invoke a Bedrock Agent, scanning any image files first."""
    bedrock_agents_runtime = boto3.client("bedrock-agent-runtime", region_name="us-east-1")

    if input_files:
        for f in input_files:
            if f.get("source", {}).get("sourceType") == "BYTE_CONTENT":
                content = f["source"]["byteContent"]
                img_bytes = base64.b64decode(content["data"])
                media = content.get("mediaType", "")
                if media.startswith("image/"):
                    _scan_image_bytes(img_bytes, f"agent input file: {f.get('name', '?')}")

    response = bedrock_agents_runtime.invoke_agent(
        agentId=agent_id,
        agentAliasId=agent_alias_id,
        sessionId=session_id,
        inputText=input_text,
        sessionState={"files": input_files} if input_files else {},
    )
    output_text = ""
    for event in response["completion"]:
        if "chunk" in event:
            output_text += event["chunk"]["bytes"].decode()
    return output_text

What Guardrails cover vs what Glyphward covers

Bedrock Guardrails and Glyphward are complements, not competitors. Use both:

• Bedrock Guardrails: text-topic denial (keep the model on-task), PII redaction (remove sensitive data from responses), grounding check (detect hallucinations relative to retrieved context), word filters (block specific terms). Runs server-side inside Bedrock; requires no additional outbound call.
• Glyphward: multimodal PI detection for the image bytes and audio waveforms that Guardrails does not inspect. Runs client-side in your application, before the InvokeModel or InvokeAgent call. Returns a 0–100 risk score, a flagged pixel region, and per-signal confidences for FigStep, AgentTypo, and WhisperInject attack classes.

The per-request Glyphward scan log (scan ID, risk score, flagged region, modality, timestamp) is also your evidence trail for AWS Shared Responsibility Model obligations, SOC 2 CC6.6, and ISO 27001 A.8.28 input-validation controls. Bedrock Guardrails logs to CloudWatch; Glyphward logs can be forwarded to the same CloudWatch log group via webhook to keep your audit trail consolidated.

Get early access

Related questions

Further reading

• The multimodal prompt-injection threat model for AI product teams (2026) — full threat model covering the attack classes that Bedrock's vision-enabled models are exposed to.
• Prompt-injection scanner for RAG pipelines — the general pattern for pre-ingestion scanning; Bedrock Knowledge Bases is one instantiation.
• OWASP LLM03:2025 — RAG corpus poisoning via embedded images — the threat model for Bedrock Knowledge Bases indirect PI.
• FigStep detection — the typographic attack class Claude's vision encoder is exposed to.
• Indirect prompt injection via images — the PDF-embedded-image vector Bedrock Knowledge Bases creates.
• Prompt-injection scanner for Vertex AI & Gemini — the equivalent pattern on Google's managed AI platform.
• Multimodal LLM security API — the category-level overview.