Prompt-injection scanner for Azure OpenAI

What Azure Prompt Shields cover — and where they stop

Azure Prompt Shields (part of Azure AI Content Safety, generally available in 2024) performs two checks on each inference request:

1. User prompt attack detection. The text in the user's messages[] is analysed for direct injection attempts — phrases that try to override the system prompt, jailbreak the model, or elicit disallowed outputs through text alone.
2. Document attack detection. When you pass retrieved context to the model as a document or tool output, Prompt Shields can detect injected instructions that an attacker embedded in that document text.

Both checks operate on text representations. An image_url content block passes a URL or a base64-encoded image — a blob of bytes, not a text string. Azure Prompt Shields does not decode that blob and search it for rendered instruction text. The typographic prompt injection payload that walks past Prompt Shields is not a text-format attack that text analysis could catch — it is an instruction rendered as pixels, legible to the GPT-4o vision encoder and invisible to any text-path scanner.

Azure Computer Vision (the imageanalysis API) can generate text captions and OCR transcripts for images. The OCR path has the same structural ceiling as all text-extraction-before-scan architectures: FigStep and AgentTypo attacks produce a clean or ambiguous OCR transcript while remaining clearly legible to the vision model's neural encoder. Scanning the OCR output, rather than the original image bytes, covers the wrong artefact.

The Python SDK intercept — openai + Azure endpoint

Azure OpenAI uses the same OpenAI Python SDK with an Azure endpoint and API key (or Entra ID credential). The scan intercept is a wrapper around the chat completion call that walks the messages list before dispatch:

import httpx
import base64
import os
from openai import AzureOpenAI

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
AZURE_OPENAI_ENDPOINT = os.environ["AZURE_OPENAI_ENDPOINT"]  # e.g. https://my-resource.openai.azure.com
AZURE_OPENAI_API_KEY = os.environ["AZURE_OPENAI_API_KEY"]
AZURE_DEPLOYMENT_NAME = "gpt-4o"  # your deployment name

azure_client = AzureOpenAI(
    azure_endpoint=AZURE_OPENAI_ENDPOINT,
    api_key=AZURE_OPENAI_API_KEY,
    api_version="2024-05-01-preview",
)

def _scan_image_url_block(block: dict, label: str) -> None:
    """Scan an image_url content block. Raises if score exceeds threshold."""
    url_val = block.get("image_url", {}).get("url", "")
    if url_val.startswith("data:image"):
        # Base64 data URI
        b64_data = url_val.split(",", 1)[1]
        img_bytes = base64.b64decode(b64_data)
    else:
        # Remote URL: fetch bytes first
        img_bytes = httpx.get(url_val, timeout=10).content

    resp = httpx.post(
        "https://api.glyphward.com/v1/scan",
        json={
            "data": base64.b64encode(img_bytes).decode(),
            "modality": "image",
            "source_trust": "low",
        },
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        timeout=5,
    )
    result = resp.json()
    if result["score"] > 70:
        raise ValueError(
            f"{label}: multimodal PI score {result['score']} "
            f"(region: {result.get('region')})"
        )

def safe_azure_chat_completion(messages: list, **kwargs) -> object:
    """Send a chat completion to Azure OpenAI after scanning all image_url blocks."""
    for msg in messages:
        content = msg.get("content", [])
        if isinstance(content, list):
            for i, block in enumerate(content):
                if isinstance(block, dict) and block.get("type") == "image_url":
                    _scan_image_url_block(block, f"{msg['role']}[{i}]")

    return azure_client.chat.completions.create(
        model=AZURE_DEPLOYMENT_NAME,
        messages=messages,
        **kwargs,
    )

Replace your existing azure_client.chat.completions.create() calls with safe_azure_chat_completion(). The added latency is ~150–200 ms per image block. GPT-4o's own inference latency is typically 1–4 seconds for multimodal prompts, so the scan overhead is well within user-acceptable response time.

Azure AI Search + Azure OpenAI RAG: the indirect-PI surface

A common Azure architecture feeds Azure AI Search (formerly Cognitive Search) results into an Azure OpenAI chat completion — the "own-data" pattern supported by Azure OpenAI's data_sources extension. When the documents in Azure AI Search include PDFs with embedded images, those image pages may contain typographic PI payloads that the search indexer's text extraction misses and that arrive in the model's context as trusted retrieved content.

The pre-ingestion scan pattern applies here too: before a document enters your Azure AI Search index, extract its embedded images and scan each one. A flagged document should be quarantined before indexing. The scan evidence (scan ID, document hash, decision) is the provenance record for your ISO 27001 A.8.28 input-validation obligation and your OWASP LLM03 dataset-provenance trail.

Running Prompt Shields and Glyphward together

Azure Prompt Shields and Glyphward cover non-overlapping attack surfaces. The recommended architecture uses both in the request handling path:

1. Glyphward scan (client-side): For each image_url block in the user's message, POST bytes to /v1/scan. If score > threshold, return HTTP 400 to the user. This gate runs before the Azure API call.
2. Azure Prompt Shields (Azure-side): Enable via the Content Safety configuration on your Azure OpenAI deployment or call POST /contentsafety/text:shieldPrompt on the text fields. This catches text-format injection in the same request.

Neither tool substitutes for the other. A text-only injection in the user message is caught by Prompt Shields; a pixel-layer injection in the attached image is caught by Glyphward. The per-request Glyphward scan log (scan_id, score, region, modality) integrates with Azure Monitor via webhook — forward it to the same Log Analytics workspace as your Azure Content Safety logs for a consolidated compliance evidence trail.

For teams pursuing SOC 2 Type II or ISO 27001:2022 certification, the combined log stream satisfies the per-request evidence requirement for CC6.6 and A.8.28 across both text and image modalities in a single audit artifact.

Get early access

Related questions

Further reading

• Azure Prompt Shields alternative for non-Azure teams — if you are not on Azure, this page covers cross-cloud positioning.
• Glyphward vs Azure Prompt Shields — the full comparison: what each tool covers, where they differ, and the run-both architecture.
• FigStep detection — the typographic attack class GPT-4o's vision encoder is exposed to.
• Indirect prompt injection via images — the RAG/retrieval vector for Azure AI Search + Azure OpenAI pipelines.
• OWASP LLM03:2025 — dataset poisoning via embedded images — the Azure AI Search pre-ingestion scan architecture.
• Prompt-injection scanner for AWS Bedrock — the equivalent pattern on Amazon's managed AI platform.
• Multimodal LLM security API — the category-level overview.