reskSecure

Per-User LLM Firewall — Unauthorized Content Becomes Physically Ungeneratable

Security Inside the Generation Loop, Not After It

Prompt filters are jailbreakable. Post-hoc moderation acts too late — the content is already generated. reskSecure takes a different approach: it intercepts the model at every token prediction and checks each candidate token against a GPU-accelerated Aho-Corasick automaton inside the generation loop. Banned phrases and disallowed tool calls are not detected after the fact — they are never emitted.

Built on the resk-logits engine, reskSecure adds an enterprise-grade policy layer: per-user capability bitmasks, YAML policy configuration with hot-reload, and token-level tool-call gating.

How It Compares

Prompt filters: jailbreakable — a rephrased prompt slips past the input check.
Post-hoc moderation: too late — the harmful content was generated, sent, and possibly seen.
Policy engines (OPA-style): decide whether to answer, but cannot constrain what the model generates.
reskSecure: forbidden content is ever emitted: No. Enforcement happens at the token level, where no prompt engineering can reach.

Project Stats

200

PyPI Downloads

GitHub Stars

400+

Banned Phrases Bundled

Permission Bits per User

Key Features

Per-User Capability Bitmask

Each user carries a 64-bit capability mask received from your external auth (no JWT handling inside the firewall). Policies map masks to phrase rules and tool permissions, so security is enforced per user, not per deployment.

Up to 64 independent permission bits, 8 predefined capabilities (tools, code gen, DB read/write, email, PII, user management…)
Exact mask match with default-policy fallback
Tool-level permission granularity

Shadow Ban: Invisible Enforcement

Instead of crashing with an exception or truncating output, reskSecure steers generation silently. Hard mode pins a token's logit to -inf (physically ungeneratable); bias mode applies a configurable penalty that makes harmful content statistically vanish — a penalty of -15.0 drives generation probability to ~0.00003%.

Hard mode: logit = -inf, impossible to generate
Bias mode: configurable penalty per phrase (-5 light → -20 near-impossible)
Strict mode: forces EOS at the first banned prefix
No exceptions, no truncation, no visible blocking — your users never hit a wall

Multi-Token, Jailbreak-Resistant Matching

The vectorized Aho-Corasick automaton tracks partial matches across token boundaries, so multi-token rephrasings of banned phrases are still caught. GPU-accelerated and cached, it scales to 1000+ phrases with a bundled dataset of 400+ dangerous phrases across 20 categories.

Stateful partial-match tracking across tokens
GPU-accelerated (CUDA) via resk-logits
Thread-safe automaton cache per (mask, model) pair with TTL
Bundled banned-phrases dataset: 400+ phrases, 20 categories

Tool Call Blocking at the Token Level

If a user lacks the permission bit for a tool, its trigger phrases are automatically added to the hard-block list — the model cannot even start generating the call. A post-generation ToolGuard verifies tool actions as defense in depth.

Per-tool trigger phrases in the YAML policy
Blocked at generation time, before the call exists
verify_tool_action() post-generation double check

Production-Ready Operations

Policies are plain YAML files that hot-reload without restarting the server — edit the file, and new rules take effect within seconds.

PolicyWatcher polls YAML changes (5 s interval), zero-downtime updates
Streaming support (stream_generate()) and vLLM adapter (to_vllm())
Symbolic YAML rule engine with templates and severity levels (high/medium/low)

Quick Start

pip install resksecure

Requires Python ≥ 3.13, PyTorch ≥ 2.0, and Transformers ≥ 4.35.

Usage Example

                Policy File (policy.yaml)
                
version: "1.0"
policies:
  - mask: 7
    name: contributor
    default: true
    rules:
      - phrase: "DROP TABLE"
        mode: hard
      - phrase: "salaries"
        mode: bias
        penalty: -5.0
    tools:
      send_email:
        required_bit: 1
        trigger_phrases:
          - "send_email("
                
            

                Generation Pipeline
                
from resksecure import BitmaskLogitsProcessor, load_policy, verify_tool_action

policy_set = load_policy("policy.yaml")

processor = BitmaskLogitsProcessor(
    mask=7,
    model_name="mistralai/Mistral-7B-v0.1",
    tokenizer=tokenizer,
    policy_set=policy_set,
    device="cuda",
)

outputs = model.generate(**inputs, logits_processor=[processor])

# Defense in depth: verify tool actions after generation
if not verify_tool_action("send_email", user_mask=7, policy_set=policy_set):
    raise PermissionError("Action not authorized")
                
            

Architecture

                
User bitmask (from external auth)
    |
    v
PolicyLoader -- loads YAML, resolves mask to Policy
    |
    v
TrieFactory -- builds VectorizedAhoCorasick from rules
    |         + tool trigger phrases for disallowed tools
    v
BitmaskLogitsProcessor -- HuggingFace LogitsProcessor
    |
    v
Aho-Corasick automaton via resk-logits (GPU)
    |
    v
Hard mode: logit = -inf
Bias mode: logit -= penalty
Strict mode: EOS on prefix match
    |
    v
ToolGuard (post-generation verification)
                
            

The RESK Ecosystem

resk-logits (Apache 2.0) — the engine: shadow-ban logits processor, vectorized Aho-Corasick, streaming, vLLM adapter.
reskSecure — this package: per-user bitmasks, policies, tool gating on top of the engine.
ReskSafety — full LLM security firewall platform with input-time filtering.
ReskPoints — logging and observability for your LLM security events.

Licensing

Free for Individuals. Licensed for Businesses.

reskSecure is distributed under the RESK Software License: it is free of charge for individuals, and its professional use by companies requires a commercial license.

Individuals, students, researchers, education, evaluation: free for personal and non-commercial use.
Companies & professional organizations: any commercial use — integration into a product, SaaS offering, or internal business operations — requires a paid commercial license.

Full terms: LICENSE (RESK Software License).

Get Started with reskSecure

Add policy-driven, token-level security to your LLM deployments.

View on GitHub PyPI Package

Commercial Licensing & Support

Using reskSecure in a professional context? Request a commercial license, pricing, or integration support:

contact[@]resk.fr

Contact Our Team