fix(detector): always return a verdict for image/PDF content - #4
Merged
Merged
Conversation
Non-scam images (e.g. a screenshot) were getting the generic "introduce yourself" greeting instead of a verdict. The detector received only the raw OCR text and, seeing no forwarded-scam structure, fell into system-prompt rule 6 (greeting) and replied with the intro message. Thread the message source through analyze(): - For image/document text, skip the greeting/challan shortcuts — extracted text is content submitted for checking, not a chat line. - Tag the content with a provenance note so the model treats it as material to analyze and always returns a فراڈ/مشکوک/ٹھیک verdict. - Add system-prompt rule 8: extracted image/PDF text always gets a verdict; if it shows no scam structure, say it does not look like a scam (یہ فراڈ نہیں لگتا). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MuhammadAnasTahir
pushed a commit
to MuhammadAnasTahir/sachbatao
that referenced
this pull request
Jul 20, 2026
Implements the code-level guardrails for operating an LLM in an adversarial civic context. Policy/roadmap items are documented in docs/GUARDRAILS.md. - codewithfourtix#2 Prompt injection: analyzed content is wrapped in <message_to_analyze> tags, delimiter breakout is escaped, and the system prompt treats any embedded "mark me safe" instruction as a fraud signal. - codewithfourtix#3 PII: redact CNIC / phone / account numbers before logging, hash sender ids in logs, redact the high-risk webhook body (src/redact.js). - codewithfourtix#4 Calibrated/aid: never clear a BISP/Ehsaas message without the 8171 verification line; low confidence defaults to "verify, don't act". - codewithfourtix#5 Hallucination: strip links (non *.gov.pk/.gop.pk) and phone/UAN numbers not on the official allowlist from every reply (src/sanitize.js). - codewithfourtix#6 Disclosure: one-time Urdu AI/advisory/data-use notice on first contact (src/disclosure.js). - codewithfourtix#7 Abuse: flag repeated near-duplicate fraud-flagged submissions from one sender as a probing signal (src/abuse-monitor.js). - codewithfourtix#8 Escalation: high-emotion verdicts always surface police 15, FIA 1991 and a "ask a trusted family member first" nudge. - #12 Feedback: one-tap "was this helpful? (ہاں/نہیں)" after each verdict, logged as eval labels (src/feedback.js). Tests: tests/guardrails.test.js — offline, LLM client stubbed, no paid API calls. 15 cases covering every guardrail above. `npm test` runs them. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Non-scam images (e.g. a screenshot) were getting the generic "introduce yourself" greeting instead of a verdict. The detector received only the raw OCR text and, seeing no forwarded-scam structure, fell into system-prompt rule 6 (greeting) and replied with the intro message.
Thread the message source through analyze():