llmverify
Version:
AI Output Verification Toolkit — Local-first LLM safety, hallucination detection, PII redaction, prompt injection defense, and runtime monitoring. Zero telemetry. OWASP LLM Top 10 aligned.
120 lines • 13.3 kB
JavaScript
;
/**
* CSM6 Baseline Engine
*
* Cognitive System Management v6 - Baseline Profile
* Implements security, privacy, and safety checks.
*
* @module csm6/baseline
* @author Haiec
* @license MIT
*/
Object.defineProperty(exports, "__esModule", { value: true });
exports.CSM6Baseline = void 0;
const security_1 = require("./security");
class CSM6Baseline {
constructor(config) {
this.config = config;
this.LIMITATIONS = [
'Pattern-based detection (free tier)',
'English language only',
'Cannot detect novel attack patterns',
'Context-dependent false positives possible',
'Requires human validation for production use'
];
this.METHODOLOGY = 'CSM6 Baseline Profile: Implements OWASP LLM Top 10 aligned checks ' +
'for security (prompt injection), privacy (PII detection), and ' +
'safety (harmful content). Pattern-based detection with confidence intervals.';
}
async audit(input, output) {
const findings = [];
const checksPerformed = [];
const csm6Config = this.config.engines.csm6;
// Security checks
if (csm6Config.checks.security) {
checksPerformed.push('security:prompt-injection');
const injectionFindings = (0, security_1.checkPromptInjection)(input);
findings.push(...injectionFindings);
}
// Privacy checks
if (csm6Config.checks.privacy) {
checksPerformed.push('privacy:pii-detection');
const piiFindings = (0, security_1.checkPII)(output);
findings.push(...piiFindings);
}
// Safety checks
if (csm6Config.checks.safety) {
checksPerformed.push('safety:harmful-content');
const harmFindings = (0, security_1.checkHarmfulContent)(output);
findings.push(...harmFindings);
}
// Transparency (always enabled)
checksPerformed.push('transparency:audit-trail');
// Calculate summary
const summary = this.calculateSummary(findings);
// Calculate risk score
const riskScore = this.calculateRiskScore(findings);
// Determine if passed
const passed = !findings.some(f => f.severity === 'critical' || f.severity === 'high');
return {
findings,
summary,
riskScore,
passed,
profile: csm6Config.profile,
checksPerformed,
limitations: this.LIMITATIONS,
methodology: this.METHODOLOGY
};
}
calculateSummary(findings) {
const bySeverity = {
info: 0,
low: 0,
medium: 0,
high: 0,
critical: 0
};
const byCategory = {
security: 0,
privacy: 0,
safety: 0,
fairness: 0,
reliability: 0,
governance: 0
};
for (const finding of findings) {
bySeverity[finding.severity]++;
byCategory[finding.category]++;
}
return {
total: findings.length,
bySeverity,
byCategory
};
}
calculateRiskScore(findings) {
if (findings.length === 0)
return 0;
const severityWeights = {
info: 0.1,
low: 0.2,
medium: 0.4,
high: 0.7,
critical: 1.0
};
let totalWeight = 0;
let maxWeight = 0;
for (const finding of findings) {
const weight = severityWeights[finding.severity] * finding.confidence.value;
totalWeight += weight;
maxWeight = Math.max(maxWeight, weight);
}
// Combine average and max for final score
const avgWeight = totalWeight / findings.length;
const score = avgWeight * 0.6 + maxWeight * 0.4;
return Math.min(1, score);
}
}
exports.CSM6Baseline = CSM6Baseline;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmFzZWxpbmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY3NtNi9iYXNlbGluZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7Ozs7OztHQVNHOzs7QUFJSCx5Q0FBaUY7QUFFakYsTUFBYSxZQUFZO0lBY3ZCLFlBQW9CLE1BQWM7UUFBZCxXQUFNLEdBQU4sTUFBTSxDQUFRO1FBYmpCLGdCQUFXLEdBQUc7WUFDN0IscUNBQXFDO1lBQ3JDLHVCQUF1QjtZQUN2QixxQ0FBcUM7WUFDckMsNENBQTRDO1lBQzVDLDhDQUE4QztTQUMvQyxDQUFDO1FBRWUsZ0JBQVcsR0FDMUIsb0VBQW9FO1lBQ3BFLGdFQUFnRTtZQUNoRSw4RUFBOEUsQ0FBQztJQUU1QyxDQUFDO0lBRXRDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBYSxFQUFFLE1BQWM7UUFDdkMsTUFBTSxRQUFRLEdBQWMsRUFBRSxDQUFDO1FBQy9CLE1BQU0sZUFBZSxHQUFhLEVBQUUsQ0FBQztRQUVyQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFFNUMsa0JBQWtCO1FBQ2xCLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMvQixlQUFlLENBQUMsSUFBSSxDQUFDLDJCQUEyQixDQUFDLENBQUM7WUFDbEQsTUFBTSxpQkFBaUIsR0FBRyxJQUFBLCtCQUFvQixFQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3RELFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFFRCxpQkFBaUI7UUFDakIsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQzlCLGVBQWUsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsQ0FBQztZQUM5QyxNQUFNLFdBQVcsR0FBRyxJQUFBLG1CQUFRLEVBQUMsTUFBTSxDQUFDLENBQUM7WUFDckMsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsQ0FBQyxDQUFDO1FBQ2hDLENBQUM7UUFFRCxnQkFBZ0I7UUFDaEIsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzdCLGVBQWUsQ0FBQyxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQztZQUMvQyxNQUFNLFlBQVksR0FBRyxJQUFBLDhCQUFtQixFQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ2pELFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLENBQUMsQ0FBQztRQUNqQyxDQUFDO1FBRUQsZ0NBQWdDO1FBQ2hDLGVBQWUsQ0FBQyxJQUFJLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUVqRCxvQkFBb0I7UUFDcEIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRWhELHVCQUF1QjtRQUN2QixNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFcEQsc0JBQXNCO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUNoQyxDQUFDLENBQUMsUUFBUSxLQUFLLFVBQVUsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLE1BQU0sQ0FDbkQsQ0FBQztRQUVGLE9BQU87WUFDTCxRQUFRO1lBQ1IsT0FBTztZQUNQLFNBQVM7WUFDVCxNQUFNO1lBQ04sT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPO1lBQzNCLGVBQWU7WUFDZixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7WUFDN0IsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1NBQzlCLENBQUM7SUFDSixDQUFDO0lBRU8sZ0JBQWdCLENBQUMsUUFBbUI7UUFDMUMsTUFBTSxVQUFVLEdBQTZCO1lBQzNDLElBQUksRUFBRSxDQUFDO1lBQ1AsR0FBRyxFQUFFLENBQUM7WUFDTixNQUFNLEVBQUUsQ0FBQztZQUNULElBQUksRUFBRSxDQUFDO1lBQ1AsUUFBUSxFQUFFLENBQUM7U0FDWixDQUFDO1FBRUYsTUFBTSxVQUFVLEdBQTZCO1lBQzNDLFFBQVEsRUFBRSxDQUFDO1lBQ1gsT0FBTyxFQUFFLENBQUM7WUFDVixNQUFNLEVBQUUsQ0FBQztZQUNULFFBQVEsRUFBRSxDQUFDO1lBQ1gsV0FBVyxFQUFFLENBQUM7WUFDZCxVQUFVLEVBQUUsQ0FBQztTQUNkLENBQUM7UUFFRixLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLFVBQVUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMvQixVQUFVLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakMsQ0FBQztRQUVELE9BQU87WUFDTCxLQUFLLEVBQUUsUUFBUSxDQUFDLE1BQU07WUFDdEIsVUFBVTtZQUNWLFVBQVU7U0FDWCxDQUFDO0lBQ0osQ0FBQztJQUVPLGtCQUFrQixDQUFDLFFBQW1CO1FBQzVDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxDQUFDLENBQUM7UUFFcEMsTUFBTSxlQUFlLEdBQTZCO1lBQ2hELElBQUksRUFBRSxHQUFHO1lBQ1QsR0FBRyxFQUFFLEdBQUc7WUFDUixNQUFNLEVBQUUsR0FBRztZQUNYLElBQUksRUFBRSxHQUFHO1lBQ1QsUUFBUSxFQUFFLEdBQUc7U0FDZCxDQUFDO1FBRUYsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO1FBQ3BCLElBQUksU0FBUyxHQUFHLENBQUMsQ0FBQztRQUVsQixLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLE1BQU0sTUFBTSxHQUFHLGVBQWUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFDNUUsV0FBVyxJQUFJLE1BQU0sQ0FBQztZQUN0QixTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUMsQ0FBQztRQUVELDBDQUEwQztRQUMxQyxNQUFNLFNBQVMsR0FBRyxXQUFXLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUNoRCxNQUFNLEtBQUssR0FBRyxTQUFTLEdBQUcsR0FBRyxHQUFHLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFFaEQsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM1QixDQUFDO0NBQ0Y7QUE3SEQsb0NBNkhDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBDU002IEJhc2VsaW5lIEVuZ2luZVxuICogXG4gKiBDb2duaXRpdmUgU3lzdGVtIE1hbmFnZW1lbnQgdjYgLSBCYXNlbGluZSBQcm9maWxlXG4gKiBJbXBsZW1lbnRzIHNlY3VyaXR5LCBwcml2YWN5LCBhbmQgc2FmZXR5IGNoZWNrcy5cbiAqIFxuICogQG1vZHVsZSBjc202L2Jhc2VsaW5lXG4gKiBAYXV0aG9yIEhhaWVjXG4gKiBAbGljZW5zZSBNSVRcbiAqL1xuXG5pbXBvcnQgeyBDb25maWcgfSBmcm9tICcuLi90eXBlcy9jb25maWcnO1xuaW1wb3J0IHsgQ1NNNlJlc3VsdCwgRmluZGluZywgU2V2ZXJpdHksIENhdGVnb3J5IH0gZnJvbSAnLi4vdHlwZXMvcmVzdWx0cyc7XG5pbXBvcnQgeyBjaGVja1Byb21wdEluamVjdGlvbiwgY2hlY2tQSUksIGNoZWNrSGFybWZ1bENvbnRlbnQgfSBmcm9tICcuL3NlY3VyaXR5JztcblxuZXhwb3J0IGNsYXNzIENTTTZCYXNlbGluZSB7XG4gIHByaXZhdGUgcmVhZG9ubHkgTElNSVRBVElPTlMgPSBbXG4gICAgJ1BhdHRlcm4tYmFzZWQgZGV0ZWN0aW9uIChmcmVlIHRpZXIpJyxcbiAgICAnRW5nbGlzaCBsYW5ndWFnZSBvbmx5JyxcbiAgICAnQ2Fubm90IGRldGVjdCBub3ZlbCBhdHRhY2sgcGF0dGVybnMnLFxuICAgICdDb250ZXh0LWRlcGVuZGVudCBmYWxzZSBwb3NpdGl2ZXMgcG9zc2libGUnLFxuICAgICdSZXF1aXJlcyBodW1hbiB2YWxpZGF0aW9uIGZvciBwcm9kdWN0aW9uIHVzZSdcbiAgXTtcbiAgXG4gIHByaXZhdGUgcmVhZG9ubHkgTUVUSE9ET0xPR1kgPSBcbiAgICAnQ1NNNiBCYXNlbGluZSBQcm9maWxlOiBJbXBsZW1lbnRzIE9XQVNQIExMTSBUb3AgMTAgYWxpZ25lZCBjaGVja3MgJyArXG4gICAgJ2ZvciBzZWN1cml0eSAocHJvbXB0IGluamVjdGlvbiksIHByaXZhY3kgKFBJSSBkZXRlY3Rpb24pLCBhbmQgJyArXG4gICAgJ3NhZmV0eSAoaGFybWZ1bCBjb250ZW50KS4gUGF0dGVybi1iYXNlZCBkZXRlY3Rpb24gd2l0aCBjb25maWRlbmNlIGludGVydmFscy4nO1xuICBcbiAgY29uc3RydWN0b3IocHJpdmF0ZSBjb25maWc6IENvbmZpZykge31cbiAgXG4gIGFzeW5jIGF1ZGl0KGlucHV0OiBzdHJpbmcsIG91dHB1dDogc3RyaW5nKTogUHJvbWlzZTxDU002UmVzdWx0PiB7XG4gICAgY29uc3QgZmluZGluZ3M6IEZpbmRpbmdbXSA9IFtdO1xuICAgIGNvbnN0IGNoZWNrc1BlcmZvcm1lZDogc3RyaW5nW10gPSBbXTtcbiAgICBcbiAgICBjb25zdCBjc202Q29uZmlnID0gdGhpcy5jb25maWcuZW5naW5lcy5jc202O1xuICAgIFxuICAgIC8vIFNlY3VyaXR5IGNoZWNrc1xuICAgIGlmIChjc202Q29uZmlnLmNoZWNrcy5zZWN1cml0eSkge1xuICAgICAgY2hlY2tzUGVyZm9ybWVkLnB1c2goJ3NlY3VyaXR5OnByb21wdC1pbmplY3Rpb24nKTtcbiAgICAgIGNvbnN0IGluamVjdGlvbkZpbmRpbmdzID0gY2hlY2tQcm9tcHRJbmplY3Rpb24oaW5wdXQpO1xuICAgICAgZmluZGluZ3MucHVzaCguLi5pbmplY3Rpb25GaW5kaW5ncyk7XG4gICAgfVxuICAgIFxuICAgIC8vIFByaXZhY3kgY2hlY2tzXG4gICAgaWYgKGNzbTZDb25maWcuY2hlY2tzLnByaXZhY3kpIHtcbiAgICAgIGNoZWNrc1BlcmZvcm1lZC5wdXNoKCdwcml2YWN5OnBpaS1kZXRlY3Rpb24nKTtcbiAgICAgIGNvbnN0IHBpaUZpbmRpbmdzID0gY2hlY2tQSUkob3V0cHV0KTtcbiAgICAgIGZpbmRpbmdzLnB1c2goLi4ucGlpRmluZGluZ3MpO1xuICAgIH1cbiAgICBcbiAgICAvLyBTYWZldHkgY2hlY2tzXG4gICAgaWYgKGNzbTZDb25maWcuY2hlY2tzLnNhZmV0eSkge1xuICAgICAgY2hlY2tzUGVyZm9ybWVkLnB1c2goJ3NhZmV0eTpoYXJtZnVsLWNvbnRlbnQnKTtcbiAgICAgIGNvbnN0IGhhcm1GaW5kaW5ncyA9IGNoZWNrSGFybWZ1bENvbnRlbnQob3V0cHV0KTtcbiAgICAgIGZpbmRpbmdzLnB1c2goLi4uaGFybUZpbmRpbmdzKTtcbiAgICB9XG4gICAgXG4gICAgLy8gVHJhbnNwYXJlbmN5IChhbHdheXMgZW5hYmxlZClcbiAgICBjaGVja3NQZXJmb3JtZWQucHVzaCgndHJhbnNwYXJlbmN5OmF1ZGl0LXRyYWlsJyk7XG4gICAgXG4gICAgLy8gQ2FsY3VsYXRlIHN1bW1hcnlcbiAgICBjb25zdCBzdW1tYXJ5ID0gdGhpcy5jYWxjdWxhdGVTdW1tYXJ5KGZpbmRpbmdzKTtcbiAgICBcbiAgICAvLyBDYWxjdWxhdGUgcmlzayBzY29yZVxuICAgIGNvbnN0IHJpc2tTY29yZSA9IHRoaXMuY2FsY3VsYXRlUmlza1Njb3JlKGZpbmRpbmdzKTtcbiAgICBcbiAgICAvLyBEZXRlcm1pbmUgaWYgcGFzc2VkXG4gICAgY29uc3QgcGFzc2VkID0gIWZpbmRpbmdzLnNvbWUoZiA9PiBcbiAgICAgIGYuc2V2ZXJpdHkgPT09ICdjcml0aWNhbCcgfHwgZi5zZXZlcml0eSA9PT0gJ2hpZ2gnXG4gICAgKTtcbiAgICBcbiAgICByZXR1cm4ge1xuICAgICAgZmluZGluZ3MsXG4gICAgICBzdW1tYXJ5LFxuICAgICAgcmlza1Njb3JlLFxuICAgICAgcGFzc2VkLFxuICAgICAgcHJvZmlsZTogY3NtNkNvbmZpZy5wcm9maWxlLFxuICAgICAgY2hlY2tzUGVyZm9ybWVkLFxuICAgICAgbGltaXRhdGlvbnM6IHRoaXMuTElNSVRBVElPTlMsXG4gICAgICBtZXRob2RvbG9neTogdGhpcy5NRVRIT0RPTE9HWVxuICAgIH07XG4gIH1cbiAgXG4gIHByaXZhdGUgY2FsY3VsYXRlU3VtbWFyeShmaW5kaW5nczogRmluZGluZ1tdKTogQ1NNNlJlc3VsdFsnc3VtbWFyeSddIHtcbiAgICBjb25zdCBieVNldmVyaXR5OiBSZWNvcmQ8U2V2ZXJpdHksIG51bWJlcj4gPSB7XG4gICAgICBpbmZvOiAwLFxuICAgICAgbG93OiAwLFxuICAgICAgbWVkaXVtOiAwLFxuICAgICAgaGlnaDogMCxcbiAgICAgIGNyaXRpY2FsOiAwXG4gICAgfTtcbiAgICBcbiAgICBjb25zdCBieUNhdGVnb3J5OiBSZWNvcmQ8Q2F0ZWdvcnksIG51bWJlcj4gPSB7XG4gICAgICBzZWN1cml0eTogMCxcbiAgICAgIHByaXZhY3k6IDAsXG4gICAgICBzYWZldHk6IDAsXG4gICAgICBmYWlybmVzczogMCxcbiAgICAgIHJlbGlhYmlsaXR5OiAwLFxuICAgICAgZ292ZXJuYW5jZTogMFxuICAgIH07XG4gICAgXG4gICAgZm9yIChjb25zdCBmaW5kaW5nIG9mIGZpbmRpbmdzKSB7XG4gICAgICBieVNldmVyaXR5W2ZpbmRpbmcuc2V2ZXJpdHldKys7XG4gICAgICBieUNhdGVnb3J5W2ZpbmRpbmcuY2F0ZWdvcnldKys7XG4gICAgfVxuICAgIFxuICAgIHJldHVybiB7XG4gICAgICB0b3RhbDogZmluZGluZ3MubGVuZ3RoLFxuICAgICAgYnlTZXZlcml0eSxcbiAgICAgIGJ5Q2F0ZWdvcnlcbiAgICB9O1xuICB9XG4gIFxuICBwcml2YXRlIGNhbGN1bGF0ZVJpc2tTY29yZShmaW5kaW5nczogRmluZGluZ1tdKTogbnVtYmVyIHtcbiAgICBpZiAoZmluZGluZ3MubGVuZ3RoID09PSAwKSByZXR1cm4gMDtcbiAgICBcbiAgICBjb25zdCBzZXZlcml0eVdlaWdodHM6IFJlY29yZDxTZXZlcml0eSwgbnVtYmVyPiA9IHtcbiAgICAgIGluZm86IDAuMSxcbiAgICAgIGxvdzogMC4yLFxuICAgICAgbWVkaXVtOiAwLjQsXG4gICAgICBoaWdoOiAwLjcsXG4gICAgICBjcml0aWNhbDogMS4wXG4gICAgfTtcbiAgICBcbiAgICBsZXQgdG90YWxXZWlnaHQgPSAwO1xuICAgIGxldCBtYXhXZWlnaHQgPSAwO1xuICAgIFxuICAgIGZvciAoY29uc3QgZmluZGluZyBvZiBmaW5kaW5ncykge1xuICAgICAgY29uc3Qgd2VpZ2h0ID0gc2V2ZXJpdHlXZWlnaHRzW2ZpbmRpbmcuc2V2ZXJpdHldICogZmluZGluZy5jb25maWRlbmNlLnZhbHVlO1xuICAgICAgdG90YWxXZWlnaHQgKz0gd2VpZ2h0O1xuICAgICAgbWF4V2VpZ2h0ID0gTWF0aC5tYXgobWF4V2VpZ2h0LCB3ZWlnaHQpO1xuICAgIH1cbiAgICBcbiAgICAvLyBDb21iaW5lIGF2ZXJhZ2UgYW5kIG1heCBmb3IgZmluYWwgc2NvcmVcbiAgICBjb25zdCBhdmdXZWlnaHQgPSB0b3RhbFdlaWdodCAvIGZpbmRpbmdzLmxlbmd0aDtcbiAgICBjb25zdCBzY29yZSA9IGF2Z1dlaWdodCAqIDAuNiArIG1heFdlaWdodCAqIDAuNDtcbiAgICBcbiAgICByZXR1cm4gTWF0aC5taW4oMSwgc2NvcmUpO1xuICB9XG59XG4iXX0=