How Sunglasses
actually works

One input. Four layers. Every miss teaches the next.

Most AI input scanners are one-layer. A single ML classifier, or a single guardrail, or a single keyword list. Sunglasses runs a cascade: each layer handles what it’s best at, and only escalates what it can’t resolve.

Layers 0 and 1 are shipped in the current release line. Layers 2 and 3 are planned for v0.3.0. The cascade routing rule is simple: if an earlier layer is confident, skip the rest. The 0.26 ms figure shown on this page comes from our internal Apr 11 benchmark corpus, not an external benchmark suite.

Neutralize the tricks before you start matching

Signature scanners get called “2005 antivirus” because attackers rewrite payloads faster than keyword lists can grow. The fix isn’t more keywords. The fix is deleting the rewrites before the keyword list ever sees the input.

Every scan runs through a deterministic normalization pipeline first. Homoglyphs become ASCII. Base64 gets decoded. Zero-width Unicode gets stripped. Spaced letters collapse. ROT13 gets a second pass. Shape confusion (lowercase l looking like capital I) gets its own variant. All of it runs in under a millisecond.

The whole pipeline is <200 lines of Python, runs synchronously, has no external dependencies beyond the standard library, and is readable in one sitting. Here’s the entry point:

# preprocessor.py
def normalize(text: str) -> str:
    # 17-technique pipeline. Deterministic. Sub-millisecond.
    text = strip_invisible(text)          # zero-width chars
    text = normalize_unicode(text)        # NFKC fold
    text = replace_homoglyphs(text)       # Cyrillic, Greek, Ukrainian, Latin fullwidth
    text = decode_html_entities(text)     # I -> I
    text = decode_url_encoding(text)      # %49    -> I
    text = decode_hex_escapes(text)       # \x49   -> I
    text = decode_base64_segments(text)   # SWdub3Jl -> Ignore
    text = decode_leetspeak(text)         # 1gn0r3 -> ignore
    text = strip_delimiter_padding(text)  # i.g.n.o.r.e -> ignore
    text = collapse_whitespace(text)      # tabs, multi-space -> single space
    rot = decode_rot13(text)              # enrichment only (append)
    if rot != text: text = text + " " + rot
    text = text + " " + text[::-1]  # reverse enrichment
    text = text.lower()
    shape = re.sub(r'\bl(?=[a-z])', 'i', text)
    if shape != text: text = text + " " + shape
    return text

Full source: sunglasses/preprocessor.py. MIT licensed. Copy it, fork it, improve it, PR it back.

Aho-Corasick on normalized text

Once Layer 0 has neutralized the tricks, Layer 1 does the fast work: a compiled Aho-Corasick automaton scans the normalized string for 1,273 keywords across 227 patterns in 33 attack categories. O(n) in the length of the input regardless of keyword count.

Categories include: prompt injection (direct, indirect, and multilingual variants), persona override / DAN-family jailbreaks, system prompt exfiltration (direct + soft framings), tool poisoning (MCP manifest, README, hidden notes), paraphrased directive overrides, hypothetical / roleplay framings, authority impersonation, social engineering, credential exfiltration, SSRF in agent tools, memory poisoning, supply chain detections (from GHSA advisories), and more.

Every pattern is a plain Python dict with id, name, category, severity, channel, keywords or regex, and description. Adding a new attack class takes five minutes and a pull request. The community can contribute.

78 tests. 12 categories. Real numbers.

We built an internal adversarial corpus covering twelve attack classes (AgentDojo canonical templates, paraphrase variants with no keyword overlap, roleplay persona overrides, low-resource language translations, obfuscation bypasses, advanced encodings, social engineering, system override framings, soft exfiltration, multi-step chained payloads, tool poisoning, and benign controls for false positive checking).

On April 11, 2026 we ran this internal corpus against the baseline engine, documented every miss, applied targeted fixes on a local patch branch, and reran the same corpus. The delta below reflects that internal regression cycle.

Same problem. Different philosophy. Better together.

Many AI agent security approaches include ML classifiers or LLM-based judges. Sunglasses uses a deterministic-first cascade and adds semantic escalation only when confidence is low.

Our philosophy is deterministic first, semantic escalation when needed. Layer 0 normalization and Layer 1 pattern matching are local and fast. Most inputs resolve there. Ambiguous inputs can escalate to an optional ML classifier (v0.3.0), and only high-risk low-confidence cases can escalate to an optional local LLM judge (v0.3.0). This preserves low average latency while improving robustness on semantic attacks.

We also believe the base layer should be fully local, fully open source, and readable in one sitting. That’s not marketing. It’s a design constraint: if the “free” version of a security tool can’t protect a developer who has no budget, it doesn’t deserve to be called open source.

You can run Sunglasses alongside Lakera or Rebuff. The cascade catches different classes of attack than they do, and fires in different latency regimes. Better together.

What is Sunglasses and how does it work?

Common questions about the Sunglasses AI agent input scanner — answered directly for fast reading and for AI agents and answer engines that cite this page.