LLM 生产安全检查清单：上线前必须过的 50 项

# Prompt 注入检测器
class PromptInjectionGuard:
    INJECTION_PATTERNS = [
        r"ignore\s+(all\s+)?(previous|above|prior)\s+instructions",
        r"you\s+are\s+now\s+(a|an)\s+\w+",
        r"system\s*:\s*",
        r"<\|im_start\|>",
        r"forgot\s+your\s+rules",
        r"reveal\s+your\s+(system\s+)?prompt",
    ]

    def check(self, user_input: str) -> tuple[bool, list]:
        import re
        violations = []
        for pattern in self.INJECTION_PATTERNS:
            if re.search(pattern, user_input, re.IGNORECASE):
                violations.append(pattern)
        return len(violations) == 0, violations

import re

class PIIScrubber:
    PATTERNS = {
        "phone": (r"\b1[3-9]\d{9}\b", "[PHONE]"),
        "email": (r"\b[\w.-]+@[\w.-]+\.\w+\b", "[EMAIL]"),
        "id_card": (r"\b\d{17}[\dXx]\b", "[ID_CARD]"),
        "bank_card": (r"\b\d{16,19}\b", "[BANK_CARD]"),
    }

    def scrub(self, text: str) -> str:
        for pii_type, (pattern, replacement) in self.PATTERNS.items():
            text = re.sub(pattern, replacement, text)
        return text

class OutputSafetyFilter:
    def __init__(self, toxicity_model, threshold=0.7):
        self.model = toxicity_model
        self.threshold = threshold

    async def filter(self, response: str) -> tuple[str, bool]:
        # 毒性检测
        toxicity = await self.model.predict(response)
        if toxicity > self.threshold:
            return self._safe_fallback(), False

        # 敏感信息泄露检测
        if self._detect_leaked_info(response):
            return self._safe_fallback(), False

        return response, True

    def _detect_leaked_info(self, text):
        """检测输出中是否泄露了系统信息"""
        sensitive_patterns = [
            r"api[_-]?key", r"sk-[a-zA-Z0-9]{20,}",
            r"password", r"secret", r"token",
            r"/[a-z]:\\users\\",  # Windows 路径
        ]
        return any(
            re.search(p, text, re.IGNORECASE)
            for p in sensitive_patterns
        )

class JailbreakDetector:
    ENCODING_PATTERNS = [
        (r"base64:", self._decode_base64),
        (r"\\u[0-9a-fA-F]{4}", self._decode_unicode),
        (r"\\x[0-9a-fA-F]{2}", self._decode_hex),
    ]

    async def check(self, user_input: str):
        # 1. 检查编码内容
        decoded = self._try_decode(user_input)
        if decoded != user_input:
            # 对解码后的内容也做注入检测
            safe, _ = PromptInjectionGuard().check(decoded)
            if not safe:
                return False, "Encoded injection detected"

        # 2. 检查角色扮演越狱
        roleplay_patterns = [
            r"pretend you are",
            r"act as (if you are )?DAN",
            r"you are (in )?developer mode",
            r"jailbreak",
        ]
        for pattern in roleplay_patterns:
            if re.search(pattern, user_input, re.IGNORECASE):
                return False, f"Roleplay jailbreak: {pattern}"

        return True, None

class SecurityChecklist:
    """可自动化的安全检查项"""

    CHECKS = {
        "input_length_limit": {"auto": True, "critical": False},
        "prompt_injection_filter": {"auto": True, "critical": True},
        "pii_scrubbing": {"auto": True, "critical": True},
        "output_toxicity_check": {"auto": True, "critical": True},
        "output_length_limit": {"auto": True, "critical": False},
        "jailbreak_resistance": {"auto": True, "critical": True},
        "prompt_leak_prevention": {"auto": True, "critical": True},
        "tls_check": {"auto": True, "critical": True},
        "log_pii_check": {"auto": True, "critical": True},
        "rate_limiting": {"auto": True, "critical": False},
    }

    async def run_all(self, target_url, api_key):
        results = {}
        for check_name, config in self.CHECKS.items():
            if not config["auto"]:
                continue
            method = getattr(self, f"check_{check_name}")
            try:
                passed, detail = await method(target_url, api_key)
                results[check_name] = {
                    "passed": passed,
                    "detail": detail,
                    "critical": config["critical"],
                }
            except Exception as e:
                results[check_name] = {
                    "passed": False,
                    "detail": f"Check error: {e}",
                    "critical": config["critical"],
                }

        # 汇总报告
        total = len(results)
        passed = sum(1 for r in results.values() if r["passed"])
        critical_fail = [
            k for k, v in results.items()
            if not v["passed"] and v["critical"]
        ]

        return {
            "total": total,
            "passed": passed,
            "failed": total - passed,
            "critical_failures": critical_fail,
            "ready_for_production": len(critical_fail) == 0,
            "details": results,
        }

开发完成 → 自动化检查（38 项可自动化）
              │
         全部通过？
         ├─ 是 → 人工审查（12 项需人工）
         │        ├─ 全部通过 → 安全团队签字 → 上线
         │        └─ 有问题 → 整改 → 重新审查
         └─ 否 → 修复 → 重新自动检查