LangChain Python Prompt Injection | Gate the Model Call

Your Python support chain should answer the authorized request without reading another customer’s records or issuing an unapproved refund. Build those permissions into the server, and screen the exact history and retrieval your chain will consume before its model call.

The LangChain integration guide covers framework handoffs. Here, the HTTP factory makes the checked input explicit. Callbacks add lifecycle checks where registered, with coverage determined by the callback input and the chain’s propagation path.

Where does a callback check sit?

Trace each model handoff, including nested chains and tool loops. A shared factory gives supported calls one enforced path. A callback helps inspect framework events, but registration alone does not prove that every model invocation receives it.

LangChain’s callback reference names model-start and tool-end hooks. The checked-in SafePrompt Python adapter uses those events as follows:

• on_llm_start and on_chat_model_start inspect prompt text before supported model calls. The chat variant serializes message content as text; it does not preserve every role, tool identifier or multimodal part.
• on_tool_end fires after a tool finishes. It can inspect that result, but cannot stop the action that produced it. Returned content can carry indirect prompt injection: a scraped page or retrieved document carrying hidden instructions. A chat-box-only filter never sees it.

The checked-in adapter sets raise_error = True and run_inline = True so its exceptions can propagate through supported callback paths. Verify error propagation in your installed chain. The HTTP gate below also checks the response schema before trusting a verdict.

Install and wire it in

The first tab is an enforced HTTP gate with explicit chain dependencies. The second is optional callback observation; the third checks a tool result before its next model handoff. The examples support text context and a chain expecting the single input field.

import os
import requests

def safe_llm_call(user_input, end_user_ip, run_model):
    if not isinstance(user_input, str) or not user_input.strip() or not end_user_ip:
        return {"status": 400, "error": "Invalid request"}
    try:
        response = requests.post(
            "https://api.safeprompt.dev/api/v1/validate",
            headers={"X-API-Key": os.environ["SAFEPROMPT_API_KEY"],
                     "X-User-IP": end_user_ip, "Content-Type": "application/json"},
            json={"prompt": user_input, "sensitivity": "strict"}, timeout=5,
        )
        response.raise_for_status()
        verdict = response.json()
        if not isinstance(verdict, dict) or type(verdict.get("safe")) is not bool:
            raise ValueError("Invalid verdict")
    except (requests.RequestException, ValueError, KeyError):
        return {"status": 503, "error": "Validation unavailable"}
    if not verdict["safe"]:
        return {"status": 403, "error": "Input rejected"}
    return {"status": 200, "result": run_model(user_input)}

def create_safe_chain(chain, resolve_caller, build_context):
    def invoke(request, user_input):
        caller = resolve_caller(request)
        if not caller or not caller.get("user_id") or not caller.get("ip"):
            return {"status": 401, "error": "Unauthorized"}
        if not isinstance(user_input, str) or not user_input.strip():
            return {"status": 400, "error": "Invalid input"}
        context = build_context(caller["user_id"], user_input)
        # Chain accepts only this string as variable model context.
        return safe_llm_call(context, caller["ip"],
                             lambda checked: chain.invoke({"input": checked}))
    return invoke

# build_context authorizes records and preserves task/history/document labels.
# The chain's fixed instructions are server-owned; append no unchecked variables.

Before and after

These fragments show an unchecked invocation and the explicit factory handoff. Supply the chain, authenticated caller resolver and authorized context builder before using the gated version.

# Intentionally unchecked illustration
chain.invoke({"input": user_input})

# Compose the complete HTTP helper and factory from the first tab.
safe_invoke = create_safe_chain(chain, resolve_caller, build_context)
result = safe_invoke(request, user_input)

The abridged JSON below illustrates a response shape, without a new detector measurement. Require type(verdict["safe"]) is bool; a string or integer is a schema error.

{ "safe": false, "threats": ["jailbreak_instruction_override"], "confidence": 0.95 }

{ "safe": true, "threats": [], "confidence": 0.95 }

Tune before you enforce

Use callback log mode to inspect representative staging traffic while the enforced path remains explicit. A flagged log event does not stop inference. Decide enforcement from observed attack outcomes and ordinary controls, using a workload representative of your app.

• on_provider_error: fail-closed (default) stops the chain if SafePrompt is unreachable; fail-open lets it continue. Pick based on whether availability or safety is your priority.
• sample_rate: controls optional callback sampling. A value of 0.1 checks only a sample; it cannot enforce every model input. Keep the HTTP gate unsampled on protected calls.

What SafePrompt covers

SafePrompt screens submitted instruction attempts. Your application owns the exact context handoff and the verdict branch. Permissions and output decisions stay beside their data and tools.

Manual approach vs the handler

If you want the framework-agnostic version of this, or you are on TypeScript, the LangChain prompt injection guide shows the manual requests and fetch pattern, plus a LangGraph guard node. The JS package is @safeprompt.dev/langchain. Both call the same endpoint.

What do model roles and permissions enforce?

Further reading

• LangChain prompt injection, the manual validation pattern in Python, TypeScript, and LangGraph.
• Can AI agents be hacked? Agent attack vectors and permissions before tool execution.
• What is indirect prompt injection? How tool output and retrieved text can carry instructions.
• How to prevent prompt injection, framework-agnostic defense.
• SafePrompt API reference.