Injection defence

Quarantine: instructions are not memories

Text that tries to instruct the model is stored, quarantined, and withheld until the tenant's reviewer releases it.

What gets quarantined

The canonical CAIN detector (cain/cain_injection_detector.py) normalises Unicode (NFKC, format characters stripped, homoglyphs folded, whitespace collapsed, casefolded), decodes one layer of base64/hex/percent encoding, and matches instruction-override, task-switch, role-hijack, prompt-exfiltration and forced-output families. It is deterministic and makes no model call.

What quarantine means, precisely

• The memory is stored, not rejected. Rejecting it would hide the attempt.
• status is quarantined and quarantine_reason names the family that matched.
• Recall never returns its text. include_quarantined: true lists it with text: null and withheld; the text is shown only with the reviewer secret (until 2026-11-02 it was returned).
• Text, tags and source are all screened, after Unicode tag characters (hidden ASCII) are decoded.
• It cannot be deleted into silence without leaving a chained tombstone.
• Release requires the tenant's reviewer secret (X-CAIN-Reviewer) and a name in reviewed_by; the release is appended to the chain with the reviewer recorded.

Why a reviewer secret, not just a name

An automatic release rule is just a second injection surface: whatever can write the memory can also learn the rule that un-quarantines it. Until 2026-11-02 a typed name was enough, and the agent that wrote the memory could type one. Now the person who reviews sets a secret once with POST /aether33/api/reviewer (only a salted hash is kept; changing it needs the old one) and keeps it away from the agent. Set it before the agent gets the tenant key: whoever sets it first holds it. The name still records *who* decided, in a chain that cannot be edited afterwards.

The detector's real limits

This is pattern matching. It misses paraphrases, other languages, and semantic injections that use no override vocabulary. It is one layer. The measured recall and false-positive figures for the shared detector live in benchmarks/memory_sanitizer/ and are not restated here as though they were AETHER-33's own numbers.