--- title: "Undominated · Adversarial suffix detection audit: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/undominated-adversarial-suffix-detection-audit/ description: "Checks a supplied perplexity-ratio assertion and anomaly threshold over local numeric input; a flag is a heuristic signal for review, not proof of an attack." --- # Undominated · Adversarial suffix detection audit: review, setup & limitations · Undominated.ai > Checks a supplied perplexity-ratio assertion and anomaly threshold over local numeric input; a flag is a heuristic signal for review, not proof of an attack. [← Explore all skills](/skills/) EVIDENCE AND EVALUATION / Undominated.ai # Undominated · Adversarial suffix detection audit Checks a supplied perplexity-ratio assertion and anomaly threshold over local numeric input; a flag is a heuristic signal for review, not proof of an attack. [See setup guidance ↓](#setup)[Original source ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher Undominated.ai Licence [MIT ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/LICENSE.txt) Revision 0a1d5d8143f5 [Read what was—and wasn’t—checked ↓](#review) “Check a perplexity-ratio assertion and a supplied anomaly threshold over local numeric input. A threshold flag is a heuristic signal for review, not proof of a GCG suffix, prompt injection, or an actual attack.” [Undominated.ai · upstream description ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Pairs a bounded numeric audit with an offline Python checker and an explicitly synthetic threshold-breach example. - Recomputes the ratio from supplied inputs instead of trusting the asserted anomaly ratio. - Distinguishes input errors, ratio-assertion mismatches and threshold breaches without claiming attack attribution. ### A good fit for - Review a proposed perplexity threshold against supplied observations before deciding what further model or security evaluation is needed. - Check a ratio assertion and threshold with explicit exit codes: 0 for a valid passing comparison, 1 for a breach or assertion mismatch, and 2 for invalid input. ### Weigh up before choosing - Does not measure perplexity, inspect prompts, execute a target model or establish detector accuracy. Input provenance and threshold suitability remain unverified; attack_detected means only that the unrounded ratio exceeded the supplied threshold. - Eight local regression tests cover the supplied numeric contract and CLI exit codes; they do not establish detector performance on real prompts or models. - Public GitHub source availability is not yet verified; the complete download contains the reviewed source. - A new npm install path is not yet verified. Use the complete source download. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/undominated-adversarial-suffix-detection-audit/SKILL.md - skills/undominated-adversarial-suffix-detection-audit/scripts/check.py - skills/undominated-adversarial-suffix-detection-audit/examples/synthetic.json ### Our findings - First-party resource authored by Undominated.ai; this is our own verification record, not an independent endorsement. - The download preserves the complete source and supporting files. Its manifest hashes identify the exact bytes. - The checker requires prompt_perplexity, baseline_normal_perplexity, anomaly_ratio and max_allowed_anomaly_ratio; the baseline must be positive and all inputs finite, non-negative numbers or decimal strings. - Exact fraction arithmetic recomputes the ratio and compares its unrounded value to the threshold. The supplied ratio must match two-decimal half-up rounding. - Eight local regression tests passed for benign input, threshold equality and a small breach, half-up rounding, forged and old ratio assertions, invalid or missing values, and CLI exit codes 0/1/2. The synthetic 245.8 / 32.4 example reports 7.59 and exits 1 with FLAGGED. - The compatibility field attack_detected records a numeric threshold breach only; no model execution or actual attack detection was tested. ### Not established by this review - Perplexity measurement or provenance of supplied observations - Accuracy against real GCG suffixes, prompt injections or other attacks - Suitability of a chosen anomaly threshold - Model compliance with these instructions on arbitrary tasks - Native integration in every agent host - Public GitHub source identity - Remote installation through the standard Skills CLI - The new npm resource CLI installation The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) - Download the complete bundle from https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/bundle.zip and extract it into a new directory. - Place the extracted directory at .agents/skills/undominated-adversarial-suffix-detection-audit/ or your host's documented skills directory. Preserve SKILL.md, scripts, examples and licence files together. - Run the documented synthetic example from the skill directory with Python 3.10 or later before using your own evidence. ### Before you start - An Agent Skills compatible host - Python 3.10 or later for the optional checker ### Compatibility Agent Skills compatible hosts · Python 3.10+ ### Implementation Python · Markdown ### Local, explicit inputs - read:user-selected-local-file ### Cost model MIT source at no charge. Your agent host or model provider may charge for use; the included offline checks require no paid API. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download complete resource + licence ↗](/resources/skills/undominated-adversarial-suffix-detection-audit/bundle.zip)[Raw Markdown ↗](/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) # Adversarial suffix detection audit ## Description Check a perplexity-ratio assertion and a supplied anomaly threshold over local numeric input. A threshold flag is a heuristic signal for review, not proof of a GCG suffix, prompt injection, or an actual attack. ## Category `evaluation` ## Tags `evaluation`, `security`, `jailbreak`, `gcg`, `perplexity` ## When to Use Review a proposed perplexity threshold against supplied observations before deciding what further model or security evaluation is needed. ## Operational Limitations The checker does not measure perplexity, inspect prompts, execute a target model, or establish detector accuracy. It recomputes a ratio from the supplied numbers; their provenance and a threshold's suitability remain unverified. The compatibility field `attack_detected` means only that the unrounded ratio exceeded the supplied threshold. It is not attack attribution or a security verdict. ## Input Contract Supply a JSON object containing these four numeric fields (JSON numbers or decimal strings): - `prompt_perplexity`: finite and non-negative. - `baseline_normal_perplexity`: finite and strictly positive. - `anomaly_ratio`: the asserted quotient `prompt_perplexity / baseline_normal_perplexity`, rounded to two decimal places using half-up rounding. - `max_allowed_anomaly_ratio`: a finite, non-negative threshold. Boolean, missing, nonnumeric, nonfinite and negative values are invalid. The reported ratio and threshold must fit finite JSON numbers. Threshold comparison uses the exact, unrounded quotient: equality passes, and any value above the threshold flags even if the displayed two-decimal ratio equals the threshold. A mismatched `anomaly_ratio` assertion also requires review; it cannot hide a threshold breach. ## Verification Script Run the deterministic verification checker: ```bash python3 scripts/check.py examples/synthetic.json ``` The supplied example intentionally exceeds its threshold and returns **1** with `status: FLAGGED`. Its quotient is `245.8 / 32.4`, whose two-decimal half-up assertion is `7.59`. Exit codes: - `0`: Valid input, a matching ratio assertion and a ratio at or below the threshold. - `1`: Threshold breach or ratio-assertion mismatch; review the structured `issues`. - `2`: Schema error, unreadable input or invalid usage; see the structured error. The download contains SKILL.md . Extract the whole bundle; the supporting files are required. Inspect the included MANIFEST.json for file hashes. By **Undominated.ai**. [Exact upstream source ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) · [Licence](/resources/skills/undominated-adversarial-suffix-detection-audit/LICENSE.txt) · [Attribution](/resources/skills/undominated-adversarial-suffix-detection-audit/ATTRIBUTION.txt) SHA-256 0a1d5d8143f5146aace29234f376214d22d518de1d6e911b7c78a92d55c417fa Read the applicable licence MIT License Copyright (c) 2026 Undominated.ai Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Original Undominated definition ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md) Checked 2026-10-14 https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/definition.md Supports: Workflow and input requirements, Stated limitations - [MIT licence ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/LICENSE.txt) Checked 2026-10-14 https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/LICENSE.txt Supports: Redistribution terms and attribution - [Complete source bundle ↗](https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/bundle.zip) Checked 2026-10-14 https://undominated.ai/resources/skills/undominated-adversarial-suffix-detection-audit/bundle.zip Supports: Full local source, supporting files and integrity manifest KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Undominated · ASCII art jailbreak evasion audit ↗ Audits ASCII art spatial obfuscation and safety alignment bypass resistance in prompt inputs.](/skills/undominated-ascii-art-jailbreak-evasion-audit/)[### Undominated · Prompt Extraction & Leakage Resilience Audit ↗ Evaluates system prompt confidentiality retention under adversarial prompt extraction and reconstruction attacks.](/skills/undominated-prompt-leakage-resilience-audit/)[### Undominated · System prompt extraction guard audit ↗ Audits resistance against system prompt leakage attacks and multi-turn extraction attempts.](/skills/undominated-system-prompt-extraction-guard-audit/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)