fix(injection-defense): detect single-bracket [INST]/[/INST] delimiter (#353)

[gnanirahulnutakki]

Root cause

crates/injection-defense/src/pattern.rs — the delimiter_injection
signature was r"\[\[INST\]\]|<\|im_start\|>". The \[\[INST\]\] alternative
requires a doubled bracket, so it only fired on [[INST]]. The delimiter
attackers actually use to smuggle a new turn/role — the single-bracket
Llama/Mistral chat-template markers [INST] and [/INST] — matched nothing
and passed the filter unflagged. Verified in-tree: the other delimiter
signatures (system_directive_delimiter, role_tag_delimiter, <|im_start|>)
did not cover this form, so single-bracket [INST] was a genuine gap.

Fix

Widen the one regex to:

(?i)\[\s*/?\s*INST\s*\]|<\|im_start\|>|<</?SYS>>

• Matches [INST], [/INST], the doubled [[INST]] (inner match), and
  internal-whitespace forms like [ INST ].
• Adds the closely related Llama system-block delimiters <<SYS>> / <</SYS>>
  that pair with [INST].
• Keeps <|im_start|> (ChatML).
• Anchored to exactly INST/SYS + closing bracket, so benign bracketed text
  — [INSTALL], [INSTRUCTIONS], [INFO], [INSTANCE], array indexing
  a[0] — does not match. No false positives.

Tightest possible scope: one signature line changed, no new dependencies,
Cargo.lock untouched.

Regression tests

New crates/injection-defense/tests/inst_delimiter_variants.rs, both directions:

• inst_delimiter_variants_are_blocked — [INST], [/INST], [[INST]],
  [ INST ], <s>[INST], <<SYS>>…<</SYS>> all → Block + DelimiterAbuse.
• benign_bracketed_text_is_not_flagged — [INSTALL], [INSTRUCTIONS],
  [INFO], a[0], [INST. of Tech], [instance] all → Allow, no
  DelimiterAbuse.

Verification (all green locally)

• cargo test -p ardur-injection-defense — pass (incl. 2 new tests)
• cargo test -p ardur-e2e-tests — pass
• cargo clippy -p ardur-injection-defense --all-targets -- -D warnings — clean
• cargo fmt --check — clean

Fixes #353

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 45be49fa-be66-4cc2-b18d-28f353865c0e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/353-inst-delimiter

---

_{Comment @coderabbitai help to get the list of available commands.}