Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces seven novel prompt injection detection techniques inspired by diverse fields like forensic linguistics and bioinformatics, aiming to overcome the limitations of pattern matching and fine-tuned classifiers. Three of these techniques—local sequence alignment, stylometric analysis, and fatigue tracking—are implemented and evaluated across six datasets. Results show significant F1 score improvements, particularly with local alignment boosting performance on the deepset dataset from 0.033 to 0.378 and stylometric analysis improving indirect injection detection by 11.1 percentage points.
Prompt injection defenses get a major upgrade: borrowing ideas from fields like epidemiology and economics yields detectors that leapfrog the limitations of regexes and fine-tuned classifiers.
Current open-source prompt-injection detectors converge on two architectural choices: regular-expression pattern matching and fine-tuned transformer classifiers. Both share failure modes that recent work has made concrete. Regular expressions miss paraphrased attacks. Fine-tuned classifiers are vulnerable to adaptive adversaries: a 2025 NAACL Findings study reported that eight published indirect-injection defenses were bypassed with greater than fifty percent attack success rates under adaptive attacks. This work proposes seven detection techniques that each port a specific mechanism from a discipline outside large-language-model security: forensic linguistics, materials-science fatigue analysis, deception technology from network security, local-sequence alignment from bioinformatics, mechanism design from economics, spectral signal analysis from epidemiology, and taint tracking from compiler theory. Three of the seven techniques are implemented in the prompt-shield v0.4.1 release (Apache 2.0) and evaluated in a four-configuration ablation across six datasets including deepset/prompt-injections, NotInject, LLMail-Inject, AgentHarm, and AgentDojo. The local-alignment detector lifts F1 on deepset from 0.033 to 0.378 with zero additional false positives. The stylometric detector adds 11.1 percentage points of F1 on an indirect-injection benchmark. The fatigue tracker is validated via a probing-campaign integration test. All code, data, and reproduction scripts are released under Apache 2.0.