Search papers, labs, and topics across Lattice.
This paper evaluates prompt injection detection methods across diverse deployment regimes, considering factors like model choice, data distribution shifts, and evaluation metrics beyond ranking. The authors introduce interpretable structural signals to capture prompt injection patterns, assessing their effectiveness alone and in conjunction with transformer-based detectors. Results demonstrate that detection performance is highly regime-dependent, emphasizing the need for deployment-aware evaluation and highlighting the value of structural signals in specific scenarios, particularly for maintaining low false positive rates.
Prompt injection detection performance varies wildly across deployment settings, so relying on leaderboard rankings alone could leave your LLM vulnerable.
Prompt injection poses a critical threat to the safe deployment of large language models, yet existing detection approaches are typically evaluated under limited settings that do not reflect real-world operating constraints. In this work, we present a deployment-aware evaluation of prompt injection detection using a multi-model and multi-regime experimental framework. We compare lexical, semantic, structural, and transformer-based detectors across multiple out-of-distribution settings, repeated data splits, and both ranking and thresholded deployment metrics. We introduce interpretable structural signals that capture hierarchy overrides, system prompt spoofing, role redefinition, and evasion patterns, and assess their contribution both within sparse models and in combination with strong encoder baselines. Our results show that detection performance is highly regime-dependent and sensitive to threshold selection, with no single model dominating across all settings. Transformer-based models achieve the strongest overall performance, while structural signals provide modest but consistent gains in certain regimes and improve low false positive rate behaviour in harder scenarios. These findings highlight the gap between ranking performance and deployment effectiveness and underscore the importance of evaluating prompt injection defences under realistic operational constraints. Code will be released.
