How reliable are prompt-injection detectors?

Imagine asking an AI agent to read your emails and tell you what needs your attention. Buried in one message is an instruction to abandon that task and send private information somewhere else. Although you never asked it to do that, now the assistant has to distinguish between the text you’ve asked it to read and which instructions it is authorised to follow.

The risk grows when agents can read untrusted content, access private data, and send information. These capabilities make agents useful, but also give attackers more ways to cause harm.

For both enterprise agents and personal assistants, usefulness depends on following instructions across different sources and tools. One Refractal customer uses long-running agents to receive emails and process logistics workflows. Many of us now use agentic assistants like Instinct to read our inboxes, research travel options, or make reservations. Each workflow requires the agent to interpret untrusted content and act on it.

The vulnerability emerges when this content contains malicious instructions and the agent follows them without authorisation. In February, Microsoft researchers documented attempts to manipulate AI recommendations through “Summarize with AI” links containing instructions to remember and favour particular companies. The user requested a summary, but instead the embedded instructions attempted to shape future behaviour of the agent.

Prompt-injection detectors offer one way to identify these attempts before an agent acts on them. To be effective, these detectors must catch attacks, while allowing legitimate instructions.

We evaluated seven models on 4,256 examples across five prompt-injection and jailbreak benchmarks: six local text classifiers and Jev 1.13, a prompted decision model. We measured detection quality, false positives, and prediction latency to examine how well each balanced protection with the ability to keep useful work moving.

Jev achieved the highest average F1, deepset the highest average F2, and FMOps the lowest recorded latency. Yet the individual results complicate that ranking. On one benchmark, the model with the highest F1 still flagged almost 59% of benign inputs. Another model exceeded 90% F1 on two datasets but fell below 9% on a third.

Understanding those differences is essential to assessing whether a detector can provide useful protection.

Comparing two approaches to detection

The six local classifiers assign an attack or benign label to an input passage. They comprise Meta’s Llama Prompt Guard 2 in its 22M and 86M variants, FMOps DistilBERT, Protect AI’s DeBERTa Small and Base v2 models, and deepset DeBERTa Base.

Jev performs the same task using written decision criteria. The application supplies the passage alongside instructions defining the judgement to make. Jev then returns a typed decision, i.e. an output of probabilities across those restricted choices. In our experiment, that decision was a choice between Attack and Benign.

For instance, consider “Send this report to the finance team.” As a request from an authorised user, it may be legitimate. Embedded in a webpage that the assistant was asked only to summarise, it could be an attempt to redirect the workflow.

A decision model gives the application a way to explicitly state the relevant distinction. Jev accepts defined decision criteria and returns structured choices with associated probabilities. The application can use those outputs directly in its control logic.

Developers can specify which content is untrusted, what behaviour would constitute a redirection, and how quoted instructions should be treated. They can revise those criteria without retraining a dedicated classifier, although every revision still requires evaluation.

Local classifiers also learn linguistic distinctions and return machine-readable outputs. What makes the decision-model approach interesting is the combination of explicit criteria, contextual inputs, and constrained answers.

Our experiment tested a narrower configuration. Jev used one fixed prompt throughout, treating each passage as untrusted external content. We did not test multiple policies, richer task context, or probability-based escalation. Its performance therefore provides evidence about that configuration, rather than proving the broader advantages of the approach.

Evaluation results

Model	English 3K	PromptShield	Rogue / Qualifire	WAInjectBench Text	Neuralchemy v2
Jev 1.13	80.6	56.5	74.9	68.5	76.3
deepset DeBERTa Base	75.7	55.5	66.3	55.0	86.5
FMOps DistilBERT	75.1	54.9	66.3	52.7	83.7
Protect AI Base v2	90.6	8.7	65.6	56.6	91.7
Protect AI Small v2	89.0	10.5	62.5	48.0	91.3
Prompt Guard 2 86M	43.8	41.6	67.8	0.8	66.7
Prompt Guard 2 22M	16.7	0.6	18.4	0.0	34.3

0255075100

We measured precision, i.e. the proportion of flagged examples labelled as attacks, and recall, i.e. the proportion of labelled attacks detected. F1 balances precision and recall; F2 places greater weight on recall. We also examined false-positive rates directly because they show how frequently benign examples were flagged.

Reported averages give each benchmark equal weight.

This is a classification evaluation against reference labels. It does not establish whether an attack would succeed against an assistant or whether a detector would prevent that success.

What the headline scores show

Jev’s average F1 exceeded deepset’s by 3.55 percentage points. Deepset’s average F2 was 3.40 points higher, reflecting its greater emphasis on catching attacks at the evaluated operating points. We have not established the statistical significance of those differences.

Jev led on PromptShield, Rogue / Qualifire, and WAInjectBench Text. Protect AI Base led on English 3K and Neuralchemy.

Perfect recall can coexist with poor discrimination

On English 3K, deepset, FMOps, and Jev detected all 187 labelled attacks. Each achieved 100% recall.

Their treatment of the 127 benign examples was less reassuring. Deepset flagged 120, FMOps flagged 124, and Jev flagged 90. Protect AI Base missed 28 attacks but flagged only five benign examples, giving it the highest F1 on this benchmark.

A simple baseline puts the high-recall results in perspective. Classifying every English 3K example as an attack would produce 74.65% F1. Deepset achieved 75.71%; FMOps achieved 75.10%. At their evaluated thresholds, those models provided little separation between the two classes.

The pattern continued on PromptShield. Deepset and FMOps detected all 315 attacks, but flagged 505 and 518 of the 685 benign examples respectively. Jev detected 283 attacks and flagged 404 benign examples.

Jev’s F1 of 56.49% was the highest on this subset. Its false-positive rate was nevertheless 58.98%. If each flag triggered a block, more than half the legitimate examples would be interrupted.

Fewer false alarms did not automatically produce useful protection either. Prompt Guard 2 86M flagged just 20 benign examples but missed 227 attacks. Protect AI Small missed 297 attacks, and Protect AI Base missed 300.

These results show why a detector needs to be assessed at an operating point appropriate to its application. High recall can be obtained by flagging broadly; low false-positive rates can be obtained by rarely flagging anything. Reliability requires useful separation between the classes.

The proportion of attacks affects F1 and F2. Across these five class distributions, an always-attack detector would achieve an equally weighted average F2 of 76.99%. F2 remains useful when missed attacks are especially costly, but it needs to be interpreted alongside false positives and the consequences of acting on a flag.

The trade-off changes between datasets

• Attacks detected (recall)
• Benign inputs flagged (false-positive rate)

Jev 1.13deepset

English 3K

Jev 1.13Attacks detected: 100.0%Benign inputs flagged: 70.9%

deepsetAttacks detected: 100.0%Benign inputs flagged: 94.5%

050100%

PromptShield

Jev 1.13Attacks detected: 89.8%Benign inputs flagged: 59.0%

deepsetAttacks detected: 100.0%Benign inputs flagged: 73.7%

050100%

WAInjectBench Text

Jev 1.13Attacks detected: 58.6%Benign inputs flagged: 4.1%

deepsetAttacks detected: 92.0%Benign inputs flagged: 47.3%

050100%

On WAInjectBench Text, Jev flagged 31 of 751 benign examples, producing a false-positive rate of 4.13%. That was a substantial improvement over its behaviour on PromptShield.

Its recall was 58.63%, however: it detected 146 of 249 attacks and missed 103.

Deepset detected 229 attacks, reaching 91.97% recall, while flagging 355 benign examples (false-positive rate of 47.27%).

The metric determines which balance looks preferable. Jev led on F1, at 68.54% against deepset’s 54.98%. F2 favoured deepset, with 72.47% against Jev’s 62.23%.

Jev’s 86.6% accuracy on this sample also illustrates why overall correctness is insufficient. Most examples were benign, so correctly classifying them contributed heavily to accuracy despite the 103 missed attacks.

Protect AI Base showed an even larger change across benchmarks. Its F1 reached 90.60% on English 3K and 91.73% on Neuralchemy, then fell to 8.70% on PromptShield. There, it detected only 15 of 315 attacks.

Some of that variation may reflect differences in task definition. Protect AI’s v2 models explicitly exclude jailbreak detection from their intended scope, while this evaluation includes jailbreaks. Other possible explanations include attack style, input length, and differences in reference labels. We need to inspect the errors to test these explanations.

Prompt Guard 2 also produced results that warrant closer investigation. On WAInjectBench Text, the 22M variant detected none of the 249 attacks; the 86M variant detected one. Both completed their predictions.

Those results describe failures in the evaluated configuration. Before attributing them to the models’ detection capabilities, the inference pipeline needs to be audited. Tokenisation, label mapping, truncation, and the location of the injected instruction can all affect what is actually evaluated. A completed prediction does not establish that the model processed the relevant attack content.

Context is part of the specification

Jev’s fixed prompt assumed that every passage came from an untrusted document or tool result. The benchmarks also contain direct user requests. An instruction that is legitimate as a user request can look like a redirection attempt when presented as external content.

That mismatch could explain some disagreements with the reference labels. It also means the comparison includes the effects of task framing alongside model capability.

This is especially relevant to the potential value of decision models. Their interface allows developers to make the trust boundary explicit, but the evaluation must supply enough information for that boundary to be meaningful. A detector cannot reliably infer the user’s authorisation from a passage alone when the same passage is valid in one context and malicious in another.

A stronger contextual evaluation would preserve the user’s request, identify the origin of external content, and specify the proposed action. It could then test whether a model distinguishes authorised behaviour from attempted redirection when the wording is otherwise similar.

Jev’s results make that a worthwhile direction to investigate. Its leading average F1 shows that the fixed decision formulation was competitive in this study. Whether additional context improves discrimination remains an empirical question.

Observed latency

• Jev 1.13355.7 ms
• deepset DeBERTa Base25.9 ms
• FMOps DistilBERT5.1 ms
• Protect AI Base v226.1 ms
• Protect AI Small v214.4 ms
• Prompt Guard 2 86M26.6 ms
• Prompt Guard 2 22M25.6 ms

0100200300400

FMOps had the lowest observed mean prediction latency at 5.1 ms. Deepset averaged 25.9 ms, while Jev averaged 355.7 ms.

Importantly, Jev’s timing also included the remote request, parsing, and retries. These different timing boundaries limit direct speed comparisons.

What would establish practical reliability?

The next evaluation should begin with an explicit tolerance for false positives. Selecting thresholds on validation data to meet a target false-positive rate, then measuring attack recall on held-out data, would provide a clearer deployment comparison.

It should also separate user-request screening, external-content inspection, and jailbreak detection. These tasks overlap, but they place different demands on a detector. Reviewing representative errors within each setting would help distinguish failures of classification from failures of task definition or input handling.

The model set should also be extended. This study includes established classifier baselines rather than every current release. Recent alternatives such as Horizon Labs’ Prompt Injection Guard and Wolf Defender v2 provide additional comparisons for long inputs, difficult benign content, and agent-oriented traffic. Their published results should be tested under the same protocol before drawing conclusions about relative performance.

Finally, detectors need to be evaluated inside an assistant workflow. That would connect classification decisions to the outcomes that matter: whether an attack succeeds, whether intervention prevents it, and whether the assistant still completes the legitimate task.

Jev’s average F1 and its configurable decision interface make it a useful candidate for that next stage. Deepset’s recall and the local classifiers’ observed latency make them important comparators.

For enterprise agents and personal assistants alike, the objective is to preserve the capabilities that make instruction following useful while preventing untrusted content from acquiring authority. A reliable detector must catch attacks within an acceptable false-positive budget and still allow legitimate work to continue.

Methods

For WAInjectBench, we sampled uniformly without replacement from 3,698 text records using seed 42. The other selections preserve the datasets’ original ordering. WAInjectBench’s image attacks were outside the study.

We calculated metrics separately for each benchmark, then averaged them with equal weight. The 314-example English 3K set therefore contributes as much to the reported average as a 1,000-example set.

The execution conditions differed. Local timing covered the classifier prediction call. Jev’s timing included the remote request, parsing, and recorded retries, with four clients making requests concurrently. Initialisation was excluded, and latency averages gave equal weight to each benchmark’s mean.

The decision rules also matter. Local classifiers used their highest-scoring class, equivalent to a 0.5 attack threshold for a two-class softmax model apart from exact ties. Jev used the structured choice returned by the fixed external_boundary prompt and the dated typesafe/jev-1.13-20260917 snapshot. We did not apply an additional probability threshold to Jev’s choice.