Prompt Injection Detector Benchmark
A study of how reliable prompt injection detectors really are. Five kinds of detector were trained on two public datasets and tested on each other's data.
Many companies protect their AI chatbots with detectors that try to recognise malicious text. This study checks how reliable those detectors stay when the data changes.
Five kinds of detector were tested: a keyword rule, TF-IDF + logistic regression, a fine-tuned multilingual DistilBERT transformer, a cascade, and local Llama 3.2 3B and Llama 3.1 8B models as LLM judges. All were trained on two public datasets (deepset and jackhhao) and tested on each other's data.
The result: a detector that scores 0.96–0.98 F1 on its own dataset either misses most attacks on the other one or blocks up to 97% of harmless text. The site shows every result with interactive charts, a speed-vs-accuracy plot and the full table.
- Training on both datasets closes most of the gap.
- Llama 3.1 8B reaches 0.947 F1 on jackhhao with no training, but is 2,100× slower than the transformer.
- A cascade cannot rescue a model that is confidently wrong.