Prompt Injection Detection Classifiers

An injection classifier is a model or service that assigns labels or scores to text for signs of prompt injection or jailbreak attempts. It is separate from the primary language model’s answer-generation job, although some products may package analysis and policy actions together. The classifier’s definition of an attack matters. Meta’s Llama Prompt Guard 2 model card describes 22M and 86M binary classifiers that label text benign or malicious when it explicitly attempts to override prior instructions. The card says the 86M model is multilingual across a documented set of languages, while the 22M version has a multilingual performance gap; both have a 512-token context window. Those are version-specific claims, not universal properties of injection detectors. A classifier can be used to annotate, block, route, or prioritize text, but a score only has meaning under a threshold and deployment policy. Aggressive thresholds may flag legitimate text that discusses attacks or quotes adversarial examples. Loose thresholds can miss indirect, paraphrased, novel, or out-of-distribution attacks. Microsoft Prompt Shields is a separate managed feature that documents scanning user prompts and documents at configured intervention points, with block or annotate-style handling and troubleshooting for false positives and misses. Product setup matters: a control that is not attached to the relevant deployment or input path may not inspect that content. Test the classifier on representative benign and adversarial examples, including documents and tool responses if those are part of the workflow. Track false positives, false negatives, and downstream impact, then tune policy for the application’s risk. Split long inputs only in ways supported by the model documentation, because segmentation may change context between fragments. A detector does not prove that unflagged text is safe or that flagged text is malicious. Combine screening with data provenance, least-privilege tools, output validation, monitoring, and incident review.