prompt-injection-guard-v2

Prompt Injection Guard v2

DeBERTa-v3-base fine-tuned for binary prompt injection classification. Trained on the original 8,183-example dataset plus 1,687 synthetic examples targeting 5 documented v1 failure patterns.

Results

The standard test set is saturated (v1 already missed only 7 of 1,754 examples). v2 was not measured to beat v1 on this benchmark by design intent of the synthetic data, which targets categories underrepresented in split_test. On a held-out adversarial slice built from the failure clusters (n=651, injection-heavy), v2 achieves 0.99 injection recall and 1.00 benign recall.

Training Data

9,870 examples: 8,183 original (5 public datasets, deduplicated) + 1,687 synthetic examples generated via Claude Sonnet, deduplicated against existing training data via sentence embeddings, cross-validated with Claude Haiku (99.2% label agreement).

Synthetic data targets 5 failure clusters identified from v1 error analysis: non-English injections, very short injections, indirect jailbreaks framed as hypotheticals, legitimate role-play requests, and instruction-adjacent coding phrasing.

Training Details

• Base model: microsoft/deberta-v3-base
• Epochs: 3
• Learning rate: 2e-5
• Batch size: 8 (gradient accumulation 2, effective 16)
• Hardware: Colab T4

Full Methodology

See the GitHub repository for the complete failure analysis, synthetic data pipeline, and quality filter documentation.

Usage

from transformers import AutoTokenizer, AutoModelForSequenceClassification

tokenizer = AutoTokenizer.from_pretrained("alvi42/prompt-injection-guard-v2")
model = AutoModelForSequenceClassification.from_pretrained("alvi42/prompt-injection-guard-v2")