What 78K attack samples taught me about catching prompt injection

Short summary

A developer built a prompt-injection detector trained on 78K attack samples using deterministic regex plus classical ML (TF-IDF + logistic regression) instead of an LLM judge, achieving 7ms latency and zero per-call cost. The model hits 0.895 recall on real-world jailbreaks but only 0.324 on subtle roleplay framing. The key insight: always-on detection should be cheap and deterministic, with heavier models reserved for ambiguous cases.

• •Deterministic regex + TF-IDF/logistic regression detects prompt injection in 7ms with no per-call cost
• •Recall is strong (0.895) on real-world jailbreaks but weak (0.324) on subtle roleplay framing
• •FPR is traffic-dependent: 0.4% on curated input but up to 5% on open conversational logs; always ask vendors which distribution they measured

Generated with AI, which can make mistakes.