Prompt injection detection

These range from regexes for "ignore previous instructions" to fine-tuned classifier models scoring every chunk of retrieved content, tool output, or user input. A high score triggers blocking, stripping, quarantine, or a human check. Providers and open-source projects both ship them.

Why it matters

They help — measurably lowering the success rate of known attacks — and they are worth deploying. But detection is an arms race against an attacker with unlimited phrasing, and false positives break legitimate workflows. Detectors are a probabilistic layer; the deterministic controls (privilege, isolation, egress, approval) are what you rely on when the detector is wrong.