Prompt injection detection tools compared (2026)

Tools at a glance#

If you are already on a cloud provider#

AWS Bedrock Guardrails. The prompt attack filter detects jailbreaks, prompt injection and, on the Standard tier only, prompt leakage. For InvokeModel you must wrap user input in guard tags, or the filter does not run. It does not evaluate tool results [10]. Content filters cost $0.15 per 1,000 text units; for how prompt attack checks are billed, see the AWS pricing page [9]. Retention and language coverage: not stated on the pages we read.

Azure Prompt Shields. It covers user prompt attacks (rule changes, conversation mock-ups, role-play, encoding) and document attacks, which means instructions hidden in third-party content such as emails [8]. The standalone API takes one user prompt and up to five documents [8]. The free instance stops at 5,000 text records per month; one record is up to 1,000 characters [7]. Languages and retention: not stated on the pages we read.

Google Model Armor. Billing is per token, defined as four characters excluding white space; it is included with Security Command Center Premium and Enterprise, or bought standalone [11]. Prompts and responses are processed but not stored at rest; templates are stored. EU regions include eu, europe-west1, europe-west3, europe-west4 and others [12]. Languages are not stated [12].

On price, these three are cheaper per call than StormDoor’s model-backed call. A 500-character prompt on Model Armor is about 125 tokens, so roughly $0.0000125 per call at list price (our arithmetic from [11]).

If you must self-host#

Meta Llama Prompt Guard 2. Two classifiers, 86M and 22M parameters. Meta reports 92.4 ms (86M) and 19.3 ms (22M) per classification on an A100 at 512 tokens [1]. The 86M model was evaluated on English, French, German, Hindi, Italian, Portuguese, Spanish and Thai; the 22M model has no multilingual pretraining [1]. The licence is the Llama 4 Community License, which requires attribution and bars services above 700 million monthly active users without a Meta licence [1]. It is not an OSI open-source licence. It is a classifier only, so you operate and update it.

NVIDIA NeMo Guardrails. Apache-2.0 toolkit with a built-in “jailbreak and injection detection” rail [6]. It is a framework for programmable rails around an LLM application, not a standalone detector.

Protect AI LLM Guard. MIT-licensed scanner library including a PromptInjection input scanner. The repository is read-only since 2026-07-09 [4]. Existing installs keep working; there will be no upstream fixes.

Rebuff. Apache-2.0 prototype. Its README says it “cannot provide 100% protection” and the repository has been archived since 2025-05-16 [5]. We do not recommend starting new work on it.

If you want one API for injection plus other input checks#

StormDoor /v1/prompts. Ten rule checks (override phrasing in 18 languages, forged delimiters, hidden and smuggled Unicode, encoded payloads, exfiltration links, extraction, jailbreak role-play, persistence instructions, text addressed to the model) plus a paid model check (see the prompts gate). The same API key covers PII, secrets, links, spam and others, and every response lists checks_run and checks_skipped. A model finding is suspect at most; only rule findings can reach block. No payloads are retained. StormDoor has no customers yet, no SOC 2 report and no self-hosted option.

Lakera Guard. A hosted guardrails API now under Check Point. Processing endpoints exist in the EU, US and Singapore; log storage defaults to the EU and is fixed when the organisation is created [3]. We could not read its pricing page, and its docs page we read does not state retention. “100+ languages” is a vendor claim we did not re-verify today.

Why published accuracy numbers are not comparable#

Each vendor tests on its own data, at its own threshold, with its own definition of “attack”. Two examples from the sources above:

• Meta reports 97.5% recall at 1% false-positive rate for Prompt Guard 2 (86M) on a private benchmark whose datasets the model card does not name [1]. Lakera’s PINT benchmark, run by Lakera on 4,314 inputs, scored the same model 78.76% [2].
• PINT ranks Lakera Guard first (95.22%), then Bedrock Guardrails (89.24%), Azure Prompt Shield (89.12%) and Google Model Armor (70.07%), with test dates between 2025-05-02 and 2025-08-27. Lakera runs the benchmark and its dataset is “a blend of public and proprietary data” [2]. Treat it as vendor-reported.

Public datasets exist, and any claim should name which one it used:

Datasets also disagree on what counts as an attack, and a detector tuned for one will look poor on another.

StormDoor’s own numbers#

Source: StormDoor internal measurement, 2026-10-09 and October 2026; method described in the Method section of this article [18].

Rules only (no model). 5,562 rows: 3,334 attacks and 2,228 benign, drawn from deepset (Apache-2.0), jackhhao jailbreak-classification (Apache-2.0), TrustAIRLab in-the-wild jailbreaks (MIT), Microsoft LLMail-Inject (MIT), InjecAgent attacker instructions (MIT), OpenAssistant chat (Apache-2.0) and our own hand-written sets. Overall precision 92.1%, recall 27.8%, F1 42.7%, false-positive rate 3.6%. Recall by source ranges from 0% (InjecAgent, 62 rows) to 11.4% (deepset), 21.7% (LLMail-Inject), 42.0% (jackhhao) and 50.8% (our adversarial set). 2,412 of 3,334 attacks were missed.

Model check. On a 600-row injection set (300 attacks, 300 benign, from the public sets above) at the production threshold of 0.5: precision 0.996, recall 0.747, F1 0.853, 1 false positive on 30 hand-written hard negatives, 62 of 63 adversarial rows flagged. Latency measured from our test machine was 245 ms median and 295 ms 95th percentile. The model is weakest on role-play and non-English attacks, and lowering its threshold raised recall at a high false-positive cost (15% at threshold 0.05). Samples are small: one hard-negative error moves the false-positive rate by about 3 points. These are our measurements, not independent results, and the datasets differ from every vendor figure above.

What rules cannot catch#

Rules match shapes: known phrases, forged delimiters, invisible characters, decodable payloads. Our misses fall into four groups:

• Instructions written as ordinary requests. In LLMail-Inject, 1,022 of 1,174 misses ask to send an email to a fixed address, with no phrase or delimiter to match.
• Short, polite tool requests such as “unlock my front door” (all 62 InjecAgent rows missed). Without knowing the text came from retrieved content, it looks like a user request.
• Persona set-ups without “no limits” wording, which are identical in shape to harmless role-play.
• Paraphrases and one-line task redirections in German or English.

Rules also misfire on prompt templates that begin with “ignore all previous instructions” and on security write-ups that quote attacks. See prompt.override_instructions, prompt.hidden_text and prompt.encoded_payload for what the rules do catch, and prompt.likely_injection for the model finding. Full gate reference: /docs/gates/prompts.

No detector, ours included, replaces least-privilege design for the agent itself. If you also need toxicity screening of user text, see Perspective API alternatives.