AI Prompt Injection Detection Benchmark 2026: AgentID vs Llama Prompt Guard

Prompt injection detection is increasingly used as a security control in LLM applications, AI agents, copilots, retrieval pipelines and AI gateways. But comparing prompt injection detectors is difficult: results can change substantially depending on the attack distribution, benign data, model checkpoint, classifier threshold, preprocessing, input length and deployment environment.

This engineering note reports an internal AgentID prompt injection detection benchmark across three public prompt-injection datasets: Lakera Gandalf, Deepset, and PromptShield.

The benchmark compares AgentID with Meta's Llama Prompt Guard on attack recall across all three datasets, plus false positive and latency measurements where those figures were included in the underlying benchmark summary.

The results should be read as dataset-specific measurements, not as a universal ranking of AI security systems.

AgentID benchmarked its prompt injection detection stack against Meta's Llama Prompt Guard across three public prompt-injection datasets. AgentID reported higher attack recall on all three datasets.

The latency summary shared publicly included concrete p50 examples for Lakera Gandalf and Deepset, where AgentID also measured faster than Llama Prompt Guard. As with any detector benchmark, these are dataset- and configuration-specific measurements rather than universal security guarantees.

On the AgentID Gandalf-derived evaluation corpus, both detectors achieved high attack recall. AgentID detected 94.7% of attack samples at a 0.4% false positive rate; Llama Prompt Guard detected 91.5% with no false positives observed among the 250 benign samples.

The difference was much larger on `deepset/prompt-injections`. AgentID detected 73.0% of the 263 attack samples, while Llama Prompt Guard detected 10.3% under the configuration used in this benchmark. AgentID produced a 0.8% false positive rate across 399 benign examples; no false positives were observed for Llama Prompt Guard.

Latency measurements also favored AgentID in the recorded test environment. On Gandalf, AgentID measured 48 ms p50 and 110 ms p95 versus 93 ms and 190 ms respectively for Llama Prompt Guard. On Deepset, the measurements were 27 ms / 116 ms for AgentID and 51 ms / 176 ms for Llama Prompt Guard.

These measurements do not establish that one system is universally more secure.

They establish something narrower:

> Under the benchmark configuration used for these runs, the two detectors behaved similarly on the selected Gandalf-derived corpus but very differently on the Deepset distribution.

That difference is exactly why prompt injection benchmarks should use multiple datasets.

A detector can perform strongly against one attack distribution and substantially worse against another. Model training distributions, attack style, language, prompt length, classifier threshold, preprocessing and definitions of "prompt injection" all influence the result.

Prompt injection is not a single homogeneous attack class.

A direct instruction such as "ignore all previous instructions" is structurally different from an indirect injection hidden inside a document, a multi-turn manipulation, an encoded instruction, a role-play attack, a context-dependent tool-use attack or an adversarially optimized input targeting a specific detector.

This creates several benchmarking problems.

A detector may perform well when the test distribution resembles examples seen during training or model development.

Performance can fall when the linguistic structure, attack technique or benign population changes.

This is distribution shift.

It means a result such as 95% recall should always be interpreted as:

95% recall on this dataset, under this configuration.

It should not be interpreted as 95% protection against prompt injection in production.

Testing only malicious prompts produces an incomplete security benchmark.

A detector that labels every prompt as malicious would achieve 100% attack recall but be unusable in production.

This is why false positives matter alongside recall.

Lakera's separate PINT benchmark explicitly includes hard negatives, normal chatbot messages and public documents in addition to attacks, illustrating the importance of evaluating both security and utility.

Many prompt injection classifiers produce a score rather than an intrinsic binary verdict.

Changing the decision threshold changes the operating point.

A lower attack threshold will normally increase recall while also increasing false positives. A higher threshold may reduce false positives while allowing more attacks through.

A benchmark that reports recall without documenting its classification threshold is therefore incomplete.

"Llama Prompt Guard" is not precise enough for reproducibility.

Meta has published the original `meta-llama/Prompt-Guard-86M` and the later `meta-llama/Llama-Prompt-Guard-2-86M`, among other variants. Prompt Guard 2 changed the training objective and classification design from the original release.

The exact model ID, revision or commit hash must therefore be frozen in a reproducible benchmark.

The benchmark compares two prompt injection detection systems:

AgentID prompt injection detection pipeline

versus

Meta Llama Prompt Guard

across two evaluation corpora.

1,000 attack prompts

250 benign prompts

1,250 total inputs

Required before publication:

exact source/revision of the Gandalf data;

sampling procedure;

whether duplicates were removed;

source of the 250 benign examples;

whether prompts were transformed;

whether multi-turn context was flattened;

language distribution.

The public Gandalf research project was developed as a crowd-sourced, gamified red-teaming environment. Its associated research release contains far more attacks than the 1,000 used here, so this benchmark is best described as an AgentID-selected Gandalf-derived evaluation set, unless internal artifacts establish a more precise public subset name.

Primary Gandalf sources: Gandalf the Red paper and Gandalf research repository.

263 attack prompts

399 benign prompts

662 total inputs

The current Hugging Face release contains 546 training examples and 116 test examples. Across both splits, the corpus contains 263 injection-labeled inputs and 399 legitimate inputs.

This benchmark appears to have evaluated the complete 662-example corpus rather than only Deepset's test split.

That distinction must be retained because the dataset is also used to train prompt-injection classifiers, including Deepset's own detector. A full-corpus benchmark is useful for distribution testing, but it should not automatically be interpreted as a clean unseen holdout evaluation for every model being tested.

Primary dataset: deepset/prompt-injections on Hugging Face.

Gandalf is useful because its attack data emerged from an adversarial setting.

Users attempted to manipulate an LLM-based system and defeat progressively stronger defenses. The associated research describes Gandalf as a mechanism for collecting realistic and adaptive attacks rather than relying exclusively on static attack templates.

For this AgentID benchmark, 1,000 attack inputs were evaluated together with 250 benign inputs.

At the supplied rates, AgentID detected 947 of 1,000 attacks.

Llama Prompt Guard detected 915 of 1,000 attacks.

AgentID's 0.4% FPR over 250 benign inputs corresponds to one false positive if the published rounded rate derives directly from integer sample counts.

Llama Prompt Guard produced no observed false positives in those 250 benign samples.

Zero observed false positives should not be interpreted as proof of a zero false-positive probability in a larger population. It means only that none occurred in this finite benign sample.

`deepset/prompt-injections` is a compact public binary-classification dataset containing legitimate inputs and prompt injections.

The released dataset has 662 examples: 399 benign and 263 injection-labeled prompts. Its public dataset card defines a `text` field and binary `label`.

The rounded percentages imply approximately 192 detected attacks for AgentID and approximately 27 for Llama Prompt Guard.

For AgentID, a 0.8% rounded FPR across 399 benign examples is consistent with approximately three false positives.

These integer counts should be confirmed from the raw result file rather than reconstructed from rounded percentages before publication.

Prompt injection recall is the percentage of known attack inputs that the detector identifies as attacks.

Formula:

`Recall = True Positives / (True Positives + False Negatives)`

If a benchmark contains 1,000 attacks and a detector catches 947, recall is 94.7%.

Recall measures attack coverage on the evaluated distribution.

It does not measure overall system security.

False Positive Rate, or FPR, is the percentage of benign inputs incorrectly classified as attacks.

Formula:

`FPR = False Positives / (False Positives + True Negatives)`

FPR matters operationally because excessive blocking can make a security control unusable.

A detector with extremely high recall but a high false-positive rate may interrupt legitimate employee, customer or agent workflows.

Precision is the percentage of inputs classified as attacks that actually are attacks.

Formula:

`Precision = True Positives / (True Positives + False Positives)`

Precision depends strongly on the attack prevalence of the evaluated population.

For that reason, precision measured on a benchmark whose attack/benign ratio differs dramatically from production traffic may not transfer directly to production.

Precision was not independently supplied in the internal benchmark summary and should therefore be calculated from raw confusion matrices after those matrices are validated.

p50 latency is the median observed detector latency.

Half of measured requests completed faster than the p50 value and half completed slower.

p95 latency is the latency below which 95% of measured requests completed.

p95 is often more relevant than averages for inline AI security controls because tail latency affects the responsiveness users experience.

Latency numbers are not portable between deployments.

Hardware, CPU/GPU selection, batching, model loading, network transport, serialization, runtime framework and whether timing includes the complete request path can all materially change the measurement.

These are measurements of specific detector configurations against two specific input distributions.

They are not percentages of "security."

The Gandalf-derived test produced relatively close recall results.

AgentID detected 94.7% of the attack set. Llama Prompt Guard detected 91.5%.

That is a 3.2 percentage-point difference in recall on this corpus.

The scientifically appropriate interpretation is not that AgentID is "3.2% more secure."

The appropriate interpretation is that, at the operating thresholds used in this benchmark, AgentID produced fewer false negatives on this particular Gandalf-derived attack set.

The trade-off is visible in benign traffic.

AgentID produced one apparent false positive among 250 benign examples, based on the rounded 0.4% FPR. Llama Prompt Guard produced none.

Whether that trade-off is preferable depends on the application.

A consumer assistant, an internal code agent and an autonomous system with access to production infrastructure may rationally use different classification thresholds.

The Deepset benchmark showed a much larger difference.

AgentID recall fell from 94.7% on Gandalf to 73.0% on Deepset.

That decline itself is important.

It demonstrates that AgentID is also sensitive to distribution shift.

Llama Prompt Guard's measured recall decreased much more sharply, reaching 10.3% on this dataset under the tested configuration.

That result deserves investigation rather than marketing interpretation.

Potential explanations include:

a mismatch between the Deepset attack distribution and Prompt Guard's learned decision boundary;

the selected Prompt Guard model version;

the threshold used to convert classifier scores into attack decisions;

treatment of Prompt Guard classes;

tokenization;

truncation or segmentation;

preprocessing differences;

inference implementation.

Meta's original Prompt Guard and Prompt Guard 2 have different classification designs, making model identification especially important.

Before publishing the 10.3% result, the benchmark owner should rerun the evaluation from a frozen environment and preserve the raw model scores.

The difference between Gandalf and Deepset is not necessarily anomalous.

It illustrates one of the central problems in machine-learning security evaluation: the test distribution defines what the metric means.

Gandalf originates from an interactive red-teaming environment.

Deepset is a relatively small binary classification corpus containing legitimate requests and injection examples, including English and German material.

Different datasets can vary in:

wording;

attack explicitness;

prompt length;

language;

adversarial sophistication;

repeated templates;

benign prompt style;

label definition;

direct versus indirect injection;

similarity to model training data.

A detector can learn features that work extremely well for one distribution but transfer poorly to another.

For production security, this is why evaluation should include several independent datasets plus organization-specific traffic.

There is no useful prompt injection detector metric in isolation.

Blocking every input would maximize recall and destroy usability.

A detector that never blocks anything has a perfect 0% FPR but zero defensive value.

Prompt injection detection often sits in the critical path before an LLM or agent executes.

Additional latency therefore accumulates directly in user-facing or machine-to-machine workflows.

In these benchmark runs, AgentID recorded lower p50 and p95 latency on both datasets.

That statement should remain tied to the test environment.

It should not be generalized into a claim that AgentID is always faster than Prompt Guard.

Meta itself reports latency for Prompt Guard under specific hardware and token-length conditions, illustrating why hardware and request shape must accompany latency claims.

A classifier benchmark tests classification.

A production AI system has a much larger attack surface.

Prompt injection may arrive through:

direct user input;

retrieved web content;

uploaded documents;

RAG sources;

email;

tool responses;

MCP servers;

API results;

agent memory;

multi-turn context.

An attacker can also adapt after learning that a detector exists.

Meta explicitly notes that Prompt Guard is not immune to adaptive attacks.

A real security architecture therefore should not rely on one prompt classifier as the sole control.

Detector output can be one signal inside a broader enforcement system containing deterministic access controls, scoped permissions, data controls, tool restrictions, approvals, rate limits, output validation and audit evidence.

For AgentID's architectural view of this problem, see Beyond the Prompt: A Guide to Building a Deterministic Cage for LLM Security.

This benchmark does not measure:

indirect injections embedded in realistic documents;

adaptive attacks targeting the detector itself;

long-context attacks beyond classifier context windows;

multi-turn attacks;

multilingual generalization beyond the tested corpus;

encoded or obfuscated attacks unless present in the dataset;

attacks embedded in tool responses;

tool authorization;

data exfiltration after a successful injection;

downstream action safety;

output-side security;

retrieval poisoning;

model-specific attack success;

rate limiting;

identity and permission boundaries;

human approval systems.

It also does not measure whether an attack that passes the detector actually succeeds against the protected LLM.

Detection recall and attack success rate are different metrics.

A detector false negative means the input passed the classifier.

It does not necessarily mean the downstream LLM followed the malicious instruction.

Conversely, detecting suspicious text does not by itself guarantee that the rest of the application is secure.

A reproducible version of this benchmark should publish or internally archive the following configuration.

For each dataset record:

canonical dataset name;

URL;

exact commit/revision/hash;

selected split;

sample IDs;

attack and benign counts;

deduplication procedure;

sampling seed;

transformations.

Record:

exact Hugging Face model ID;

exact model revision;

Transformers version;

PyTorch version;

tokenizer revision;

classification label mapping;

threshold;

maximum input length;

truncation strategy;

chunking strategy;

aggregation rule.

Record:

AgentID detector version;

pipeline/config version;

policy pack version;

semantic model version where applicable;

threshold/configuration;

deterministic preprocessing rules;

input normalization;

request endpoint/path.

Record:

CPU;

GPU, if used;

RAM;

operating system;

container/runtime;

inference engine;

number of workers;

concurrency;

warm versus cold runs.

Define exactly where the timer starts and stops.

For example:

`client call -> serialization -> guard endpoint -> preprocessing -> inference -> policy decision -> response received`

or:

`model inference only`

These are different latency measurements and should not be compared as if they were identical.

For every sample retain at minimum:

`dataset_id, sample_id, ground_truth, detector_version, raw_score, threshold, predicted_label, latency_ms`

Publishing anonymized per-sample results would make the benchmark substantially more useful to external researchers.

This benchmark has several important limitations.

First, only two datasets were used. Prompt injection is too diverse for these datasets to represent the complete production attack surface.

Second, the Gandalf subset needs provenance validation. The public Gandalf corpus is much larger than the 1,000 attacks evaluated here. The exact selection mechanism and benign source are not established in the available benchmark summary.

Third, the exact Llama Prompt Guard checkpoint must be recovered. Prompt Guard 1 and Prompt Guard 2 are distinct models and should not be conflated.

Fourth, the operating thresholds must be documented. Recall and FPR cannot be interpreted independently of the threshold.

Fifth, the latency environment is not yet documented in the supplied benchmark record. The current p50 and p95 values should not be published as reproducible latency measurements until hardware, runtime and timing boundaries are confirmed.

Sixth, percentages are rounded. Raw confusion matrices should replace reconstructed integer counts.

Seventh, the Deepset evaluation apparently combines the complete train and test corpus. That is acceptable for measuring behavior on a known distribution, but must be disclosed clearly and should not be described as an unseen test set without verifying training overlap.

Finally, neither benchmark evaluates end-to-end compromise probability.

Prompt injection detection is one security control, not a complete measure of AI system security.

The main finding from this benchmark is not that a single prompt injection detector "wins."

It is that detector performance can change dramatically across datasets.

On the AgentID Gandalf-derived corpus, AgentID and Llama Prompt Guard both achieved high recall, with AgentID at 94.7% and Llama Prompt Guard at 91.5%.

On `deepset/prompt-injections`, AgentID achieved 73.0% recall while the Llama Prompt Guard configuration used in the test achieved 10.3%.

At the same time, Llama Prompt Guard produced no observed false positives in either benign sample, while AgentID recorded 0.4% and 0.8% FPR respectively.

AgentID also recorded lower p50 and p95 latency in both benchmark runs.

Those results are useful because they expose trade-offs.

They are not sufficient to infer universal production security.

A serious prompt injection benchmark should use multiple attack distributions, realistic benign traffic, frozen model versions, documented thresholds, raw confusion matrices, reproducible latency methodology and, ideally, adaptive and indirect attack evaluations.

For production systems, prompt injection detection should then be combined with deterministic security controls rather than treated as a complete security boundary.

AgentID uses prompt injection detection as one component of a broader runtime governance and security architecture. For the surrounding architecture, see AgentID's material on deterministic LLM security, AI application and prompt-injection security, enterprise AI governance platform requirements, and AI audit and forensic logs.