Prompt Injection Detection Tools: Five Options Compared

If you are deploying an LLM and need to pick prompt injection detection tools today, the honest framing is that no single classifier eliminates the risk: OWASP ranks prompt injection as LLM01:2025, and published benchmarks consistently show that detection systems degrade on out-of-distribution attacks. That said, tooling has matured enough to make layered defense practical without heroic engineering effort. For most teams, Lakera Guard (now part of Check Point) covers the fastest path to production-grade detection as a managed API, and Meta’s Llama Prompt Guard 2, published in 86M and 22M sizes, is the maintained self-hosted pick for on-premises or data-residency-constrained environments, with the 22M size covering strict footprint constraints. Protect AI’s open-source DeBERTa-v3 classifier, the self-hosted pick in earlier versions of this comparison, is now archived and unmaintained, the same status as LLM Guard. The evaluation below covers each tool’s capabilities, where it sits in your request path, and the trade-offs that should drive your selection.

This page takes the content-moderation angle on that problem. Injection detection is the security-layer sibling of the harm classifiers a moderation stack already runs, and the two answer different questions: a content-moderation classifier scores whether text is harmful, while an injection detector scores whether an instruction is trying to hijack the model, however polite it reads. A moderation pipeline that only grades harm leaves that provenance gap open, which is why an injection filter belongs beside the moderation layer rather than folded into it.

What Each Tool Does

The five prompt injection detection tools covered here differ most on deployment model, detection surface, and latency profile.

Lakera Guard is a SaaS runtime filter that wraps around your LLM call at the API boundary. Per Lakera’s product documentation, it delivers average latency under 12 ms, processes content across 100+ languages, and logs roughly 15,000 threats daily across its customer base. It scans both user-supplied inputs (direct injection) and content retrieved from external sources — documents, URLs, PDFs — before that content enters the model context (indirect injection). The platform also supports PII redaction, structured output validation, and audit logging with SIEM exports to Grafana and Splunk. SOC 2, GDPR, and NIST alignment are documented. Lakera was acquired by Check Point in September 2025; procurement teams evaluating multi-year commitments should account for roadmap integration uncertainty during that transition.

Protect AI’s deberta-v3-base-prompt-injection-v2 (archived) is an open-source binary classifier hosted on Hugging Face, fine-tuned from Microsoft’s DeBERTa-v3-base (184M parameters). It is trained on a mix of public prompt-injection datasets with binary labels — safe or injection attempt — covering jailbreaks, “ignore previous instructions” variants, and tool/role hijacks. It drops into an LLM pipeline as a pre-call guard with no external API dependency. Its model card now states that the project and its associated code are no longer under active development or maintained. The weights still run, but they will not be retrained as attacks move, so treat it as legacy rather than a starting point.

Meta’s Llama Prompt Guard 2 is the maintained self-hosted option. Meta publishes it in two sizes, 86M and 22M, as a binary classifier that labels an input benign or malicious, under the Llama 4 Community License. The jailbreak-versus-injection split often attributed to Prompt Guard belongs to the original Prompt Guard (version 1), which returned separate jailbreak and injection labels for exactly that kind of routing. Meta’s Prompt Guard 2 model card states that, unlike Prompt Guard 1, it does not include a specific injection label, so a response policy that routed the two attack types differently needs its own logic after a migration. The 22M size is the one to evaluate for embedded or mobile-adjacent deployments.

NVIDIA NeMo Guardrails is a configuration-driven orchestration framework rather than a standalone classifier. Injection detection within it uses a lightweight random forest model leveraging pre-trained embedding pairs. The framework excels at enforcing topical rails and structured dialogue policies. It requires authoring a rail configuration specific to your application — an engineering investment that pays off when you need fine-grained control over conversational flow in addition to security controls.

LLM Guard (by Protect AI and community contributors) is an open-source Python middleware toolkit that aggregates scanners — including the DeBERTa classifier above — into a composable layer. It handles both input and output scanning, PII redaction, and code detection, and it is pip-installable. It is also no longer maintained: Protect AI archived the repository on 9 July 2026, and the README states that the project and its associated Hugging Face models are out of active development. Existing deployments still run, but a frozen classifier in a security path decays as attacks move, so new self-hosted stacks should not start here.

Where These Tools Fit in the Request Path

All five tools operate at the input layer — between the application and the LLM call — though some extend into the output path. A representative placement:

Client → application server → injection detector (pre-call) → LLM API → output scanner (post-call) → application server → client

For a managed SaaS setup, Lakera Guard functions as an API sidecar: each LLM call passes through Guard’s endpoint first, and a response comes back with a classification before your code invokes the model. For self-hosted setups, Llama Prompt Guard 2 slots into the same position as middleware, as do the archived Protect AI classifier and LLM Guard on installations that predate their archival.

Indirect injection — where malicious instructions are embedded in documents or web content that the model retrieves — requires scanning retrieval output before it enters the prompt, not just scanning the user’s original query. Only Lakera Guard and LLM Guard address this surface in their default configurations, and LLM Guard is now unmaintained, which leaves Lakera Guard as the only actively developed option here; the others require custom integration. For teams running RAG pipelines, this distinction carries more practical weight than any benchmark F1 score. The offensive mechanics of indirect injection are documented in depth at aisec.blog, which tracks active exploitation techniques and real-world jailbreak disclosures.

Trade-offs

Latency. Lakera Guard reports under 12 ms average latency per its documentation. The Protect AI DeBERTa-v3 classifier runs at roughly 286 ms on CPU per a published benchmark by NeuralTrust — meaningful overhead for synchronous pipelines. GPU inference reduces that significantly; the trade-off is infrastructure cost. Llama Prompt Guard 2 22M is much smaller than that DeBERTa-v3-base classifier and correspondingly faster on the same hardware.

Detection accuracy and false-positive rate. Lakera claims a 0.01% false-positive rate (per their product page). Independent benchmarks complicate that picture. The NeuralTrust comparison referenced above found Lakera achieved an F1 score of 0.30 on a proprietary airline-domain dataset — a result that likely reflects recall-precision imbalance on domain-specific inputs rather than the product’s behavior on general content. Note that this benchmark was produced by a competing vendor and should be weighted accordingly. The broader takeaway from cross-dataset comparisons is that all current classifiers show significant performance variance when evaluated outside their training distribution; overfitting to public injection datasets remains an industry-wide problem.

A 2025 arXiv paper (arXiv:2504.11168) found that character-level perturbations and adversarial machine learning attacks can evade most current classifiers at the time of evaluation. That residual evasion risk is why detection is one layer in a stack, not the stack itself. aidefense.dev explains how runtime filters work, and guardml.io maps the types of AI guardrails.

Integration effort. Lakera Guard requires the least integration work — rerouting your LLM calls through their endpoint is typically a few lines of code. NeMo Guardrails has the steepest onboarding because rail configurations are application-specific and must be authored per deployment. LLM Guard sits in the middle: pip-installable but requires selecting and chaining scanners manually, and any effort spent on it is now effort spent on a frozen codebase.

Throughput cost. Running detectors on both input and output on every LLM transaction doubles the scanning overhead per call. Teams with high token volumes should profile this against throughput requirements before committing to a configuration.

Who Should Pick Which Tool

Use Lakera Guard if you need the fastest path to production, your compliance posture requires certified audit logging, and your team cannot maintain local model infrastructure. Factor in the Check Point acquisition when assessing long-term vendor stability.

Use Llama Prompt Guard 2 if you operate under data residency requirements, need full control over model weights, or are integrating detection into an existing MLOps pipeline. The weights run on your own infrastructure and can be audited internally; review the Llama 4 Community License terms before you embed it in a product. Do not start a new build on Protect AI DeBERTa or LLM Guard. Both are archived and receive no fixes (LLM Guard since July 2026); teams already running either should keep the pre-call guard slot and the composable-scanner pattern, and plan a move to a maintained model behind them.

Use the 22M size of Prompt Guard 2 if footprint size is the binding constraint. If your downstream routing depends on separate jailbreak and injection labels, only Prompt Guard 1 returned that multilabel signal; Prompt Guard 2 dropped the injection label and returns a single benign-or-malicious verdict, so that routing has to come from somewhere else, such as tagging whether the text arrived in the user turn or in retrieved content.

Use NeMo Guardrails if injection detection is one slice of a broader need for conversational guardrails — topic enforcement, output format validation, and structured dialogue control — and your team has the capacity to author rail configurations per application.

Do not rely on any single tool as your only control. All current classifiers have documented evasion paths. Pair a runtime filter with output schema enforcement, tool allowlists for agentic applications, and a logging layer that surfaces anomalies before they become incidents.

Related across the network

• Jailbreak Detection for LLMs Explained: How Runtime Filters Work — aidefense.dev
• How to Detect Prompt Injection: Four Approaches Ranked — promptinjection.report
• AI Defense Techniques for LLMs: A Practitioner’s Guide — aidefense.dev
• Why Your Prompt Injection Guardrails Fail: Bypass Classes — aisec.blog
• Rebuff: Open-Source Prompt Injection Defense, Layer by Layer — aisecreviews.com
• Lakera Guard: Prompt Injection Detection in Practice — aisecreviews.com

Related on this site

• What Is an LLM Firewall? Prompt-Layer Defenses Explained