Machine Learning Models Better Protect Artificial Intelligences from Prompt Injection Attacks

Modern artificial intelligences, particularly large language models, are increasingly exposed to prompt injection attacks. These attacks allow malicious actors to manipulate model responses to bypass protections and achieve behaviors not intended by their designers. Such manipulation can lead to data leaks, identity theft, or other serious consequences, whether through direct injection into the query or by exploiting external sources such as websites or files.

To counter this threat, machine learning methods have been evaluated to detect these manipulation attempts. Four main approaches were compared: traditional classifiers using vector representations of texts, fine-tuned transformer models, models specialized in detecting prompt injections, and finally large language models used as classifiers.

Traditional classifiers, such as random forests or multilayer neural networks, offer good accuracy while requiring few computational resources. They achieve remarkable performance, with scores sometimes exceeding 96% for detecting malicious prompts. Their simplicity makes them suitable for environments with limited resources.

Fine-tuned transformer models, such as DistilBERT, RoBERTa, or DeBERTa, stand out for their ability to detect attacks with an accuracy close to 99.6%. These more complex models finely analyze the meaning of texts and identify manipulation attempts with high reliability. Their main drawback lies in their higher computational cost, which can limit their deployment in systems requiring fast responses.

Specialized models, designed specifically to detect prompt injections, show mixed results. Although optimized for this task, their detection rate remains often low, with recall scores sometimes below 25%. This means they allow a significant number of attacks to pass through, reducing their practical utility.

Finally, general-purpose large language models, such as gpt-5-nano, can also be used to detect these attacks. With an accuracy of 84% and a recall of 71%, they offer an interesting balance between performance and versatility. Their strength lies in their ability to adapt to different types of queries without requiring specific training.

This analysis reveals that no single method dominates all others in every context. Traditional classifiers are suitable for lightweight systems, while fine-tuned transformer models excel where accuracy takes precedence over speed. Specialized models, though promising, still need to improve to compete with other approaches. As for large language models, they represent a flexible solution, but their deployment depends on technical constraints and specific needs.

Documentary Sources / Document Base

Reference Report

DOI: https://doi.org/10.1007/s10207-026-01264-8

Title: Comparative evaluation of machine learning methods for protecting LLMs from prompt injection attacks

Journal: International Journal of Information Security

Publisher: Springer Science and Business Media LLC

Authors: Nazarii Dzhaliuk; Dmytro Sabodashko; Volodymyr Khoma; Yuriy Khoma; Viktor Kolchenko; Michal Podpora