{"resourceId":"arxiv-prompt-injection-detectors-reevaluation-2026","versions":[{"version":"external-d893fcfbc32769abd54dcee8d71d1acd375113551006db25d13c282d8efec19a","resource":{"id":"arxiv-prompt-injection-detectors-reevaluation-2026","title":"Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents","organization":"Zhuowen Liu (arXiv preprint)","sector":"Academic research; AI agent security","geography":"Not specified (benchmark study; transferability to SLED deployments untested)","publishedAt":"2026-10-02","publicationDate":"2026-10-02","eventDate":null,"sourceName":"arXiv","sourceLabel":"Preprint, not peer reviewed (arXiv:2610.03448)","sourceUrl":"https://arxiv.org/abs/2610.03448","evidenceClass":"academic-research","outcomeClass":"mixed","topics":["developers-agents","data-security","governance-procurement"],"finding":"Preprint, not peer reviewed. Evaluating fifteen prompt-injection detectors (including Meta's Prompt Guard 2) and two LLM judges on benign-by-construction tool outputs from AgentDojo and tau-bench, the author finds rankings transfer poorly: the best detector on BIPIA caught 2% of AgentDojo injections at a 1% false-positive rate, and one catching 72% on AgentDojo caught 15% on tau-bench. False-positive rates on tool outputs ranged from none to over 90%. The author recommends evaluating on the agent's own tool outputs at low false-positive rates and auditing training data.","sledRelevance":"Independent scrutiny relevant to vendor guardrails such as Falcon Guardian's prompt and tool-call policy checks and CrowdStrike's prompt-injection taxonomy work. It suggests SLED buyers should ask for detection rates measured on their own agent workflows, not public benchmark scores. Why now: it is the most recent independent evidence found to weigh against this week's CrowdStrike agent-security claims.","evidence":"Single-author preprint with replay methodology across three benchmarks; does not test CrowdStrike or other commercial endpoint products.","architectureImplications":"Detector choice must be validated inside the specific agent and tool environment; benchmark leadership is not a proxy.","governanceImplications":"Procurement evaluations of AI guardrails should require low-false-positive detection metrics on representative workflows and disclosure of training data.","securityPrivacyImplications":"High false-positive rates can block legitimate work; low detection rates leave injections through; both affect agent safety.","caveats":"Preprint, not peer reviewed. Does not evaluate CrowdStrike products. Benchmarks may not represent public-sector workflows.","streamIds":["crowdstrike"],"roles":{"sales":"Benchmark skepticism is the framing point: this preprint shows prompt-injection detectors that lead one benchmark can catch as little as 2% elsewhere. For SLED buyers evaluating AI-agent guardrails, the bounded conversation is how a vendor will prove detection on the buyer's own workflows. Interpretation: welcome that test rather than citing leaderboard scores. The study tests no CrowdStrike product, so it cannot be used to claim Falcon Guardian is better or worse than alternatives.","engineering":"Environment-specific validation is the framing point: detection and false-positive rates did not transfer between benchmarks, though false-positive rates did transfer between the two agent benchmarks. Interpretation: pre-sales should design a proof of value that replays the customer's own agent tool outputs, measures detection at a fixed low false-positive rate, and records which detector or policy engine is in use. Ask vendors what data their guardrail models were trained on, as the paper links results to training-input form.","delivery":"Measurement discipline is the framing point: guardrail performance must be measured in place, not assumed. Interpretation: delivery should build a small labelled set of benign and injected tool outputs from the institution's agents and rerun it after each policy or model change. Ownership sits with the AI security engineer or SOC content team. Proposed acceptance criteria include a recorded detection rate at a 1% false-positive rate on that set and a documented retest schedule."},"roleDetails":{"sales":{"customerProblem":"Buyers cannot tell from public benchmarks how well prompt-injection guardrails will work in their agents.","stakeholders":["CISO","AI governance lead","Procurement evaluator","Developer platform owner"],"discoveryQuestions":["How will the vendor measure detection on our agent workflows?","What false-positive rate is acceptable?","What data trained the guardrail model?"],"valueHypothesis":"Workflow-specific testing reduces the risk of buying an ineffective guardrail; no direct savings claim.","potentialEngagement":"Design of an evaluation protocol for AI-agent guardrails during procurement.","unsupportedClaims":["Performance of any CrowdStrike product","Peer-reviewed status","Generalization to all agent types"]},"engineering":{"fit":"Any organization deploying or buying prompt-injection detection for agents.","architectureIntegration":"Evaluation harness replaying agent tool outputs through candidate detectors.","prerequisites":["Sample of agent tool outputs","Labelled injections","Defined false-positive threshold"],"constraints":["Small labelled sets","Workflow drift","Vendor opacity on training data"],"security":"Measure both missed injections and false blocks.","proofOfValue":["Detection at 1% FPR on own tool outputs","Cross-check on a second workflow","Retest after model updates"]},"delivery":{"work":"Build and maintain a labelled evaluation set and rerun it on changes.","dependencies":["Agent logs","Analyst labelling time","Vendor test access"],"ownership":"AI security engineer or SOC content team.","skillsAdoption":"Staff need basic evaluation-metric skills.","governanceCheckpoints":["Evaluation protocol approval","Results review before go-live","Periodic retest"],"acceptanceCriteria":["Proposed: detection rate recorded at 1% FPR","Proposed: retest schedule documented","Proposed: training-data disclosure obtained"],"risks":["Unrepresentative test set","Over-trust in benchmark scores","Vendor refusal to disclose"]}},"retrievedAt":"2026-10-30T22:13:23-05:00","enrichedAt":"2026-10-30T22:21:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No workforce data.","procurementImplications":"Supports requiring workflow-specific, low-FPR evaluation in AI security procurements.","operatingModelImplications":"Guardrail tuning becomes an ongoing measurement task.","peerReview":"preprint","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2610.03448","referenceExcerpt":"the best detector on BIPIA catches 2% of AgentDojo injections at a 1% false-positive rate","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}