From the Palo Alto Networks edition of October 29, 2026
Passing the Test You Trained On: re-evaluating 15 prompt-injection detectors on agent tool outputs finds benchmark rankings transfer poorly and false-positive rates range from none to over 90%
Academic authors (arXiv preprint 2610.03448) · AI security research / LLM agent guardrails · International
- Publisher
- arXiv
- Original publication
- arXiv preprint v1, Oct. 2, 2026
- Source retrieved
- 2026-10-30
What happened
The authors replay ground-truth tool calls from AgentDojo and tau-bench to get benign-by-construction tool outputs, label injected outputs by differential replay, and test 15 open detectors (including Meta Prompt Guard 2) plus two task-aware LLM judges, also on BIPIA. Rankings barely transfer: Kendall tau is 0.01 between BIPIA and AgentDojo and 0.28 between the two agent benchmarks. PIGuard catches 95.1% of BIPIA injections at 1% FPR but 2.1% on AgentDojo; one detector catching 72.2% on AgentDojo catches 15.2% on tau-bench. False-positive rates on tool outputs range from none to over 90% and are consistent across agent benchmarks. Training-input form, not attack-string overlap, explains results; every approach misses classes of injections outside its training distribution. The authors recommend evaluating on the agent’s own tool outputs at low FPR and auditing training data.
Why it matters
Agencies evaluating AI runtime guardrails, including Prisma AIRS prompt-injection defense, should not rely on vendor or public benchmark scores; they need tests on their own agent traffic.
Evidence and measured results
Opened the arXiv HTML and read the abstract, introduction, methods, results and limitations. Code is published for reproduction.
Limitations and uncertainty
Preprint, not peer reviewed. Commercial API detectors, including Prisma AIRS, were not tested; relevance to any specific product is by analogy only.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Buyers cannot compare AI guardrails reliably using published benchmark scores.
- Stakeholders
- AI program leads
- Security architects
- Procurement evaluators
- Discovery questions
- Will the vendor test on your agent’s tool outputs?
- What false-positive rate is acceptable for your services?
- Will the vendor disclose training data sources?
- Value hypothesis
- Interpretation: agency-specific evaluation reduces the risk of buying an ineffective guardrail; no product was measured here.
- Potential engagement
- A guardrail evaluation on agency traffic using the replay method described.
- Unsupported claims
- That Prisma AIRS or any commercial product performs a certain way
- Generalisation beyond tested benchmarks
- Peer-reviewed status
Pre-sales engineering
Role takeaway
- Fit
- Applies to any detector-based prompt-injection defense for agents.
- Architecture and integration
- Detectors screen tool outputs before the agent; complement with system-level separation.
- Prerequisites
- Representative tool-output samples
- Replay capability
- Attack corpus
- Constraints
- Commercial detectors untested
- Preprint findings
- Security
- Measure both misses and false alarms; neither alone is sufficient.
- Proof of value
- Detection at 1% FPR on agency outputs
- False-positive rate on benign outputs
- Re-test after tool changes
Delivery
Role takeaway
- Work
- Create and maintain a guardrail evaluation harness.
- Dependencies
- Agent tool inventory
- Sample data access
- Engineering time
- Ownership
- AI program office or security engineering.
- Skills and adoption
- Staff need evaluation design skills; reuse the authors’ published code where licensing allows.
- Governance checkpoints
- Pre-deployment evaluation sign-off
- Periodic re-evaluation
- Acceptance criteria
- Proposed: detection and FPR reported for each deployed guardrail
- Proposed: evaluation repeated after significant agent changes
- Risks
- Unrealistic test data
- False positives breaking services
- Over-trust in benchmarks
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Detector-based defenses are easiest to add but brittle; system-level separation of untrusted data from planning remains a necessary complement.
Governance
Who approves, reviews and stays accountable for outcomes?
Procurement evaluations of AI guardrails should require testing on representative tool outputs, low-FPR reporting and training-data disclosure.
Security and privacy
What data, permissions and controls need testing?
Missed injections let attacker-written text in email, calendars or tables redirect agents; high false positives break tasks and push users to bypass controls.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Running replay-based evaluations requires skills most SLED teams lack; shared test harnesses could help.
Procurement
What should contracts, pricing and exit terms secure?
Supports evaluation clauses requiring demonstrations on agency data instead of headline benchmark numbers.
Operating model
Which teams own the service once it runs?
Guardrail performance must be monitored continuously as agent tools and data change.
Publication history
- 2026-10-29Palo Alto Networks · Issue 018 resources
Stable resource ID: arxiv-reevaluating-prompt-injection-detectors-llm-agents-benchmarks-transfer-poorly-20261002