Lightweight Prompt Injection Detection: From Centroid-Based Embedding Classification to a Hybrid Guardrail
Year: 2026
Type: preprint
Abstract: Prompt injection attacks against large language models demand robust real-timedefenses. This paper investigates three questions: (1) whether embedding represen-tations contain discriminative information for prompt injection detection, (2) whynearest-centroid classification fails on these embeddings, and (3) whether lightweightstatistical features offer a viable alternative. Through controlled experiments acrossembedding models on 144,569 test samples, we find that the embedding space con-tains discriminative information (linear probes achieve AUC 0.844–0.855) that nearest-centroid scoring cannot access (AUC 0.547). The critical factor is the number ofcentroids: 4 category centroids overlap (C = 0.986) while 2 class centroids achieveAUC 0.763–0.784. We then evaluate a lightweight hybrid guardrail combining 117handcrafted features, TF-IDF similarity, and a stacking ensemble. The hybrid modelachieves 83.0% in-distribution accuracy with a measured single-threaded CPU infer-ence latency of 0.149 ms per prompt. An ablation study reveals that TF-IDF alone(85.0% accuracy) outperforms the full hybrid, indicating that, under the evaluatedsetting, the 117 handcrafted features do not provide complementary predictive valuebeyond TF-IDF. Cross-dataset evaluation on four external benchmarks reveals a se-vere generalization gap: performance drops from 83.0% to 51.5% (a 31.5 percentage-point decline). We present a detailed analysis of the model’s strengths, weaknesses,and failure modes, providing experimentally grounded guidance for designing promptinjection detection systems.
Author: Tiwari, Prashanna
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204452369