Prompt Guard 2 has a 52.5% false-negative rate on real injection prompts lacking its key lexical markers

Auto-published from arXiv:2609.24801 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.83, flags: [possible-zero-day]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

prompt-injection

Model

Prompt Guard 2 (DeBERTa-v2, 86M)

Surface

API — classifier invoked as input filter

Setup

A random sample of 200 injection prompts from the xTRam1/safe-guard-prompt-injection dataset (3,000-prompt malicious split, generated via GPT-3.5-turbo) is run through Prompt Guard 2. Dataset-scale SHAP attribution is computed across both detected and undetected prompts to identify which lexical features drive positive predictions.

Reproduction anchor

benchmark: xTRam1/safe-guard-prompt-injection (HuggingFace, n=200 injection-class sample); model meta-llama/Prompt-Guard-2-86M; procedure is fully described in paper body; no code artifact released.

Observed behavior

105 of 200 injection prompts (52.5%) are classified as benign by Prompt Guard 2. SHAP analysis reveals that detected prompts cluster around tokens 'ignore', 'instructions', and 'confidential', while the 105 undetected prompts systematically lack these lexical markers, suggesting the classifier targets instruction-override/role-play patterns rather than general adversarial intent.

Expected behavior

A robust classifier should detect injection prompts regardless of whether they use canonical instruction-override vocabulary, generalizing to semantically equivalent adversarial constructions.

Reproducibility

high

Threat model

Any attacker whose injection prompt avoids the token vocabulary Prompt Guard 2 was trained on — e.g., indirect injections embedded in retrieved documents, or jailbreaks phrased without 'ignore'/'instructions' — will pass through the guardrail undetected in production systems that rely solely on Prompt Guard 2.

Novelty

SHAP attribution at dataset scale makes the lexical over-reliance of Prompt Guard 2 mechanistically legible, converting an anecdotal false-negative observation into a reproducible signal that can directly guide evasion prompt design.

Source

• arXiv: 2609.24801
• PDF: https://arxiv.org/pdf/2609.24801
• Categories: cs.CR, cs.AI
• Authors: Fernando Outeda, Gustavo Betarte, Juan Diego Campo, Fiorella Cravero

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: Demonstrates concrete jailbreak bypasses of the Prompt Guard 2 guardrail through XAI-guided saliency attacks (synonym substitution and paraphrasing); no mention of vendor disclosure coordination.

─────────────────────────────────────────────────────────────────────