A lightweight and explainable framework for prompt injection detection in AI applications

1. OWASP Foundation, “LLM01:2025 Prompt Injection,” OWASP Top 10 for LLM Applications, 2025. Available:
https://genai.owasp.org/llmrisk/llm01-prompt-injection/
2. K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you have signed up for: Compromising real-world
LLM-integrated applications with indirect prompt injection,” arXiv:2302.12173, 2023.
3. J. Yi et al., “Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models,” Proc. ACM
SIGKDD, 2025, doi: 10.1145/3690624.3709179.
4. E. Debenedetti et al., “AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents,”
Advances in Neural Information Processing Systems, vol. 37, 2024. Available: https://arxiv.org/abs/2406.13352
5. Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language
Model Agents,” Findings of ACL, pp. 10471–10506, 2024, doi: 10.18653/v1/2024.findings-acl.624.
6. H. Li, X. Liu, N. Zhang, and C. Xiao, “PIGuard: Prompt Injection Guardrail via Mitigating Overdefense for Free,” Proc. ACL, pp.
30420–30437, 2025, doi: 10.18653/v1/2025.acl-long.1468.
7. D. Jacob, H. Alzahrani, Z. Hu, B. Alomair, and D. Wagner, “PromptShield: Deployable Detection for Prompt Injection Attacks,”
arXiv:2501.15145, 2025. Available: https://arxiv.org/abs/2501.151458. S. Abdelnabi et al., “LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge,” arXiv:2506.09956, 2025.
Available: https://arxiv.org/abs/2506.09956
9. Y. K. Shire and S.-C. Kim, “PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution
Shift,” IEEE Access, vol. 14, pp. 134184–134205, 2026, doi: 10.1109/ACCESS.2026.3728186.
10. Y. Liu, Y. Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and Benchmarking Prompt Injection Attacks and Defenses,” Proc.
USENIX Security Symposium, pp. 1831–1847, 2024.
11. Y. Jia et al., “A Critical Evaluation of Defenses against Prompt Injection Attacks,” arXiv:2505.18333, 2025. Available:
https://arxiv.org/abs/2505.18333
12. K. Hines, G. Lopez, M. Hall, F. Zarfati, Y. Zunger, and E. Kiciman, “Defending Against Indirect Prompt Injection Attacks With
Spotlighting,” arXiv:2403.14720, 2024.
13. deepset, “prompt-injections,” Hugging Face Datasets. Available: https://huggingface.co/datasets/deepset/prompt-injections (accessed
Oct. 2026).
14. H. Li et al., “PIGuard code and NotInject benchmark,” research repository. Available: https://github.com/leolee99/PIGuard (accessed
Oct. 2026).
15. Microsoft Learn, “Prompt Injection (Direct / Indirect),” AI attack technique catalogue. Available: https://learn.microsoft.com/enus/
security/zero-trust/catalog-ai-attack-techniques/prompt-injection (accessed Oct. 2026).
16. F. Pedregosa et al., “Scikit-learn: Machine Learning in Python,” Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011.
Available: https://jmlr.org/papers/v12/pedregosa11a.html
17. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1,
2023, doi: 10.6028/NIST.AI.100-1.
18. National Institute of Standards and Technology, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and
Mitigations, NIST AI 100-2e2025, 2025. Available: https://csrc.nist.gov/pubs/ai/100/2/e2025/final
19. M. T. Ribeiro, S. Singh, and C. Guestrin, “Why Should I Trust You?: Explaining the Predictions of Any Classifier,” Proc. KDD, pp.
1135–1144, 2016, doi: 10.1145/2939672.2939778.
20. T. Saito and M. Rehmsmeier, “The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on
imbalanced datasets,” PLoS ONE, vol. 10, no. 3, e0118432, 2015, doi: 10.1371/journal.pone.0118432.
21. C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On Calibration of Modern Neural Networks,” Proc. ICML, pp. 1321–1330, 2017.
Available: https://proceedings.mlr.press/v70/guo17a.html
22. S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” Advances in Neural Information Processing
Systems, vol. 30, 2017. Available: https://arxiv.org/abs/1705.07874
23. P. Röttger et al., “XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models,” Proc. NAACL,
pp. 5377–5400, 2024, doi: 10.18653/v1/2024.naacl-long.301.
24. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial
Intelligence Profile, NIST AI 600-1, 2024. Available: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
25. MITRE, “ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems.” Available: https://atlas.mitre.org/
26. Horizon-Labs, “Prompt Injection Eval Suite,” Hugging Face Datasets. Available: https://huggingface.co/datasets/Horizon-
Labs/prompt-injection-eval-suite
27. T. Geng, Z. Xu, Y. Qu, and W. E. Wong, “Prompt Injection Attacks on Large Language Models: A Survey of Attack Methods, Root
Causes, and Defense Strategies,” Computers, Materials & Continua, vol. 87, no. 1, 2026, doi: 10.32604/cmc.2025.074081.
28. Z. Liao et al., “Attack and Defense Techniques in Large Language Models: A Survey and New Perspectives,” Neural Networks, 2025,
doi: 10.1016/j.neunet.2025.108388.
29. S. Shaheer, G. M. R. Islam, M. R. Hamid, and T. Z. Jilan, “Beyond the Benchmark: Innovative Defenses Against Prompt Injection
Attacks,” arXiv:2512.16307, 2025. Available: https://arxiv.org/abs/2512.16307
30. Y. Chen, H. Li, Z. Zheng, D. Wu, Y. Song, and B. Hooi, “Defense Against Prompt Injection Attack by Leveraging Attack Techniques,”
Proc. ACL, 2025. Available: https://aclanthology.org/2025.acl-long.897/