🤖 AI Summary
Existing prompt injection detection methods rely on large neural networks, which struggle to meet the stringent requirements of first-layer defenses—namely low latency, determinism, prompt-immunity, and auditability. To address this, this work proposes the Mirror design pattern, which constructs a strictly paired positive–negative sample mirror topology to steer classifiers toward learning the underlying attack mechanisms rather than exploiting data shortcuts, thereby prioritizing data organization over model scale. Using 5,000 open-source samples, the authors build a 32-cell mirror dataset to train a sparse character n-gram linear SVM, which is then compiled into a static Rust module. Evaluated on a held-out test set of 524 examples, the approach achieves a 95.97% recall and 92.07% F1 score, with inference latency under 1 millisecond and no dependency on external models.
📝 Abstract
Prompt injection defenses are often framed as semantic understanding problems and delegated to increasingly large neural detectors. For the first screening layer, however, the requirements are different: the detector runs on every request and therefore must be fast, deterministic, non-promptable, and auditable. We introduce Mirror, a data-curation design pattern that organizes prompt injection corpora into matched positive and negative cells so that a classifier learns control-plane attack mechanics rather than incidental corpus shortcuts. Using 5,000 strictly curated open-source samples -- the largest corpus supportable under our public-data validity contract -- we define a 32-cell mirror topology, fill 31 of those cells with public data, train a sparse character n-gram linear SVM, compile its weights into a static Rust artifact, and obtain 95.97\% recall and 92.07\% F1 on a 524-case holdout at sub-millisecond latency with no external model runtime dependencies. On the same holdout, our next line of defense, a 22-million-parameter Prompt Guard~2 model reaches 44.35\% recall and 59.14\% F1 at 49\,ms median and 324\,ms p95 latency. Linear models still leave residual semantic ambiguities such as use-versus-mention for later pipeline layers, but within that scope our results show that for L1 prompt injection screening, strict data geometry can matter more than model scale.