Enhancing security in LLM applications: a performance evaluation of early detection systems

Summary

Researchers evaluated early prompt injection detection systems against prompt leak attacks built on context-ignoring and context-manipulation techniques. They compared LLM Guard, Vigil, and Rebuff, finding that the canary word-based detection in Vigil and Rebuff was weak against these attacks, and that Rebuff's secondary model-based technique had an evasion weakness. Vigil was found optimal when a minimal false positive rate is required, and Rebuff when the highest detection rate is needed.

Mitigation

The authors propose improvements for the canary word-based detection techniques in Vigil and Rebuff, and they proposed a mitigation for the evasion weakness in Rebuff's secondary model-based technique. The specific details of these improvements and mitigation are not given in the source text.

Related items

• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
• MediumGHSA-hmq2-7hp6-7crh: Banks: User-controlled prompt input can be parsed as privileged chat messagesSimilar attack · GitHub Advisory Database
• CriticalGHSA-9mp3-24cc-77mg: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsSimilar attack · GitHub Advisory Database
• Medium'AgentCorruption' Puts AWS Environments At Risk With Single PromptSimilar attack · Dark Reading
• MediumGHSA-4xxv-6wmf-xf45: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspaceSimilar attack · GitHub Advisory Database