ctrltokyo/prompt-injection-detector
The ctrltokyo/prompt-injection-detector is a 0.5 billion parameter Qwen2.5-0.5B-Instruct model, fine-tuned by Alexander Nicholson, specifically designed for detecting prompt injection attacks. It functions as the reasoning component within a Decode-Reason-Classify (DRC) pipeline, achieving 100% detection across 25 distinct injection techniques with zero false positives. This model excels at semantic and novel attack detection, complementing deterministic decoders for encoding and structural attacks.
Loading preview...
Prompt Injection Detector (DRC Pipeline)
This model, developed by Alexander Nicholson, is a fine-tuned Qwen2.5-0.5B-Instruct (0.5 billion parameters) specifically designed for detecting prompt injection attacks. It serves as the crucial 'Reason' stage in a Decode → Reason → Classify (DRC) pipeline, which collectively achieves 100% detection across 25 distinct injection techniques with 0 false positives on an adversarial test suite.
Key Capabilities
- Chain-of-Thought Reasoning: Utilizes detailed analysis to identify semantic and novel injection attacks.
- Comprehensive Detection: When integrated into the full DRC pipeline, it detects a wide range of attacks including:
- Classic jailbreaks: DAN, Developer Mode, STAN, EvilBOT.
- Encoding attacks: ASCII, ROT13, Base64, disemvoweling, emoji ciphers (handled by the Decode stage).
- Indirect injections: HTML comments, email worms, ChatML C2.
- Structural attacks: GODMODE, predictive reasoning, deceptive delight sandwich, many-shot ICL.
- Instruction exploits: Translation tricks, response priming, variable expansion.
- High Accuracy: Demonstrated 100% correct detection on 25 injection techniques and 8 benign samples.
When to Use This Model
- Robust Prompt Injection Defense: Ideal for developers seeking to protect their LLM applications from a broad spectrum of prompt injection attacks.
- Integrated Security: Best utilized as part of the provided DRC pipeline for optimal performance, as the standalone model may miss certain encoding attacks.
- English-focused Applications: Primarily trained on English data, making it most effective for English-language prompt security.
Limitations: The model alone is not sufficient; the full DRC pipeline is required for reliable detection. It is English-focused and may not detect novel attack patterns not represented in its training data. It serves as a detection tool, not a full content filter.