Prompt-injection detectors fail to transfer between agent benchmarks
Source published ·Modelwire updated
Original coverage: arXiv cs.CL ↗·How Modelwire adds context
The development
A new evaluation reveals that prompt-injection detectors widely used in LLM agent deployments fail to generalize across benchmarks, undermining the reliability of current selection methods. Researchers replayed tool calls from AgentDojo and tau-bench to construct ground-truth benign outputs, then tested fifteen detectors including Meta's Prompt Guard 2 against these realistic scenarios. The findings expose a critical gap: detectors ranking highly on BIPIA catch only 2% of injections in AgentDojo at comparable false-positive rates, while strong AgentDojo performers drop to 15% on tau-bench. This benchmark brittleness signals that production agent deployments may rely on detectors whose real-world robustness remains unvalidated, forcing teams to rethink evaluation methodology for safety-critical agent infrastructure.
Modelwire’s AI-generated summary of coverage from arXiv cs.CL.
Modelwire analysis
Skeptical readOur AI-generated reading of the wider context and the next developments to watch.
The paper doesn't actually prove detectors are unreliable in production; it shows they overfit to specific benchmark distributions. The critical omission: whether AgentDojo and tau-bench themselves are contaminated by the same data sources used to train Prompt Guard 2 and competitors, or whether the 2% and 15% gaps reflect genuine robustness failure versus legitimate domain shift.
This fits directly into a pattern Modelwire has been tracking since early October: benchmarks themselves are becoming unreliable measurement instruments. The novelty-evaluation paper from October 1st exposed how minor prompt wording changes break LLM judges; the TPRS work from October 2nd showed that threat representation artifacts inflate security scores; and now this detector study suggests the same contamination risk applies to safety infrastructure. The common thread is that the AI community is validating tools against benchmarks without validating the benchmarks themselves.
If Meta or another vendor releases detector retraining data showing explicit exclusion of AgentDojo and tau-bench samples, that confirms the paper's finding is real generalization failure. If instead they show those benchmarks were already in their training mix, the story flips from 'detectors are brittle' to 'benchmarks need isolation protocols.' Watch for this distinction in any vendor response within the next 60 days.
This interpretation is generated from the summary above and available source metadata. Our methodology · Report an error
MentionsMeta · Prompt Guard 2 · AgentDojo · tau-bench · BIPIA
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.