Zero-Shot Classifier vs Dedicated Prompt Injection Detector

Zero-shot classifiers and dedicated prompt injection detectors make different bets about what reveals an attack. For agentic systems, zero-shot approaches generally fit broad, shifting sources of untrusted content better, while dedicated detectors suit narrow, stable domains. The choice is consequential because a missed injection can redirect an entire workflow, but neither approach replaces controls on what an agent can execute, remember, or pass downstream.

Why prompt injection becomes a cascade problem in agentic systems, not just a bad output

LLMs process system instructions, user requests, and externally retrieved text as a single token stream. No native boundary reliably separates trusted instructions from untrusted data. When a model can plan and use tools, that ambiguity extends beyond the answer it produces. An instruction hidden in retrieved content can redirect the actions that follow, turning a model-level manipulation into a multi-tool attack chain.

OWASP Top 10 for Agentic Applications 2026 names this failure ASI01, Agent Goal Hijack. A manipulated input can hijack planning, trigger privileged tool calls, place malicious instructions in persistent memory, and propagate an attack to connected agents. Each step opens another surface for the attacker. An agent’s legitimate capabilities can therefore amplify a wrong instruction across a workflow.

EchoLeak illustrates the consequences of that amplification. The vulnerability in Microsoft 365 Copilot, CVE-2025-32711, with a CVSS score of 9.3, used a crafted email that the user never opened. It coerced the agent into accessing data across the M365 environment, including emails, OneDrive files, SharePoint content, and Teams messages, and transmitting it externally. No user interaction was required for the attack. Indirect injection through documents, emails, web pages, and database records has become the dominant agentic threat vector, making external content a central concern for detector selection.

Gadgil et al. (2026) show that payloads already planted in persistent memory files, such as CLAUDE.md or AGENTS.md, can attack current and future sessions across Claude Code and OpenAI Codex. A successful injection need not remain confined to one encounter with external content. Once planted in memory, it can survive without re-injection.

How dedicated prompt injection detectors are built and what they are optimized for

Dedicated detectors treat prompt injection as a recognizable class of input that can be learned from labeled examples. A common design uses a fine-tuned transformer-based classifier trained on benign prompts and known injection or jailbreak triggers. The classifier learns distinctions within that training distribution. Its central bet is that future malicious inputs will share enough features with known attacks to remain distinguishable from legitimate requests.

This design has a practical deployment advantage. It does not require changes to the base model, and a guardrail can sit in front of or behind the target model. ProtectAI’s deberta-v3-base-prompt-injection-v2, Meta’s PromptGuard, LlamaGuard, and Granite Guardian represent dedicated fine-tuned approaches, although their coverage of harm categories differs. Their training defines what they are equipped to recognize, with high recall on represented attack patterns as a central objective.

Specialization can make that bet a sound one. BrowseSafe shows that domain-specific fine-tuning for web and browser-agent content, with a large-scale Qwen-Instruct base, can reach high F1 where smaller generic detectors fail. The distinction is scope. A well-characterized domain provides a clearer relationship between the examples used for training and the content encountered in operation. Under those conditions, a dedicated detector is a targeted control rather than an attempt to recognize every possible injection.

Where dedicated detectors break down: the false-positive trap and the out-of-distribution collapse

The first failure mode is excessive blocking of legitimate content. Agentic workflows often find instructions in documents and tool results, so language that sounds like an instruction is not enough on its own to show an attack. A detector trained around chatbot-era jailbreaks can mistake legitimate agentic content for malicious input. Operational utility then becomes the limiting constraint. A guardrail that blocks approved requests or tool calls can prevent the agent from completing its work before an attacker intervenes.

Malicious instructions hidden in documents, calendar entries, or web pages that look believable can differ from the attacks seen during training. LlamaGuard and Granite Guardian show how spotting general harmful content differs from spotting subtle prompt injection. Strength on general harm categories does not necessarily transfer to an instruction that redirects an agent without using overtly harmful language.

A 2026 comparative study published in the International Journal of Information Security found that the ProtectAI detector reached only a small fraction of expected recall on a balanced benchmark comparing specialized pre-trained detectors with fine-tuned general encoders. An indirect prompt injection benchmark evaluating eight detectors exposed the same practical tension from another direction. At a very low false-positive rate, even the best single detector caught only a small minority of injections.

These are separate failures with a shared cause. A fixed training corpus captures a snapshot of attack and benign input distributions, while an agent’s external content can vary far beyond that snapshot. This establishes the condition under which BrowseSafe’s domain-specific result is relevant, namely that the deployment remains close enough to the detector’s learned scope for both recall and false-positive performance to hold.

How zero-shot approaches detect injection differently and what that buys

Zero-shot approaches make a different bet about the signal. Rather than relying on a labeled library of known attack forms, they can examine changes in meaning or signals within the model’s processing. ZEDD, Zero-Shot Embedding Drift Detection, compares a suspect prompt with a clean variant and measures their semantic separation in embedding space.

That distinction gives ZEDD a route beyond surface matching. Rephrasing an instruction can change its words without removing the semantic shift that the detector measures. ZEDD’s experiments show strong accuracy across Llama 3, Qwen 2, and Mistral, with a low false-positive rate. By measuring semantic drift, the approach can flag previously unseen injection techniques. This is a basis for day-zero detection.

Activation-based approaches provide a separate zero-shot signal. At a matched benign false-positive rate, activation probes achieve 68.2% recall on indirect injection attacks, outperforming PromptGuard 2, LlamaGuard, and a language model used as a judge. Matching the false-positive rate also makes the result more useful operationally, since detection gains are compared at the same level of benign blocking.

External documents and retrieved content can carry new attacks whose words give few clues to a classifier trained on known patterns. Embedding drift and activation signals provide other evidence of manipulation. Their observed strength on indirect injection aligns with the dominant agentic threat surface, although these distinct methods should not be treated as interchangeable implementations.

Why adaptive attacks expose the limits of both approaches

An attacker who can observe detector feedback can optimize against the detection layer itself. A search-based adaptive attack that gives the attacker confidence scores and detection flags had an attack success rate of more than 90% against ProtectAI, PromptGuard, and Model Armor.

ZEDD resists simple paraphrasing because its signal is semantic drift. That resistance does not make it immune to adaptation. A sufficiently informed adversary with access to embedding-space signals can still optimize against it. The cited adaptive result does not measure how often ZEDD fails, but resisting rephrasing still differs in an important way from resisting an attacker who knows how to optimize against it.

Five Eyes joint guidance, “Careful Adoption of Agentic AI Services,” issued in May 2026, identifies prompt injection as a core manipulation vector and states that no single safeguard is sufficient. It recommends governance, explicit accountability, rigorous monitoring, and human oversight at consequential decisions. Detectors should be evaluated by how effectively they contribute within a layered architecture.

Matching detector type to attack surface: when each approach wins in practice

A dedicated detector fits a tightly scoped agent whose inputs and injection surface are stable and well characterized. Homogeneous inputs also make benign behavior easier to represent during training. This favors a dedicated approach when real traffic remains close to that distribution and its false-positive rate is acceptable. Latency and compute constraints can further favor this option when embedding-drift or activation-probe infrastructure is impractical.

A zero-shot approach fits an agent ingesting broad external content, including web pages, documents, emails, and RAG retrievals. Those channels combine indirect injection with a changing input distribution, weakening the assumption that labeled examples can adequately represent future attacks. Novel variants are also a credible concern for agents exposed to adversarial web content. In that setting, a signal that does not depend on recognizing familiar attack wording is the better architectural fit.

ZEDD had a 3% false-positive rate in its 2026 evaluation, which supports its use where blocking benign input would keep an agent from doing useful work. That result favors embedding-drift detection over high-recall, high-false-positive dedicated configurations such as PromptGuard-2 when the deployment resembles the evaluated conditions. It is not a universal operating rate. The relevant comparison remains performance on the content and approved workflows the agent will actually encounter.

For mixed deployments, the practical pattern is to use zero-shot or embedding-based detection as a broad indirect-injection screen during external content ingestion. A tightly scoped fine-tuned detector can serve high-volume, well-characterized channels where its false-positive rate can be validated against real traffic. Most agent runtime risks arise at the plugin and skill execution layer, so screening only prompt inputs leaves serious risks whichever classifier is used. Persistent memory also needs provenance controls beyond checks when an input first arrives.

What detector choice cannot substitute for: the controls that must sit alongside any classifier

To contain the cascade, teams should pair detection with controls that restrict propagation and execution. Memory provenance and isolation show where stored instructions came from and keep external content from writing high-priority memory. These controls directly address the persistent-payload risk documented by Gadgil et al. Tool sandboxing and minimal privileges address a different consequence. They limit what a successful injection can execute by restricting agents to the permissions required for the approved workflow.

Goal-lock mechanisms and human approval for high-impact actions further limit what an agent can do when it has been redirected. The Five Eyes guidance treats oversight at consequential decisions as a necessary safeguard. Meta’s Agents Rule of Two gives that requirement a concrete architectural form. Without human approval, an agent should satisfy at most two of three properties, namely access to sensitive systems or private data, processing untrustworthy inputs, and the ability to change state or communicate externally. Combining all three requires a human in the loop.

Deployment testing must then establish whether the chosen controls work without disabling approved behavior. A detector’s reputation or benchmark score cannot establish that fit. Teams should prove the relevant attack in an isolated environment, apply the smallest safeguard that stops it, and verify that approved workflows still pass. Production readiness rests on that evidence.