Open prompt-injection and jailbreak classifiers, all evaluated with the same script at a 0.5 threshold on 12 public sets. The sets cover over-defense (false alarms on benign look-alikes), direct injection and jailbreaks, indirect injection planted in documents, emails and RAG contexts, and character-level evasion. Click a column to sort. The best value in each column is highlighted.
Disclosure: this page is maintained by Horizon Labs, which also makes two of the listed models.
We deduplicated our own training data against every set here, but the choice of sets reflects what we care about (agents,
indirect injection, over-defense). Qualifire and Mindgard favour other models. The "macro" column averages the non-robustness
sets and rewards models that flag everything on the recall-only sets, so read it together with the mean FPR column.
Eval code: code/train/evaluate.py in
the model repo. Data:
prompt-injection-eval-suite (Qualifire and Mindgard
are gated and non-commercial, so they are evaluated but not redistributed). Want a model added or found a problem? Open a discussion on this Space.
Metrics: F1 on mixed sets (FPR on the benign half in the tooltip), accuracy on benign-only sets, recall on attack-only sets. Long inputs are windowed (max over windows; 512 tokens for DeBERTa models, 2048 for 8k-context models). Snapshot: 2026-09-23.