Sentinel: SOTA model to protect against prompt injections

Dror Ivry; Oran Nahum

REVIEW 4 major objections 6 minor 26 references

Sentinel: SOTA model to protect against prompt injections

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Sentinel claims 98.7% accuracy at catching prompt injections

desk verdict The paper's central SOTA claim is contradicted by its own Table 1, where the reported F1 scores cannot be derived from the reported precision and recall. read the letter →

arxiv 2506.05446 v1 pith:SOPCUSWW submitted 2025-06-05 cs.CR cs.AI

Dror Ivry , Oran Nahum This is my paper

classification cs.CRcs.AI

keywords promptinjectiondetectionLLMsecurityModernBERTjailbreakbinaryclassifierfine-tuninglow-latency

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims to build a state-of-the-art prompt-injection detector, Sentinel, by fine-tuning ModernBERT-large on a carefully aggregated mix of open-source and private datasets. On a held-out internal test set it reports an average accuracy of 0.987 and an F1 score of 0.980, and on four public benchmarks it reports an average binary F1 of 0.938, beating the DeBERTa-v3-based baseline by roughly 23 points. The practical payoff is that LLM applications could gate user input with a lightweight classifier that adds about 20 milliseconds of latency per prompt. The authors attribute the improvement to a modern base model combined with diverse, carefully curated training data.

What carries the argument

The load-bearing mechanism is the pairing of a modern encoder architecture with a diverse training corpus. Sentinel is a 395M-parameter binary classifier obtained by fine-tuning ModernBERT-large, a bidirectional encoder-only Transformer with 28 layers, a native 8192-token context, rotary position embeddings, local-global alternating attention, unpadding, and Flash Attention. The training set is consolidated to roughly 70% benign and 30% jailbreak prompts, split 90/10 into training and held-out test, with the private synthetic portion aimed at nuanced error correction and real-world misclassifications. The same architecture-plus-data recipe is what the paper credits for the transfer to public benchmarks.

What would settle it

Collect a fresh corpus of prompt-injection attacks created after Sentinel's training cutoff, none of which appeared in its public benchmarks, and run the released model on it; if its F1 falls toward the DeBERTa-v3 baseline rather than staying near 0.98, the generalization claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that fine-tuning ModernBERT-large as a binary benign-versus-injection classifier on a 70/30 mix of benign and jailbreak prompts, drawn from several open-source collections plus a small private synthetic set, yields a detector that sets a new state of the art for prompt-injection detection. The evidence is a 10% held-out internal test set where Sentinel scores 0.987 average accuracy, 0.991 recall, 0.986 precision, and 0.980 F1, versus 0.848, 0.905, 0.820, and 0.728 for the DeBERTa-v3 baseline, plus four public benchmarks where Sentinel averages 0.938 F1 against the baseline's 0.709. The authors argue that ModernBERT's architectural features and the diversity of the curated data are what produce the gain.

Load-bearing premise

The internal held-out test set is representative of real-world prompts and does not share distributional artifacts with the training data, since the random split preserves the same sources and the private-data generation process is not described.

Editorial extensions

If this is right

At roughly 0.02 seconds per inference on an L4 GPU, Sentinel can serve as a low-latency pre-filter in front of LLM calls, making prompt-injection detection a real-time gate.
The reported F1 gain over the DeBERTa-v3 baseline (0.938 versus 0.709 averaged across four benchmarks) implies that older detector architectures are comparatively brittle on scenario-based and in-the-wild attack data.
Because the model is released publicly, application developers can reproduce the core result and integrate the detector without retraining.
The training mix suggests that a small private synthetic set targeting specific error patterns can improve a detector without requiring a massive new corpus.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves implicit that its internal test set is a random split of the same source collections used for training, so samples share formatting and topic distributions; genuinely novel attack families could reduce the reported margin over the baseline.
The error analysis found no recurring categories in misclassifications; a useful next experiment would be to stress Sentinel with character-level obfuscation, role-play reframing, and encoding tricks to map where its decision boundary actually gives way.
Including the authors' own benchmark among the four public sets may inflate the averaged comparison; the strongest test would come from fully independent third-party benchmarks collected after the model's training cutoff.
Sentinel's design as a binary classifier on raw prompt text could be extended to indirect prompt injections hiding in retrieved documents or tool outputs, a setting the paper does not evaluate.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The stress-test note is right, and it matters. In Table 1, for the DeBERTa-v3 baseline, precision 0.820 and recall 0.905 give F1 ≈ 0.860, not 0.728. For Sentinel, precision 0.986 and recall 0.991 give F1 ≈ 0.988, not 0.980. Since F1 is fully determined by precision and recall, at least one value in each row is wrong. The claimed F1 margin on the internal test set is therefore not what the table says. That is not a minor typo; it is the central empirical claim of the paper.

What is genuinely here: Sentinel is a fine-tuned ModernBERT-large binary classifier for prompt injection, and the authors have put the model on Hugging Face. Fine-tuning a strong encoder on a mixture of public and private data is a reasonable engineering approach, and the paper documents the public datasets and the training split clearly enough. The latency number on an L4 GPU (~0.02s) is plausible and useful for practitioners.

But the evaluation has more problems. Only one external baseline is used, with no confidence intervals or multiple runs. The internal test set is a random 10% split from the same sources as training, so it is in-distribution by construction. The private data generation and split process are not described, so leakage or iterative refinement on the same test set cannot be ruled out. And Table 2 includes qualifire/Qualifire-prompt-injection-benchmark, a dataset created by the same company, in the public average. That is not disqualifying by itself, but combined with the opaque private data it makes the SOTA claim hard to trust.

Who this is for: practitioners who want a fast, ready-made detector might still try the model, but the paper as written does not establish that it is state of the art. The honest fix is to correct the table, release the evaluation code and either the private data or a detailed generation protocol, and compare against several strong baselines (including other fine-tuned detectors and possibly LLM-as-judge).

Recommendation: if this lands on my desk, I would send it back for major revision. A referee should be able to check the numbers after the authors fix them. As it stands, the arithmetic error alone is enough to reject, but the underlying work is not worthless. If the authors provide the missing evidence, a revised version could be a useful applied contribution.

Referee Report

4 major / 6 minor

Summary. The paper introduces Sentinel (qualifire/prompt-injection-sentinel), a binary prompt-injection detector obtained by fine-tuning answerdotai/ModernBERT-large on a mix of open-source and private datasets. The authors report an average accuracy of 0.987 and an F1-score of 0.980 on a held-out internal test set, and they report Binary F1 scores on four public benchmarks, claiming consistent superiority over the protectai/deberta-v3-base-prompt-injection-v2 baseline. The paper also describes the dataset composition, training setup, latency measurements, a brief error analysis, and a code snippet for inference.

Significance. If the reported numbers are correct, Sentinel would be a practically useful, low-latency prompt-injection detector and a credible open-source alternative to currently available detectors. The authors should be credited for releasing a fine-tuned model, using a strong modern encoder (ModernBERT-large), and reporting latency on a concrete GPU. However, the evidence as presented is not yet sufficient to support the 'state-of-the-art' claim. The most serious problems are internal: Table 1 contains mutually inconsistent precision/recall/F1 values for both models, and the public benchmark evaluation in Table 2 includes a benchmark created by the same authors, so the headline margins are not yet independently established. The lack of confidence intervals, multiple runs, and reproducible evaluation code further limits the strength of the empirical contribution.

major comments (4)

[§5.1, Table 1] The reported metrics are arithmetically inconsistent. For the baseline protectai/deberta-v3-base-prompt-injection-v2, precision=0.820 and recall=0.905 imply an F1 score of 2·0.820·0.905/(0.820+0.905) ≈ 0.860, not the reported 0.728. For Sentinel, precision=0.986 and recall=0.991 imply F1 ≈ 0.988, not the reported 0.980. Since F1 is fully determined by precision and recall, at least one value in each row is misreported or was computed differently than stated. This affects the headline margin: the claimed internal F1 advantage of 0.252 would shrink to roughly 0.128 if the corrected baseline value is used. Please recompute all metrics from the confusion matrices, report the confusion matrices or prediction logs, and update the text in §5.1 accordingly.
[§5.2, Table 2] The public-benchmark evaluation includes qualifire/Qualifire-prompt-injection-benchmark, a dataset created by the same authors. Including a self-created benchmark in the average F1 score (0.938 vs 0.709) conflates the model's ability on independently collected data with its behavior on a dataset that may share distributional properties with Sentinel's training data. The claim that Sentinel 'consistently outperforms' the baseline across all datasets is therefore not established by independent evidence. Please report results excluding the self-created benchmark, provide a detailed description of how that benchmark was constructed, and, if possible, evaluate on additional third-party benchmarks that were not used in training.
[§3.2.2, §3.2.3] The description of the private dataset and the train/test split is too opaque to support the generalization claim. The paper states that qualifire-synthetics contains 1,400 samples synthesized using LLMs, but does not describe the generation prompts, the filtering process, or whether the synthetic data was iteratively refined based on failures on the internal test set. It is also not stated whether the 90/10 split was random, stratified, or performed before or after any development decisions, nor whether the test set was used for model selection. If the held-out test set shares distributional artifacts with the training sources, which is likely given that all open-source sources are either fully or partially used in training, then the reported 0.987 accuracy and 0.980 F1 may not transfer to genuinely novel attack distributions. Please specify the split procedure, report the class balance of the test set, and evaluate on a distributionally shifted or temporally separated test set.
[§5] The evaluation reports a single run with no confidence intervals, no standard deviations, and no multiple seeds, so the stability of the reported metrics is unknown. Moreover, the 'state-of-the-art' claim is supported by comparison against only one external baseline; several other open-source prompt-injection detectors exist and should be included for a fair SOTA comparison. Providing the evaluation code, the exact inference script, and the predictions would make the numbers checkable and would substantially increase confidence in the results.

minor comments (6)

[§5.3] The latency discussion refers to the model as 'extremely small,' but Sentinel has 0.395B parameters; this is not extremely small by encoder standards. Please report the input lengths, batch size, number of warmup iterations, and whether the latency is end-to-end or model-only.
[§6.1] The error analysis is informal: the 'random sample' size is not given, the method of manual review is not described, and the two sentences 'we didn't observed any specific identifiers' and 'typically included...' appear contradictory. Please clarify the methodology and provide representative examples.
[§3.2.1] Please provide a table with the exact number of samples taken from each open-source dataset and the final class distribution. The current description only gives partial counts (e.g., 7,000 benign samples from several sources) and does not specify the number of jailbreak samples from each source.
[References] Several reference URLs are truncated in the bibliography (e.g., [2], [12], [19], [20]), making them unusable as submitted. Please ensure all URLs are complete.
[§5.1] Please define how 'AvgAcc' and the reported F1 were computed. It is unclear whether accuracy is macro-averaged across classes, and whether F1 is computed per class or as a binary positive-class F1.
[§6] The limitation section is candid but brief. Please also state clearly that the private datasets are not publicly available and that exact reproduction of the training environment is impossible without access to them, as this is already acknowledged in limitation 2 but should be reflected in the reproducibility statement.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the performance claim is empirical and self-contained; concerns are reproducibility/correctness, not circularity.

full rationale

Sentinel's central claim is empirical: after fine-tuning ModernBERT-large on a curated mix of open-source and private datasets, the model scores 0.987 accuracy and 0.980 F1 on a held-out 10% internal split and higher F1 than protectai/deberta-v3-base-prompt-injection-v2 on public benchmarks. There is no formal derivation chain in which an output metric is used to define a model parameter, and no fitted quantity is relabeled as a prediction. The 90/10 random split ("ensuring no overlap between them") means the internal test strings are disjoint from training strings, so the reported internal numbers are not tautological. The self-citations [17] and [18] point to the authors' own benchmark and model card; they are artifacts used for evaluation rather than theoretical premises that load-bear the argument. The private datasets and the authors' own benchmark could raise independence or reproducibility concerns, but those are not circularity. Separately, Table 1's precision/recall/F1 values are arithmetically inconsistent (for the baseline, 2*0.820*0.905/(0.820+0.905) is about 0.860, not 0.728; for Sentinel, the stated values imply F1 about 0.988, not 0.980). That is a correctness/reporting issue, not evidence that the derivation reduces to its inputs. Therefore no circular step is exhibited and the circularity score is 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The central claim rests on the integrity of the data split and the fairness of the baseline comparison. The paper provides minimal evidence for these assumptions, and the private datasets are not auditable.

free parameters (1)

Training set class balance = 70% benign / 30% jailbreak
The paper states the dataset was structured to have approximately 70% benign and 30% jailbreak prompts, but this ratio is a design choice and is not derived or justified.

assumptions (3)

domain assumption The 90/10 random split creates a test set that is disjoint from the training set.
The paper asserts this split but provides no details on the random seed, stratification, or how the split was performed.
domain assumption The private synthetic dataset was generated without using the evaluation test set.
The paper does not describe the generation process or confirm that no test examples leaked into the training data.
domain assumption The baseline model was evaluated under identical preprocessing and threshold settings.
No details are given on how the baseline was loaded, thresholded, or scored, so it is assumed to be a fair comparison.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Sentinel: SOTA model to protect against prompt injections." pith.science (2026). https://pith.science/paper/SOPCUSWW

@misc{pith2026250605446,
  author       = {Pith},
  title        = {Pith review of: Sentinel: SOTA model to protect against prompt injections},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SOPCUSWW}},
  note         = {Machine review of arXiv:2506.05446}
}

read the original abstract

Large Language Models (LLMs) are increasingly powerful but remain vulnerable to prompt injection attacks, where malicious inputs cause the model to deviate from its intended instructions. This paper introduces Sentinel, a novel detection model, qualifire/prompt-injection-sentinel, based on the \answerdotai/ModernBERT-large architecture. By leveraging ModernBERT's advanced features and fine-tuning on an extensive and diverse dataset comprising a few open-source and private collections, Sentinel achieves state-of-the-art performance. This dataset amalgamates varied attack types, from role-playing and instruction hijacking to attempts to generate biased content, alongside a broad spectrum of benign instructions, with private datasets specifically targeting nuanced error correction and real-world misclassifications. On a comprehensive, unseen internal test set, Sentinel demonstrates an average accuracy of 0.987 and an F1-score of 0.980. Furthermore, when evaluated on public benchmarks, it consistently outperforms strong baselines like protectai/deberta-v3-base-prompt-injection-v2. This work details Sentinel's architecture, its meticulous dataset curation, its training methodology, and a thorough evaluation, highlighting its superior detection capabilities.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

26 extracted references · 19 canonical work pages

[1]

Is your prompt safe? investigating prompt injection attacks against open-source llms

Abdalrahman Al-Kaswan, Zhaohan Y ao, Sijia Liu, and Pin- Y u Chen. Is your prompt safe? investigating prompt injection attacks against open-source llms. arXiv preprint arXiv:2505.14368 , 2025

arXiv 2025
[2]

alespalla/chatbot_instruction_prompts dataset

alespalla. alespalla/chatbot_instruction_prompts dataset. https://huggingface.co/datasets/alespalla/chatbot

work page
[3]

Evolving security in llms: A study of jailbre ak attacks and defenses

Anonymous. Evolving security in llms: A study of jailbre ak attacks and defenses. arXiv preprint arXiv:2504.02080, 2025. 5 Qualiﬁre paper

arXiv 2025
[4]

answerdotai/ModernBERT-large model card

Answer.AI. answerdotai/ModernBERT-large model card. https://huggingface.co/answerdotai/ModernBERT-large

work page
[5]

Flashattention: Fast and memory- efﬁcient exact attention with io-awareness

Tri Dao, Daniel Y Fu, Stefano Ermon, Atri Rudra, and Chris topher Ré. Flashattention: Fast and memory- efﬁcient exact attention with io-awareness. In Advances in Neural Information Processing Systems , volume 35, pages 16284–16299, 2022

work page 2022
[6]

deepset/prompt-injections dataset

deepset. deepset/prompt-injections dataset. https://huggingface.co/datasets/deepset/prompt-inje ctions,

work page
[7]

Not what you’ve signed up for: Compromising real-world llm-integra ted applications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christ oph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integra ted applications with indirect prompt injection. In Proceedings of the 16th ACM W orkshop on Artiﬁcial Intellige nce and Security, pages 25–36, 2023

work page 2023
[8]

Deberta: Decoding-enhanced bert with disen- tangled attention

Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Che n. Deberta: Decoding-enhanced bert with disen- tangled attention. In International Conference on Learning Representations (IC LR), 2021

work page 2021

Show all 26 references

[10]

Wildtea ming at scale: From in-the-wild jailbreaks to (adversarially) safer language models

Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Y ejin Choi, and Nouha Dziri. Wildtea ming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. arXiv preprint arXiv:2...

2024 arXiv
[11]

lmsys/toxic-chat dataset

lmsys. lmsys/toxic-chat dataset. https://huggingface.co/datasets/lmsys/toxic-chat, 2023. Ac- cessed: June 1, 2025

2023
[12]

jackhhao/jailbreak-classification dataset

jackhhao. jackhhao/jailbreak-classification dataset. https://huggingface.co/datasets/jackhhao/jailbreak-
[14]

Perez and I

F. Perez and I. Ribeiro. Ignore previous prompt: An empi rical analysis of characterizing and mitigating prompt injection attacks. arXiv preprint arXiv:2211.09527 , 2022

2022 arXiv
[15]

protectai/deberta-v3-base-prompt-injection model card

ProtectAI. protectai/deberta-v3-base-prompt-injection model card. https://huggingface.co/protectai/deberta-v3-base-pr ompt-injection, 2023. Accessed: June 1, 2025

2023
[16]

microsoft/orca-agentinstruct-1M-v1 dataset

Microsoft. microsoft/orca-agentinstruct-1M-v1 dataset. https://huggingface.co/datasets/microsoft/orca-age
[18]

OpenSafetyLab/Salad-Data dataset

OpenSafetyLab. OpenSafetyLab/Salad-Data dataset. https://huggingface.co/datasets/OpenSafetyLab/Salad-Data
[20]

Do Anything Now

Xinyue Shen, Zeyuan Chen, Michael Backes, Y un Shen, and Y ang Zhang. “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Lang uage Models. In ACM SIGSAC Conference on Computer and Communications Security (CCS) . ACM, 2024

2024
[21]

Roformer: Enhanced transformer with rotary position embedding

Jianlin Su, Y u Lu, Shengfeng Pan, Ahmed Murtadha, Bo Wen , and Y unbo Liu. Roformer: Enhanced transformer with rotary position embedding. arXiv preprint arXiv:2104.09864 , 2021

2021 arXiv
[22]

protectai/deberta-v3-base-prompt-injection-v2 model card

ProtectAI. protectai/deberta-v3-base-prompt-injection-v2 model card. https://huggingface.co/protectai/deberta-v3-base-pr ompt-injection-v2, 2023. Accessed: June 1, 2025

2023
[23]

qualifire/Qualifire-prompt-injection-benchmark Dataset

Qualiﬁre. qualifire/Qualifire-prompt-injection-benchmark Dataset. https://huggingface.co/datasets/qualifire/Qualifire-prompt-injection-benchmark, 2025. Accessed: June 1, 2025. Please update URL if it changes

2025
[24]

qualifire/prompt-injection-sentinel Model Card

Qualiﬁre. qualifire/prompt-injection-sentinel Model Card. https://huggingface.co/qualifire/prompt-inject
[26]

reshabhs/SPML-Chatbot-Prompt-Injection dataset

reshabhs. reshabhs/SPML-Chatbot-Prompt-Injection dataset. https://huggingface.co/datasets/reshabhs/SPML_Ch
[30]

VMware/open-instruct dataset

VMware AI Labs. VMware/open-instruct dataset. https://huggingface.co/datasets/VMware/open-instruc t,
[31]

Accessed: June 1, 2025

2025
[32]

Smarter, better, faster, longer: A mod- ern bidirectional encoder for fast, memory efﬁcient, and lo ng context ﬁnetuning and inference

Brennan Warner, Alex Chafﬁn, Benjamin Clavié, Orion We ller, Oliver Hallström, Salma Taghadouini, An- drew Gallagher, Ritam Biswas, Feroze Ladhak, Thijs Aarsen, et al. Smarter, better, faster, longer: A mod- ern bidirectional encoder for fast, memory efﬁcient, and lo ng contex...

2024 arXiv
[33]

OET: An optimization-based evalua- tion toolkit for benchmarking prompt injection attacks and defenses

Y aguan Zhang, Jia Li, Zhaofeng Wang, Xinyi Chen, Yi Liu, and Lin Song. OET: An optimization-based evalua- tion toolkit for benchmarking prompt injection attacks and defenses. arXiv preprint arXiv:2505.00843 , 2025. 6

2025 arXiv
[2025]

Please update URL if it changes

Accessed: June 1, 2025. Please update URL if it changes

2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Is your prompt safe? investigating prompt injection attacks against open-source llms

Abdalrahman Al-Kaswan, Zhaohan Y ao, Sijia Liu, and Pin- Y u Chen. Is your prompt safe? investigating prompt injection attacks against open-source llms. arXiv preprint arXiv:2505.14368 , 2025

arXiv 2025

[2] [2]

alespalla/chatbot_instruction_prompts dataset

alespalla. alespalla/chatbot_instruction_prompts dataset. https://huggingface.co/datasets/alespalla/chatbot

work page

[3] [3]

Evolving security in llms: A study of jailbre ak attacks and defenses

Anonymous. Evolving security in llms: A study of jailbre ak attacks and defenses. arXiv preprint arXiv:2504.02080, 2025. 5 Qualiﬁre paper

arXiv 2025

[4] [4]

answerdotai/ModernBERT-large model card

Answer.AI. answerdotai/ModernBERT-large model card. https://huggingface.co/answerdotai/ModernBERT-large

work page

[5] [5]

Flashattention: Fast and memory- efﬁcient exact attention with io-awareness

Tri Dao, Daniel Y Fu, Stefano Ermon, Atri Rudra, and Chris topher Ré. Flashattention: Fast and memory- efﬁcient exact attention with io-awareness. In Advances in Neural Information Processing Systems , volume 35, pages 16284–16299, 2022

work page 2022

[6] [6]

deepset/prompt-injections dataset

deepset. deepset/prompt-injections dataset. https://huggingface.co/datasets/deepset/prompt-inje ctions,

work page

[7] [7]

Not what you’ve signed up for: Compromising real-world llm-integra ted applications with indirect prompt injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christ oph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integra ted applications with indirect prompt injection. In Proceedings of the 16th ACM W orkshop on Artiﬁcial Intellige nce and Security, pages 25–36, 2023

work page 2023

[8] [8]

Deberta: Decoding-enhanced bert with disen- tangled attention

Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Che n. Deberta: Decoding-enhanced bert with disen- tangled attention. In International Conference on Learning Representations (IC LR), 2021

work page 2021