![We retrained our prompt-injection classifier from scratch because it was crying wolf too often. [R]](https://preview.redd.it/6ysjm0ux2akh1.png?auto=webp&s=ed61449193a605eb66d3e103cbb02f529da500d7)
We retrained our prompt-injection classifier from scratch because it was crying wolf too often. [R]
We retrained Wolf Defender.
The main reason was not that attack detection was bad. The bigger issue was false positives.
The previous models were already good at detecting prompt injections, but especially on short benign inputs, security-related text, code snippets or ordinary conversations they could still be too aggressive. We also got a few reports from users that made this pretty obvious.
One example was just:
“Who are you?”
Wolf Defender Small previously classified this as a prompt injection with around 94% confidence.
For v2 we therefore changed the training setup quite a bit. Both Wolf Defender and Wolf Defender Small were retrained from fresh mmBERT checkpoints, with a much stronger focus on hard negatives.
That includes short conversations, emails, documentation about prompt injections, benign policy and system language, code and configuration snippets and generally inputs that contain words or structures which look suspicious without actually trying to manipulate a model.
We also added more counterfactual samples, multilingual examples, adversarial obfuscations and long-context injections at different positions in a document. Training combines short 256-token samples with full 2,048-token windows and uses supervised contrastive regularization, FreeLB adversarial training and Smooth-Max aggregation for long documents.
The main change can be seen in the benign benchmarks:
| Model | Benchmark | v1 | v2 |
|---|---|---|---|
| Wolf Defender | Hard benign specificity | 81.57% | 96.23% |
| Wolf Defender | Real-world benign specificity | 66.85% | 96.63% |
| Wolf Defender Small | Hard benign specificity | 82.12% | 96.67% |
| Wolf Defender Small | Real-world benign specificity | 73.60% | 94.38% |
At the same time, attack detection stayed roughly where we wanted it:
| Model | Qualifire F1 | Jayavibhav F1 |
|---|---|---|
| Wolf Defender | 95.14% | 97.84% |
| Wolf Defender Small | 95.21% | 97.68% |
There is also a tradeoff here. Some of the very high scores on our cleaner validation distributions went down slightly.
For us that is fine.
A security classifier with near-perfect benchmark scores is not very useful if normal traffic gets blocked all the time. We would rather lose a small amount on an easier validation set and get substantially better behavior on actual benign inputs.
The “Who are you?” example now gets classified as benign by Wolf Defender Small v2 with 98.55% confidence. A real instruction-override attempt is still detected as an injection with 99.99%.
We also updated the deployment variants. Both models are available as regular Transformers checkpoints and as ONNX exports in FP32, FP16, mixed INT8/FP16 and INT8 with INT4 embeddings.
The smallest Wolf Defender Small artifact is now 96 MB.
More details, benchmarks and model files are here:
https://huggingface.co/patronus-studio/wolf-defender-prompt-injection
https://huggingface.co/patronus-studio/wolf-defender-prompt-injection-small
If anyone is running prompt-injection classifiers on real traffic, I’d also be interested in which benign inputs still cause the most false positives for you.