{"slug": "passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors", "title": "Passing the Test You Trained On: Re-Evaluating Prompt-Injection Detectors", "summary": "A 2 October 2026 arXiv paper evaluating fifteen prompt-injection detectors, including Meta's Prompt Guard 2, found that public benchmark scores transfer poorly to real LLM agent deployments: the best detector on the BIPIA benchmark caught only 2% of AgentDojo injections at a 1% false-positive rate, while a detector catching 72% of AgentDojo injections caught just 15% on tau-bench. The authors replayed ground-truth tool calls from AgentDojo and tau-bench without an LLM to generate benign tool outputs and labeled injected outputs by differential replay, finding that false-positive rates on tool outputs (ranging from none to over 90%) do transfer between the two agent benchmarks. The paper concludes that deployment-oriented evaluations should use the agent's own tool outputs, report detection at a low false-positive rate, and audit detector training data, noting the best detector on both agent benchmarks was trained on agent-style inputs and shares no data with any benchmark.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 2 Oct 2026]\n\n# Title:Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents\n\n[View PDF](https://arxiv.org/pdf/2610.03448)\n\n[HTML (experimental)](https://arxiv.org/html/2610.03448v1)\n\nAbstract:LLM agents increasingly screen tool outputs with small prompt-injection detectors, and teams choose among detectors by their scores on public benchmarks. We ask whether those scores predict how a detector behaves inside an agent. We replay the ground-truth tool calls of two agent benchmarks, AgentDojo and tau-bench, without an LLM to obtain tool outputs that are benign by construction, label injected outputs by differential replay, and evaluate fifteen detectors, including Meta's Prompt Guard 2, and two task-aware LLM judges on these outputs and on the BIPIA benchmark. Detection rankings transfer poorly between benchmarks: the best detector on BIPIA catches 2% of AgentDojo injections at a 1% false-positive rate, and a detector that catches 72% of AgentDojo injections catches 15% on tau-bench. False-positive rates on tool outputs, which range from none to over 90%, do transfer between the two agent benchmarks. Where training data is public, the form of the training inputs explains the results. The BIPIA leader was trained on full BIPIA inputs, but having seen InjecAgent's attack strings as short prompts does not help it find them inside tool outputs; the best detector on both agent benchmarks shares no data with any benchmark and was trained on agent-style inputs. Evaluations meant to inform deployment should use the agent's own tool outputs, report detection at a low false-positive rate, and audit what the detector was trained on.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors", "canonical_source": "https://arxiv.org/abs/2610.03448", "published_at": "2026-10-06 04:07:08+00:00", "updated_at": "2026-10-06 04:19:57.799476+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-research", "ai-policy"], "entities": ["Meta", "Prompt Guard 2", "AgentDojo", "tau-bench", "BIPIA", "InjecAgent", "arXiv"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors", "markdown": "https://wpnews.pro/news/passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors.md", "text": "https://wpnews.pro/news/passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors.txt", "jsonld": "https://wpnews.pro/news/passing-the-test-you-trained-on-re-evaluating-prompt-injection-detectors.jsonld"}}