LLM prompt scanning is a runtime control that inspects every prompt, and ideally every retrieved document and tool result, before the model reads it, then blocks, redacts or flags whatever fails policy. Use it as one layer against OWASP LLM01 prompt injection, not as the fix: published classifiers report high recall on known attacks, and researchers have evaded them anyway.
OWASP’s LLM01:2025 Prompt Injection entry splits the threat into direct injection, typed by the user, and indirect injection, carried in files, web pages and other content the model ingests. MITRE ATLAS tracks it as AML.T0051 LLM Prompt Injection, with Direct, Indirect and Triggered sub-techniques, and tracks jailbreaks separately as AML.T0054, per the ATLAS data repository. Prompt scanners also touch two neighbors on the 2025 OWASP list: LLM02 Sensitive Information Disclosure, when users paste secrets or personal data, and LLM07 System Prompt Leakage, when a prompt tries to extract developer instructions. The layer is input, at runtime, unlike the build-time probe suites described in how LLM vulnerability scanners work, which attack an application before release.
What does LLM prompt scanning actually check?
Most prompt-scanning stacks combine four kinds of check, from cheap deterministic rules to model-based classifiers. Only the classifier tier tries to judge intent; the others match strings, entities or structure. The cost column is an editorial estimate, not a vendor figure.
| Check | What it flags | OWASP mapping | Cost profile |
|---|---|---|---|
| Pattern and secret rules | Deny-listed strings, regexes, API keys, cloud credentials | LLM02, custom policy | Negligible, no model call |
| PII detection and redaction | Card numbers, national IDs, account numbers, custom entities | LLM02 | Low to moderate, entity recognizers |
| Injection and jailbreak classifier | Instruction overrides, persona swaps, conversation mockups, encoded payloads | LLM01, LLM07 | One model inference per segment |
| Structural checks | Token length, invisible Unicode, encodings, high-perplexity strings | LLM01, LLM10 | Cheap, but needs normalization logic |
The managed services bundle several tiers behind one API. Google’s Model Armor pairs an injection and jailbreak filter with Sensitive Data Protection and malicious-URL detection. Microsoft’s Prompt Shields sorts user-prompt attacks into four subtypes: changing system rules, embedded conversation mockups, role-play and encoding attacks. The Bedrock Guardrails prompt attack filter covers jailbreaks and prompt injection, with prompt leakage detection on the Standard tier only.
The structural tier has research behind it. Jain et al. evaluated perplexity-based detection, paraphrasing and retokenization as baseline defenses against adversarial attacks on aligned models. A perplexity filter is a cheap way to catch machine-optimized attack strings that look statistically unlike natural text.
Where does the prompt scanner sit in the request path?
The scanner sits after authentication and before prompt assembly, and a second scan point belongs wherever untrusted text re-enters the context: retrieval results and tool responses. Scanning only the user’s chat turn catches direct injection and misses the indirect path that ATLAS tracks as AML.T0051.001.
Described as a path, a defensible layout reads:
user → gateway and auth → prompt scanner → orchestrator → retriever and tools → document and tool-result scanner → prompt assembly → model → output validator → user
Before the control, the orchestrator concatenates user text, retrieved chunks and tool output into one context window, and the model has no reliable way to tell data from instructions. After it, each untrusted segment has been classified, redacted or dropped before concatenation, and every verdict is logged against a request ID.
The second scan point is not automatic. Microsoft documents Prompt Shields for documents as scanning at both the user input and tool response intervention points in Foundry. Bedrock is the counterexample: AWS states that “the prompt attack filter does not evaluate tool results,” and tool definitions are not assessed either. Bedrock also skips prompt attack filtering on InvokeModel calls unless user content is wrapped in input tags. Model Armor inspects each prompt as a single turn with no conversation history, so a multi-turn attack that builds context gradually stays invisible unless the application sends that history. Detector designs for the multi-turn problem are covered in LLM jailbreak detection techniques by layer.
How accurate are prompt-injection classifiers?
Vendor-reported accuracy is high on vendor-chosen test sets and much lower under adaptive attack. Meta reports 97.5% recall at a 1% false-positive rate for Llama Prompt Guard 2 86M on English direct jailbreaks, while Hackett et al. tested evasion attacks against six guardrail systems, including Prompt Guard and Azure Prompt Shield, and reached up to 100% evasion success in some instances.
The Prompt Guard 2 model card also reports an AUC of .998 in English and .995 multilingual for the 86M model, against 21.2% recall at 1% FPR for the original Prompt Guard. On the AgentDojo agentic benchmark, Meta reports an APR at 3% utility reduction of 81.2% for the 86M model and 78.4% for the 22M model, against 22.2% for a ProtectAI classifier. These are Meta’s numbers on benchmarks Meta selected: an upper bound on known attack distributions, not a forecast for your traffic.
Hackett et al. supply the adversarial counterweight. Their 2025 study ran traditional character injection and algorithmic adversarial machine-learning evasion against six prominent protection systems, and found both could avoid detection while preserving the attack’s effect. Word-importance rankings computed on offline white-box models also raised attack success against black-box targets, so an attacker can tune evasions on a model they control and carry them to a hosted service. Meta’s card carries the same caveat: adaptive attacks may be designed to evade detection. A prompt classifier raises the cost of copy-paste jailbreaks and known templates; it does not stop an attacker who iterates against it. Which open-source detectors are still maintained is covered in Rebuff vs Vigil vs LLM Guard.
Trade-offs: latency, false positives and coverage
Latency. Every model-backed check is an inference on the critical path. Meta’s card gives 92.4 ms per classification for the 86M model and 19.3 ms for the 22M model on an A100 at 512 tokens. Those are single-call figures, not p95 under load. The context window is 512 tokens and Meta recommends scanning longer inputs as parallel segments, so a RAG request carrying 5,000 tokens of retrieved context means at least ten classifications. Load-test the composed pipeline for p95 at production concurrency.
False positives. Thresholds trade recall for benign blocks, and the vendors say so. Google warns that Model Armor’s lowest threshold, “Low and above”, can generate a high volume of false positives, and recommends starting at High or Medium and above. Microsoft suggests switching Prompt Shields from block to annotate mode to log without filtering, and Bedrock offers a Detect (no action) setting. Start in detect-only mode and label what gets flagged; pricing a benign block is covered in False Positive Cost in Refusal Systems.
Language and encoding coverage. Model Armor’s injection filter is tested in nine languages; Prompt Guard 2 86M was evaluated in eight, and the 22M model has no multilingual pretraining. Outside those lists, expect variable quality. Encoding is a sharper gap: Google’s docs state that Model Armor does not decode or inspect encoded content such as Base64, hex or URL encoding, while Prompt Shields lists encoding attacks as a detection class. If your scanner does not decode, normalize and decode in the application before classifying, and treat blobs that will not decode as suspicious.
Integration effort. A managed scanner is an API call plus a policy object, with prompts leaving your boundary. An open-weight classifier means hosting, version pinning and retraining, under its own license terms: Prompt Guard 2 ships under the Llama 4 Community License, which legal review should read before deployment. Either way, set fail-open or fail-closed behavior for scanner timeouts explicitly. That choice is a security policy, not a default.
What risk does prompt scanning leave behind?
Prompt scanning leaves three gaps: adaptive attacks tuned to slip past the classifier, injections phrased as ordinary business text that no detector flags, and any untrusted channel the scanner never sees. OWASP’s LLM01 entry states that, given how generative models work, it is unclear whether fool-proof prevention of prompt injection exists at all.
OWASP therefore lists input and output filtering as one of seven mitigations, alongside system-prompt constraints, deterministic output-format checks, least privilege for tools, human approval for high-risk actions, segregating untrusted content and adversarial testing. Azure’s Spotlighting preview applies the segregation idea: it base64-encodes third-party documents so the model treats them as lower-trust, at the cost of extra tokens. Responses need their own control, covered in classifier-on-output patterns, because a clean prompt can still produce a leaking or unsafe answer.
Test the scanner as part of the system, too. Put the configured scanner in front of the target when running garak, PyRIT or promptfoo, so the probe suite measures the defended application rather than the bare model; the CI wiring is in garak vs PyRIT vs Promptfoo in CI.
FAQ
is prompt scanning enough to stop prompt injection
No. Prompt scanning lowers the success rate of known injection and jailbreak templates, but published research has evaded leading classifiers, and OWASP says it is unclear whether fool-proof prevention exists. Pair it with least-privilege tool access, human approval for high-impact actions, deterministic output validation, and scanning of retrieved documents and tool results.
what is the difference between prompt scanning and llm vulnerability scanning
Prompt scanning is a runtime control that screens live inputs on every request, while LLM vulnerability scanning is a pre-release test that fires attack probes at a model or application to find weaknesses. Tools such as garak and promptfoo do the second job. Most teams need both, because the probe suite shows how well the runtime scanner holds.
how much latency does llm prompt scanning add
It depends on which checks run. Pattern and secret rules add almost nothing, while each classifier call adds a model inference: Meta reports 19.3 ms to 92.4 ms per 512-token classification for Prompt Guard 2 on an A100. Long prompts and RAG chunks need several calls, so measure p95 on the full pipeline.
can prompt scanning redact pii before it reaches the model
Yes, if the scanner includes a sensitive-data detector. Google’s Model Armor detects card numbers, US Social Security numbers and Google Cloud credentials in basic mode, and de-identifies data through advanced templates. Check what your logs keep afterwards: Model Armor does not store content unless Cloud Logging is enabled, and other services handle logging differently.
Related across the network
- Prompt Injection Scanner Tools: Benchmarks & Evasion — aisecbench.com
- AI Jailbreak Detection Tools: Six Options Worth Shortlisting — jailbreakdb.com
