Evidence-first notes on prompt-injection defense. Numbers over narratives; methodology published with every benchmark claim.
Our injection detector scored 0.498-0.509 on everything we gave it. The root cause was a training objective that never saw a label, and the fix was embarrassingly ordinary: supervised end-to-end training. The full debugging story, the recipe, the numbers, and what the new gate still cannot do.
Our fused gate beat a Meta model on our benchmark, and then we found real benign text scoring above attacks inside our own classifier. A post-mortem of the v13d failure and the full rebuild behind v15: family blueprints, deterministic paraphrases, group-aware splits, and the gaps we left open on purpose.
Head-to-head numbers from our 217-vector prompt-injection suite: fused detection at 1.27% FPR and 9.42% FNR, and a careful look at why PromptGuard-2's claimed recall did not transfer to our distribution.