cs.CRMar 12, 2026

The Mirror Design Pattern: Strict Data Geometry over Model Scale for Prompt Injection Detection

Authors: J Alex Corll

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Prompt injection defenses are often framed as semantic understanding problems and delegated to increasingly large neural detectors. For the first screening layer, however, the requirements are different: the detector runs on every request and therefore must be fast, deterministic, non-promptable, and auditable. We introduce Mirror, a data-curation design pattern that organizes prompt injection corpora into matched positive and negative cells so that a classifier learns control-plane attack mechanics rather than incidental corpus shortcuts. Using 5,000 strictly curated open-source samples -- the largest corpus supportable under our public-data validity contract -- we define a 32-cell mirror topology, fill 31 of those cells with public data, train a sparse character n-gram linear SVM, compile its weights into a static Rust artifact, and obtain 95.97% recall and 92.07% F1 on a 524-case holdout at sub-millisecond latency with no external model runtime dependencies. On the same holdout, our next line of defense, a 22-million-parameter Prompt Guard~2 model reaches 44.35% recall and 59.14% F1 at 49,ms median and 324,ms p95 latency. Linear models still leave residual semantic ambiguities such as use-versus-mention for later pipeline layers, but within that scope our results show that for L1 prompt injection screening, strict data geometry can matter more than model scale.

Figures & tables

CheckpointWhat changedRole in argument
v2 19k train / 2.4k holdoutInitial Mirror baselineGeometry baseline (0.835 F1); paired with v3 to isolate the effect of data quality
v3 19k locked / 1.9k holdoutSource locking and provenance cleanup; model family held fixedGeometry proof point: 0.918 →\to 0.926 F1 from data discipline alone
v5 5k curated / 524 holdoutStrict multilingual validity contract; 31/32 cell closureHeadline result: 0.921 F1 / 0.960 recall; direct PG2 comparison
Table 1: Checkpoint summary. Each row is a named dataset–model configuration discussed in the paper.
Figure 1: The Parapet layered pipeline. L1 (this paper) applies a compiled sparse linear screen on every request. Later layers handle the residual.
Figure 2: From Mirror cell contract to compiled L1 artifact. Each cell defines matched positive and negative examples; the SVM boundary is compiled into a static Rust binary.
Mirror : Non-mirrorHoldout F1 (mean ±\pm std)
100:00.837±0.0050.837\pm 0.005
70:300.825±0.0040.825\pm 0.004
50:500.819±0.0080.819\pm 0.008
30:700.819±0.0030.819\pm 0.003
0:1000.788±0.0020.788\pm 0.002
Table 2: Mixed-ratio ablation ( v2 corpus, three seeds). Performance degrades monotonically as Mirror fraction decreases.
Figure 3: Holdout F1 as a function of Mirror-to-non-mirror training ratio ( v2 corpus, three seeds). Pure Mirror (100:0) is consistently best; performance degrades monotonically.
Figure 4: Final v5 coverage matrix: 8 reasons ×\times 4 languages = 32 cells. Green = closed with valid data; red = RU constraint_bypass , the single accepted miss.
Protocol itemSetting
Holdout artifact524 cases total: 248 malicious, 276 benign
Split disciplineHoldout carved and frozen before training; training and evaluation are enforced content-hash disjoint
Evaluation preprocessingL0 sanitization enabled at evaluation time for all compared detectors
Holdout compositionThe 524-case holdout spans the same four-language, eight-reason task space as the training corpus, though not with uniform occupancy
Confidence intervals95% bootstrap intervals with 10,000 resamples over the 524-case holdout
Threshold selectionL1 main results at fixed t=0.0t{=}0.0 (natural SVM margin cutoff); PG2 evaluated at default thresholds ( pg_threshold=0.5 , block_threshold=0.5 )
Table 3: Evaluation protocol for the v5 5k comparison.
DetectorPrec.RecallF1FPFNLatency
L3 regex (75 patterns)0.9920.1410.247——<< 1 ms
Mirror L1 SVM (5k, t=0.0t{=}0.0 )0.8850.9600.9213110<< 1 ms
Prompt Guard 2 (22M)0.8870.4440.5911413849 ms
Table 4: Head-to-head comparison on the 524-case v5 holdout.
Figure 5: Latency distributions for L1 (compiled SVM) vs. PG2 (22M). L1 operates in sub-millisecond time; PG2 has a long tail reaching 324 ms at p95.

Explore similar work

CardsList

  1. Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection

    Apr 20, 2026Thamilvendhan MunirathinamPrompt Injection Attacks on LLMsPrompt Injection Attacks on AI Agents

    Independent Researcher · prompt-shield project

  2. Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals

    May 26, 2026Akindoyin Akinrele, Shreyank N GowdaLanguage Model Safety EvaluationPrompt Injection Attacks on LLMs

    School of Computer Science, University of Nottingham, Jubilee Campus, Wollaton Road, Nottingham, NG8 1BB, United Kingdom

  3. Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense

    May 29, 2026Shuhao Zhang, Jiarui Li, Qi Cao +2AI Agent Security BenchmarksLLM Security

    UC San Diego · University of Illinois Urbana-Champaign