Llama-Prompt-Guard-2-22M

Llama Prompt Guard 2 Model Card Model Information We are launching two classifier models as part of the Llama Prompt Guard 2 series, an updated version of v1: Llama Prompt Guard 2 86M and a new, smaller version, Llama Prompt Guard 2 22M. LLM-powered applications are vulnerable to prompt attacks—prompts designed to subvert the developer's intended behavior. Prompt attacks fall into two primary categories: Prompt Injections: manipulate untrusted third-party and user data in the context window to make a model execute unintended instructions. Jailbreaks: malicious instructions designed to override the safety and security features directly built into a model. Both Llama Prompt Guard 2 models detect both prompt injection and jailbreaking attacks, trained on a large corpus of known vulnerabilities. We’re releasing Prompt Guard as an open-source tool to help developers reduce prompt attack risks with a straightforward yet highly customizable solution. Summary of Changes from Prompt Guard 1 Improved Performance: Modeling strategy updates yield substantial performance gains, driven by expanded training datasets and a refined objective function that reduces false positives on out-of-distribution data. Llama Prompt Guard 2 22M, a 22 million parameter Model: A smaller, faster version based on DeBERTa-xsmall. Llama Prompt Guard 2 22M reduces latency and compute costs by 75%, with minimal performance trade-offs. Adversarial-attack resistant tokenization: We refined the tokenization strategy to mitigate adversarial tokenization attacks, such as whitespace manipulations and fragmented tokens. Simplified binary classification: Both Prompt Guard 2 models focus on detecting explicit, known attack patterns, labeling prompts as “benign” or “malicious”. Model Scope Classification: Llama Prompt Guard 2 models classify prompts as ‘malicious’ if the prompt explicitly attempts to override prior instructions embedded into or seen by an LLM. This classification considers only the intent to supe