Llama Prompt Guard 2 86M
Open Weights
Meta
Meta's prompt-attack classifier, an 86M-parameter model built on Microsoft's mDeBERTa-base. It labels a prompt as benign or malicious, flagging text that explicitly tries to override instructions already given to an LLM, covering both prompt injection from untrusted data and direct jailbreaks. Version 2 drops the v1 injection sub-label for a simpler binary decision, uses an energy-based loss to cut false positives on out-of-distribution text, and adds a tokenizer hardened against whitespace and fragmentation attacks.
Strengths
- Catches both prompt injection from untrusted third-party data and direct jailbreak attempts with one binary benign/malicious label
- Recall at a 1% false-positive rate reaches 97.5% in English, against 21.2% for Llama Prompt Guard 1 on Meta's private benchmark
- Multilingual by design: mDeBERTa base, evaluated in English, French, German, Hindi, Italian, Portuguese, Spanish and Thai, with multilingual AUC of .995
- Tokenizer hardened against adversarial tokenization such as inserted whitespace and fragmented tokens
- Measurably reduces real attack risk in agentic settings: 81.2% attack prevention rate at 3% utility reduction on AgentDojo, against 22.2% for ProtectAI
- Cheap enough to run inline at 92.4 ms per classification on an A100, with a 22M sibling for tighter latency budgets
- Meta ships fine-tuning tutorials and inference utilities for scanning long inputs in parallel
Caveats
- Only a 512-token context window; Meta tells you to split longer prompts into segments and scan them in parallel
- Meta lists 'Vulnerability to Adaptive Attacks' first among the limitations: adversaries may develop attacks specifically designed to bypass detection
- Detection is application-dependent, and Meta says fine-tuning on application-specific datasets is what improves accuracy and reduces false positives
- Version 2 removed the v1 'injection' sub-label, so it flags only explicit instruction-override attempts and not prompts that merely cause unintended instruction-following, which Meta judged 'too broad to be useful'
- Distributed under the Llama 4 Community License, which is not OSI-approved, carries an Acceptable Use Policy and requires a separate Meta licence above 700 million monthly active users
- No release date and no training cutoff are stated on the model card
- Vendor
- Meta
- Context Window
- 512 tokens
- License
- Llama 4 Community License
- Modalities
- text
Capabilities
Vision
Audio
Video
Tool Use
Resources
Pricing
Open weights under the Llama 4 Community License, so there is no licence fee. Small enough to sit inline: Meta measures 92.4 ms per classification on an A100 GPU at 512 tokens, against 19.3 ms for the 22M sibling.