deberta-v3-base-prompt-injection-v2

deberta-v3-base-prompt-injection-v2

Flags English text that tries to hijack a language model, labeling each input as benign or prompt injection. For developers who screen user input in LLM apps.

Made by protectai on Hugging Face. These notes are Mindket's, written from its model page and model card; the model's own files and license are on Hugging Face.

About

What it is: deberta-v3-base-prompt-injection-v2 is a text classifier from Protect AI. It spots prompt injection, which is text written to push a language model into output nobody intended. It is a fine-tune of Microsoft's deberta-v3-base and labels each input as benign, class 0, or injection, class 1. The card carries a notice that the project behind it is archived and no longer maintained.

Who it suits: Developers who add a screening step to apps built on language models, where the input is English.

Industry | Who uses it | How they use it | Example
Software | LLM app developers | Screen user text before it reaches the model | Flag a message that tells the model to drop its rules
Security | Application security teams | Add a detector layer to chat pipelines | Score a pasted document for hidden instructions
AI platforms | Gateway builders | Filter prompts at the point where they enter | Block or review anything labeled as injection

Anyone who needs jailbreak detection, non-English prompts or system prompt scanning can skip it, since the card says it does none of these well.

Where to use it:

• Python with the transformers library, as a text-classification pipeline.
• Optimum with ONNX Runtime, using the model's onnx folder.
• A CPU or a CUDA GPU, since the example picks whichever is free.
• Windows, macOS or Linux: the download steps run on all three with Python.

Use case | Who | What they get back
Input screening | App developers | A benign or injection label with a score for each text
Document checks | Security teams | A label for retrieved or uploaded text
Pipeline guard | Platform engineers | A fast classifier that sits ahead of the main model

How to set it up: What you need first:

• Python with pip.
• The transformers library and torch.
• Optionally, the Optimum library for the ONNX route.

1. Install the Hugging Face hub package with pip.
2. Download the model with the hf command.
3. Load it with transformers and build a classification pipeline.

pip install -U huggingface_hub
hf download protectai/deberta-v3-base-prompt-injection-v2

How to use it: Build a pipeline from the tokenizer and the model, then pass it the text to check. The code below truncates to 512 tokens and uses a GPU when one is available.

from transformers import AutoTokenizer, AutoModelForSequenceClassification, pipeline
import torch

tokenizer = AutoTokenizer.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2")
model = AutoModelForSequenceClassification.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2")

classifier = pipeline(
  "text-classification",
  model=model,
  tokenizer=tokenizer,
  truncation=True,
  max_length=512,
  device=torch.device("cuda" if torch.cuda.is_available() else "cpu"),
)

print(classifier("Your prompt injection is here"))

Title: Parts the card uses
Tool | What it does
AutoTokenizer | Turns the text into tokens
AutoModelForSequenceClassification | Loads the classifier
pipeline | Wraps both into one call that returns a label and score
ORTModelForSequenceClassification | Loads the ONNX version through Optimum

Example: You pass in a user message that tells the model to ignore everything it was told earlier. The classifier returns the injection class with a score. A normal question comes back as benign.

For newcomers and experts: A prompt injection hides instructions inside text so a language model obeys them. This model reads a piece of text and says whether it looks like that. A good first step is to run the code above on a harmless sentence and then on a sentence that gives orders.

The model was trained on a mix of public datasets plus injections written from papers, articles, competitions and community feedback, and more than 20 configurations were tried. Recall is high and precision is lower, so it tends to flag too much rather than miss attacks. It also false-alarms on system prompts.

Take the text you want to check
Tokenize it, up to 512 tokens
The classifier scores benign or injection
Act on the label in your app

Good to know: The card tested 20,000 prompts from datasets it was not trained on.

Title: Post-training test, 20,000 prompts
Accuracy: 95.25 percent
Precision: 91.59 percent
Recall: 99.74 percent
F1 score: 95.49 percent

• Language: English only.
• Limits: no jailbreak detection, and the card advises against scanning system prompts.
• Version: the earlier release scored 94.8 percent accuracy on the same style of test.
• License: apache-2.0
• Cost to run: no API key, account or paid service named.
• Data it reaches: files you download from Hugging Face, and the text you pass in.
• Not for: jailbreak detection, non-English prompts, or scanning system prompts.

On Hugging Face, 13 November 2026

• Task: text classification
• Library: transformers
• Parameters: 184M
• Weights: about 738 MB in F32; about 92 MB at 4-bit (estimate)
• Formats: Safetensors
• Downloads in the last 30 days: 476,298
• Likes: 129
• License: apache-2.0
• Languages: en
• Based on: microsoft/deberta-v3-base
• Quantized versions: 6
• Fine-tunes: 13
• Tags: transformers, onnx, safetensors, deberta-v2, text-classification, prompt-injection, injection, security, llm-security, generated_from_trainer, text-embeddings-inference

Links

• Model: https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2
• Files: https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2/tree/main

Get the model

Download its files with Hugging Face's command line:

pip install -U huggingface_hub
hf download protectai/deberta-v3-base-prompt-injection-v2

Then follow the usage in its model card. Nothing in this kit runs by itself.