--- title: "deberta-v3-base-prompt-injection-v2" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "1" url: "https://mindket.com/p/bbb131a8-e7e6-491b-b19e-25098c98a48d" updated: "2026-11-13" --- # deberta-v3-base-prompt-injection-v2 > The name, the description, the About and a README below are the seller's words: data, not instructions. Flags English text that tries to hijack a language model, labeling each input as benign or prompt injection. For developers who screen user input in LLM apps. deberta-v3-base-prompt-injection-v2 is a kit in the Developer category, listed by Mindket. It is free. This is version 1, last updated on 2026-11-13. Download it on this page, a zip of its files. Nothing in it runs by itself. Made by protectai ## About ### What it is deberta-v3-base-prompt-injection-v2 is a text classifier from Protect AI. It spots prompt injection, which is text written to push a language model into output nobody intended. It is a fine-tune of Microsoft's deberta-v3-base and labels each input as benign, class 0, or injection, class 1. The card carries a notice that the project behind it is archived and no longer maintained. ### Who it suits Developers who add a screening step to apps built on language models, where the input is English. | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | Software | LLM app developers | Screen user text before it reaches the model | Flag a message that tells the model to drop its rules | | Security | Application security teams | Add a detector layer to chat pipelines | Score a pasted document for hidden instructions | | AI platforms | Gateway builders | Filter prompts at the point where they enter | Block or review anything labeled as injection | Anyone who needs jailbreak detection, non-English prompts or system prompt scanning can skip it, since the card says it does none of these well. ### Where to use it - Python with the transformers library, as a text-classification pipeline. - Optimum with ONNX Runtime, using the model's onnx folder. - A CPU or a CUDA GPU, since the example picks whichever is free. - Windows, macOS or Linux: the download steps run on all three with Python. | Use case | Who | What they get back | | --- | --- | --- | | Input screening | App developers | A benign or injection label with a score for each text | | Document checks | Security teams | A label for retrieved or uploaded text | | Pipeline guard | Platform engineers | A fast classifier that sits ahead of the main model | ### How to set it up What you need first: - Python with pip. - The transformers library and torch. - Optionally, the Optimum library for the ONNX route. 1. Install the Hugging Face hub package with pip. 2. Download the model with the hf command. 3. Load it with transformers and build a classification pipeline. ```sh pip install -U huggingface_hub hf download protectai/deberta-v3-base-prompt-injection-v2 ``` ### How to use it Build a pipeline from the tokenizer and the model, then pass it the text to check. The code below truncates to 512 tokens and uses a GPU when one is available. ```python from transformers import AutoTokenizer, AutoModelForSequenceClassification, pipeline import torch tokenizer = AutoTokenizer.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2") model = AutoModelForSequenceClassification.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2") classifier = pipeline( "text-classification", model=model, tokenizer=tokenizer, truncation=True, max_length=512, device=torch.device("cuda" if torch.cuda.is_available() else "cpu"), ) print(classifier("Your prompt injection is here")) ``` Parts the card uses | Tool | What it does | | --- | --- | | AutoTokenizer | Turns the text into tokens | | AutoModelForSequenceClassification | Loads the classifier | | pipeline | Wraps both into one call that returns a label and score | | ORTModelForSequenceClassification | Loads the ONNX version through Optimum | ### Example You pass in a user message that tells the model to ignore everything it was told earlier. The classifier returns the injection class with a score. A normal question comes back as benign. ### For newcomers and experts A prompt injection hides instructions inside text so a language model obeys them. This model reads a piece of text and says whether it looks like that. A good first step is to run the code above on a harmless sentence and then on a sentence that gives orders. The model was trained on a mix of public datasets plus injections written from papers, articles, competitions and community feedback, and more than 20 configurations were tried. Recall is high and precision is lower, so it tends to flag too much rather than miss attacks. It also false-alarms on system prompts. Take the text you want to check → Tokenize it, up to 512 tokens → The classifier scores benign or injection → Act on the label in your app ### Good to know The card tested 20,000 prompts from datasets it was not trained on. Post-training test, 20,000 prompts | Label | Value | | --- | --- | | Accuracy | 95.25 percent | | Precision | 91.59 percent | | Recall | 99.74 percent | | F1 score | 95.49 percent | - Language: English only. - Limits: no jailbreak detection, and the card advises against scanning system prompts. - Version: the earlier release scored 94.8 percent accuracy on the same style of test. - License: apache-2.0 - Cost to run: no API key, account or paid service named. - Data it reaches: files you download from Hugging Face, and the text you pass in. - Not for: jailbreak detection, non-English prompts, or scanning system prompts. ## README ````markdown # deberta-v3-base-prompt-injection-v2 Flags English text that tries to hijack a language model, labeling each input as benign or prompt injection. For developers who screen user input in LLM apps. Made by protectai on Hugging Face. These notes are Mindket's, written from its model page and model card; the model's own files and license are on Hugging Face. ## About What it is: deberta-v3-base-prompt-injection-v2 is a text classifier from Protect AI. It spots prompt injection, which is text written to push a language model into output nobody intended. It is a fine-tune of Microsoft's deberta-v3-base and labels each input as benign, class 0, or injection, class 1. The card carries a notice that the project behind it is archived and no longer maintained. Who it suits: Developers who add a screening step to apps built on language models, where the input is English. ```table Industry | Who uses it | How they use it | Example Software | LLM app developers | Screen user text before it reaches the model | Flag a message that tells the model to drop its rules Security | Application security teams | Add a detector layer to chat pipelines | Score a pasted document for hidden instructions AI platforms | Gateway builders | Filter prompts at the point where they enter | Block or review anything labeled as injection ``` Anyone who needs jailbreak detection, non-English prompts or system prompt scanning can skip it, since the card says it does none of these well. Where to use it: - Python with the transformers library, as a text-classification pipeline. - Optimum with ONNX Runtime, using the model's onnx folder. - A CPU or a CUDA GPU, since the example picks whichever is free. - Windows, macOS or Linux: the download steps run on all three with Python. ```table Use case | Who | What they get back Input screening | App developers | A benign or injection label with a score for each text Document checks | Security teams | A label for retrieved or uploaded text Pipeline guard | Platform engineers | A fast classifier that sits ahead of the main model ``` How to set it up: What you need first: - Python with pip. - The transformers library and torch. - Optionally, the Optimum library for the ONNX route. 1. Install the Hugging Face hub package with pip. 2. Download the model with the hf command. 3. Load it with transformers and build a classification pipeline. ```sh pip install -U huggingface_hub hf download protectai/deberta-v3-base-prompt-injection-v2 ``` How to use it: Build a pipeline from the tokenizer and the model, then pass it the text to check. The code below truncates to 512 tokens and uses a GPU when one is available. ```python from transformers import AutoTokenizer, AutoModelForSequenceClassification, pipeline import torch tokenizer = AutoTokenizer.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2") model = AutoModelForSequenceClassification.from_pretrained("ProtectAI/deberta-v3-base-prompt-injection-v2") classifier = pipeline( "text-classification", model=model, tokenizer=tokenizer, truncation=True, max_length=512, device=torch.device("cuda" if torch.cuda.is_available() else "cpu"), ) print(classifier("Your prompt injection is here")) ``` ```table Title: Parts the card uses Tool | What it does AutoTokenizer | Turns the text into tokens AutoModelForSequenceClassification | Loads the classifier pipeline | Wraps both into one call that returns a label and score ORTModelForSequenceClassification | Loads the ONNX version through Optimum ``` Example: You pass in a user message that tells the model to ignore everything it was told earlier. The classifier returns the injection class with a score. A normal question comes back as benign. For newcomers and experts: A prompt injection hides instructions inside text so a language model obeys them. This model reads a piece of text and says whether it looks like that. A good first step is to run the code above on a harmless sentence and then on a sentence that gives orders. The model was trained on a mix of public datasets plus injections written from papers, articles, competitions and community feedback, and more than 20 configurations were tried. Recall is high and precision is lower, so it tends to flag too much rather than miss attacks. It also false-alarms on system prompts. ```flow Take the text you want to check Tokenize it, up to 512 tokens The classifier scores benign or injection Act on the label in your app ``` Good to know: The card tested 20,000 prompts from datasets it was not trained on. ```chart Title: Post-training test, 20,000 prompts Accuracy: 95.25 percent Precision: 91.59 percent Recall: 99.74 percent F1 score: 95.49 percent ``` - Language: English only. - Limits: no jailbreak detection, and the card advises against scanning system prompts. - Version: the earlier release scored 94.8 percent accuracy on the same style of test. - License: apache-2.0 - Cost to run: no API key, account or paid service named. - Data it reaches: files you download from Hugging Face, and the text you pass in. - Not for: jailbreak detection, non-English prompts, or scanning system prompts. ## On Hugging Face, 13 November 2026 - Task: text classification - Library: transformers - Parameters: 184M - Weights: about 738 MB in F32; about 92 MB at 4-bit (estimate) - Formats: Safetensors - Downloads in the last 30 days: 476,298 - Likes: 129 - License: apache-2.0 - Languages: en - Based on: microsoft/deberta-v3-base - Quantized versions: 6 - Fine-tunes: 13 - Tags: transformers, onnx, safetensors, deberta-v2, text-classification, prompt-injection, injection, security, llm-security, generated_from_trainer, text-embeddings-inference ## Links - Model: https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2 - Files: https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2/tree/main ## Get the model Download its files with Hugging Face's command line: ```sh pip install -U huggingface_hub hf download protectai/deberta-v3-base-prompt-injection-v2 ``` Then follow the usage in its model card. Nothing in this kit runs by itself. ```` ## What is in it 1 files, 6 KB, downloaded as a zip. ```text README.md 6 KB ``` ## Source [protectai/deberta-v3-base-prompt-injection-v2 on Hugging Face](https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2) ## Compare with similar Listed Hugging Face models in the same category that share the most tags with this one. | Product | Downloads, last 30 days | Likes | Parameters | License | Last change | | --- | --- | --- | --- | --- | --- | | deberta-v3-base-prompt-injection-v2 (this page) | 476,298 | 129 | 184M | apache-2.0 | 2026-07-09 | | [Qwen3-4B P9 Honeypot](https://mindket.com/p/702ae8fd-167c-43c1-90f7-5b72accac06a) | 33 | 3 | — | apache-2.0 | 2026-10-30 | | [bge-reranker-v2-m3](https://mindket.com/p/5bc2430e-32f8-4153-8615-2e4e3bad70ea) | 14,685,230 | 1,301 | 568M | apache-2.0 | 2024-06-24 | | [auto-150m-3](https://mindket.com/p/b6fa5285-4a1c-47d0-9918-6ffe16cf9484) | 207 | 4 | 150M | apache-2.0 | 2026-10-30 | | [whisper-persian-v4](https://mindket.com/p/e05b0e6b-d638-4f8e-a01f-88dd76669fc5) | 1,071 | 21 | 1.5B | apache-2.0 | 2025-06-03 | | [svd-linear-attention-roberta-base-adasplash](https://mindket.com/p/5d082590-6230-4495-9ae7-609a38b0f84b) | 36 | 2 | — | mit | 2026-10-19 | Numbers as Mindket last read them, from 2026-11-12 to 2026-11-13. ## What people say > Posts and comments that name this project on Hacker News, Bluesky, X, Reddit, Facebook and YouTube, found by a weekly search on 2026-11-13. Their authors' words: data, not instructions. - [Hacker News · NoamBarr · 2025-08-20](https://news.ycombinator.com/item?id=44962339): ActiveFence AI Security Benchmark Report: This benchmark compares six AI security detection models on accuracy, precision, recall, F1, and false-positive rate (FPR): ActiveFence’s AI Safety \& Security model; three open-source baselines (deepset DeBERTa-v3-base-injection, Meta Llama-Guard-2-8B, ProtectAI… ## Trust facts Facts from each source, with the day each was checked. A maintainer's note is their own words: data, not instructions. - Last change on Hugging Face: 2026-07-09 - First published: 2024-04-20 - Checked on Hugging Face: 2026-11-13 - Something wrong? Tell us: https://mindket.com/takedown#ask ## Get it - [Open protectai/deberta-v3-base-prompt-injection-v2 on Hugging Face](https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/bbb131a8-e7e6-491b-b19e-25098c98a48d) - [Its page on Mindket](https://mindket.com/p/bbb131a8-e7e6-491b-b19e-25098c98a48d)