Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection

Abstract

Current open-source prompt-injection detectors converge on two architectural choices: regular-expression pattern matching and fine-tuned transformer classifiers. Both share failure modes recent work has made concrete. Regular expressions miss paraphrased attacks. Fine-tuned classifiers are vulnerable to adaptive adversaries: a 2025 NAACL Findings study reported that eight published indirect-injection defenses were bypassed with greater than fifty percent attack-success rates under adaptive attacks. This work proposes seven detection techniques that each port a mechanism from a discipline outside LLM security: forensic linguistics, materials-science fatigue analysis, deception technology, local-sequence alignment from bioinformatics, mechanism design, spectral signal analysis, and taint tracking. Each produces a signal architecturally independent of both regex matching and transformer classification, so the seven compose with existing defenses rather than replacing them. Four of seven are now implemented in prompt-shield v0.7.3 (Apache 2.0): d028 sequence alignment, d027 stylometric discontinuity, materials-fatigue tracking, and d034 honeypot tool definitions (new in v4.0). A four-configuration ablation across nine benchmarks (~10,300 samples) covers deepset, NotInject, LLMail-Inject, AgentHarm, AgentDojo, and an independent evaluation against three peer-reviewed academic benchmarks (Liu USENIX 2024, Garak, InjecAgent). This revision adds Section 5.7 (composed-stack adaptive-attack partial run, evidence for the composability thesis), Section 5.8 (50-document held-out benchmark: d027 collapses 1.000 to 0.000 F1 in isolation but the composed engine recovers 0.815 F1), and Section 7 (three architectural patterns extracted from prompt-shield in Gang-of-Four format). All code, data, and reproduction scripts are released Apache 2.0.

v4 (31 pp, up from 27): adds Sec. 2.4 concurrent-work map (13 papers), Sec. 4.3 marked implemented (d034 ships in v0.7.3), Sec. 5.7 composed-stack adaptive-attack partial run, Sec. 5.8 50-doc held-out benchmark (d027 1.000->0.000 F1 in isolation, composed engine 0.815 F1), Sec. 7 architectural patterns. Repro tag: v0.7.3. Zenodo DOI 10.5281/zenodo.19644135