Redline Guard v5A prompt-injection classifier that scores every message at the input boundary, before the model reads it. Published results against ProtectAI v2 and PIGuard across seven external sets, measured 5 September 2026 on identical rows in a single run.Against the alternativesOn BIPIA, the indirect prompt-injection benchmark, Redline Guard v5 caught 94.84% of attacks at a 1.4% false-positive rate, against PIGuard's 83.20% at 10% and ProtectAI v2's 11.84%. Scored on the quarter of BIPIA held back from training by hash. Redline Guard v5 against ProtectAI v2 and PIGuard, measured 5 September 2026

Benchmark

Metric

Redline Guard v5

ProtectAI v2

PIGuard

Result

BIPIA

Recall

94.84%

11.84%

83.20%

Redline wins

Qualifire

AUROC

97.03%

83.05%

83.84%

Redline wins

StrongREJECT

Recall

78.91%

0.00%

8.63%

Redline wins

SORRY-Bench

Recall

35.01%

29.83%

17.62%

Redline wins

Gandalf

Recall

91.93%

100.00%

93.72%

Redline loses

NeuralChemy

Recall

51.65%

88.13%

80.08%

Redline loses

Mindgard

Recall

29.21%

72.10%

49.11%

Redline loses

Where we loseThree of the seven sets go the other way, and they are on the table above rather than left off it. Mindgard is attacks optimised specifically to evade classifiers like this one, and it is our worst result on the board. NeuralChemy costs us recall because we sit at a stricter operating point. Gandalf is real human attacks from one long-running game, scored on splits our corpus never took.Methodology

Datasets. Seven external sets, each linked in the table: BIPIA for indirect injection, Qualifire with both attack and benign rows, StrongREJECT and SORRY-Bench for harmful requests, Gandalf, real human attacks from one long-running game, NeuralChemy, a prompt-injection dataset, and Mindgard for attacks built to evade classifiers. BIPIA's evaluation slice, Mindgard, Qualifire, StrongREJECT and SORRY-Bench sit in a frozen registry: never trained on, never validated against, never used to pick a checkpoint.

Split. BIPIA is scored on the quarter held back from training by hash; Gandalf on its validation and test splits only, which our corpus never took. Training data is split by group — a session id or a normalised text prefix — and the build asserts no group straddles a split. A random split had put 29.4% of test rows in the same group as a training row and inflated the headline from 0.9544 to 0.9760.

Date. Measured 5 September 2026. Redline Guard v5, ProtectAI v2 and PIGuard were scored on identical rows in a single run.

Metrics. Recall is the share of attack rows a model scores above 0.5 attack probability. The false-positive rate is the share of benign rows in the same set scored above 0.5 — so it exists only for sets with benign rows, such as BIPIA's clean documents and Qualifire. AUROC is threshold-free and reported where a set has both classes.

Where it runsThe classifier runs at the input boundary of your own agent, scoring each user turn as it arrives. Nothing is withheld: the message still reaches the agent, with the score attached. See how accurate prompt-injection classifiers are and how to stop prompt injection in a production agent.