{"id":"b7cd9b9a-84ec-4d9b-a473-c60330b34d97","arxiv_id":"2506.05446","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Sentinel, a ModernBERT-based binary classifier trained on public and private prompt datasets, reports 0.987 accuracy and 0.980 F1 on a held-out internal test set and outperforms one baseline on public benchmarks.","lead":"This paper describes Sentinel, a fine-tuned language model that classifies prompts as benign or malicious prompt injection attempts, reporting high accuracy on its own test set and several public benchmarks. It matters because prompt injection is a growing security problem for LLM-based applications, and a reliable, low-latency detector could be a practical defense component.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 1 is internally inconsistent: baseline F1=0.728 cannot follow from recall=0.905 and precision=0.820 (harmonic mean ≈0.860); the reported headline margin and SOTA claim rest on unverified numbers.","rationale":"I read the paper's central claim as the state-of-the-art empirical claim in the abstract and Section 5: Sentinel's accuracy/F1 on a held-out internal test set and consistent outperformance of protectai/deberta-v3-base-prompt-injection-v2 on public benchmarks. The most load-bearing requirement for that claim is that the reported evaluation numbers are trustworthy. They are not, on their face: the F1 column in Table 1 is mathematically incompatible with the precision and recall columns. That is an internal inconsistency, not a disagreement with external consensus, and it directly affects the headline margin. My concrete test would settle it by recomputing F1 from the confusion matrix. If corrected, the relative advantage may shrink substantially. I still think the reader's leakage/representativeness concern is real and deserves attention, but the immediate blocker for the current manuscript is that its central comparative table is self-inconsistent. Therefore I would reject the current version rather than conditionally accept it; the model may be salvageable after rerunning the evaluation and releasing enough data to verify generalization, but the paper as written does not support its SOTA claim. I chose partial agreement because the reader identified a different weakest assumption (test-set representativeness) than mine (metric consistency), though both concern evaluation validity.","tokens_in":5317,"tokens_out":8841,"duration_ms":101965,"concrete_test":"Obtain or recompute the confusion matrix for both models on the internal held-out test set, and verify whether protectai/deberta-v3-base-prompt-injection-v2 actually yields precision=0.820, recall=0.905, F1=0.728. If the recomputed F1 is ≈0.860, Table 1 is incorrect and the reported headline margin must be revised; if the recomputed values match the table, then the metric definitions (e.g., macro vs binary, class weighting) must be stated precisely, because with the given definitions the numbers are impossible.","verdict_should_be":"REJECT","load_bearing_attack":"The central empirical claim depends on Table 1, but Table 1 cannot be arithmetically correct. For the protectai/deberta-v3-base-prompt-injection-v2 baseline, precision=0.820 and recall=0.905 imply F1 = 2·0.820·0.905/(0.820+0.905) ≈ 0.860, not 0.728. For Sentinel, precision=0.986 and recall=0.991 imply F1 ≈ 0.988, not 0.980. Since binary F1 is fully determined by precision and recall, at least one value in each row is misreported or computed differently than stated. The claimed F1 advantage on the internal test set (0.980 vs 0.728 = +0.252) becomes roughly 0.988 vs 0.860 = +0.128 if the baseline row is corrected, halving the margin; more importantly, the inconsistency signals that the evaluation pipeline or metric reporting is not reliable. No code, confusion matrices, or prediction logs are provided, so the public benchmark F1 values (Table 2) cannot be independently checked either. Until this is resolved, the state-of-the-art claim is not supported by the paper's own data.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Sentinel (qualifire/prompt-injection-sentinel), a binary prompt-injection detector obtained by fine-tuning answerdotai/ModernBERT-large on a mix of open-source and private datasets. The authors report an average accuracy of 0.987 and an F1-score of 0.980 on a held-out internal test set, and they report Binary F1 scores on four public benchmarks, claiming consistent superiority over the protectai/deberta-v3-base-prompt-injection-v2 baseline. The paper also describes the dataset composition, training setup, latency measurements, a brief error analysis, and a code snippet for inference.","tokens_in":5568,"tokens_out":3777,"duration_ms":46940,"significance":"If the reported numbers are correct, Sentinel would be a practically useful, low-latency prompt-injection detector and a credible open-source alternative to currently available detectors. The authors should be credited for releasing a fine-tuned model, using a strong modern encoder (ModernBERT-large), and reporting latency on a concrete GPU. However, the evidence as presented is not yet sufficient to support the 'state-of-the-art' claim. The most serious problems are internal: Table 1 contains mutually inconsistent precision/recall/F1 values for both models, and the public benchmark evaluation in Table 2 includes a benchmark created by the same authors, so the headline margins are not yet independently established. The lack of confidence intervals, multiple runs, and reproducible evaluation code further limits the strength of the empirical contribution.","major_comments":[{"comment":"The reported metrics are arithmetically inconsistent. For the baseline protectai/deberta-v3-base-prompt-injection-v2, precision=0.820 and recall=0.905 imply an F1 score of 2·0.820·0.905/(0.820+0.905) ≈ 0.860, not the reported 0.728. For Sentinel, precision=0.986 and recall=0.991 imply F1 ≈ 0.988, not the reported 0.980. Since F1 is fully determined by precision and recall, at least one value in each row is misreported or was computed differently than stated. This affects the headline margin: the claimed internal F1 advantage of 0.252 would shrink to roughly 0.128 if the corrected baseline value is used. Please recompute all metrics from the confusion matrices, report the confusion matrices or prediction logs, and update the text in §5.1 accordingly.","section":"§5.1, Table 1"},{"comment":"The public-benchmark evaluation includes qualifire/Qualifire-prompt-injection-benchmark, a dataset created by the same authors. Including a self-created benchmark in the average F1 score (0.938 vs 0.709) conflates the model's ability on independently collected data with its behavior on a dataset that may share distributional properties with Sentinel's training data. The claim that Sentinel 'consistently outperforms' the baseline across all datasets is therefore not established by independent evidence. Please report results excluding the self-created benchmark, provide a detailed description of how that benchmark was constructed, and, if possible, evaluate on additional third-party benchmarks that were not used in training.","section":"§5.2, Table 2"},{"comment":"The description of the private dataset and the train/test split is too opaque to support the generalization claim. The paper states that qualifire-synthetics contains 1,400 samples synthesized using LLMs, but does not describe the generation prompts, the filtering process, or whether the synthetic data was iteratively refined based on failures on the internal test set. It is also not stated whether the 90/10 split was random, stratified, or performed before or after any development decisions, nor whether the test set was used for model selection. If the held-out test set shares distributional artifacts with the training sources, which is likely given that all open-source sources are either fully or partially used in training, then the reported 0.987 accuracy and 0.980 F1 may not transfer to genuinely novel attack distributions. Please specify the split procedure, report the class balance of the test set, and evaluate on a distributionally shifted or temporally separated test set.","section":"§3.2.2, §3.2.3"},{"comment":"The evaluation reports a single run with no confidence intervals, no standard deviations, and no multiple seeds, so the stability of the reported metrics is unknown. Moreover, the 'state-of-the-art' claim is supported by comparison against only one external baseline; several other open-source prompt-injection detectors exist and should be included for a fair SOTA comparison. Providing the evaluation code, the exact inference script, and the predictions would make the numbers checkable and would substantially increase confidence in the results.","section":"§5"}],"minor_comments":[{"comment":"The latency discussion refers to the model as 'extremely small,' but Sentinel has 0.395B parameters; this is not extremely small by encoder standards. Please report the input lengths, batch size, number of warmup iterations, and whether the latency is end-to-end or model-only.","section":"§5.3"},{"comment":"The error analysis is informal: the 'random sample' size is not given, the method of manual review is not described, and the two sentences 'we didn't observed any specific identifiers' and 'typically included...' appear contradictory. Please clarify the methodology and provide representative examples.","section":"§6.1"},{"comment":"Please provide a table with the exact number of samples taken from each open-source dataset and the final class distribution. The current description only gives partial counts (e.g., 7,000 benign samples from several sources) and does not specify the number of jailbreak samples from each source.","section":"§3.2.1"},{"comment":"Several reference URLs are truncated in the bibliography (e.g., [2], [12], [19], [20]), making them unusable as submitted. Please ensure all URLs are complete.","section":"References"},{"comment":"Please define how 'AvgAcc' and the reported F1 were computed. It is unclear whether accuracy is macro-averaged across classes, and whether F1 is computed per class or as a binary positive-class F1.","section":"§5.1"},{"comment":"The limitation section is candid but brief. Please also state clearly that the private datasets are not publicly available and that exact reproduction of the training environment is impossible without access to them, as this is already acknowledged in limitation 2 but should be reflected in the reproducibility statement.","section":"§6"}],"recommendation":"major_revision","confidential_remarks":"This manuscript is closer to a technical report or model card than a full research paper, and the empirical claims need substantial revision before publication. The arithmetic inconsistency in Table 1 is the kind of issue that reviewers will likely check first; the self-created benchmark in Table 2 will also raise independence concerns. If the authors provide corrected metrics, remove the self-created benchmark from the headline comparison, and add external benchmarks, the paper could become a useful contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The stress-test note is right, and it matters. In Table 1, for the DeBERTa-v3 baseline, precision 0.820 and recall 0.905 give F1 ≈ 0.860, not 0.728. For Sentinel, precision 0.986 and recall 0.991 give F1 ≈ 0.988, not 0.980. Since F1 is fully determined by precision and recall, at least one value in each row is wrong. The claimed F1 margin on the internal test set is therefore not what the table says. That is not a minor typo; it is the central empirical claim of the paper.\n\nWhat is genuinely here: Sentinel is a fine-tuned ModernBERT-large binary classifier for prompt injection, and the authors have put the model on Hugging Face. Fine-tuning a strong encoder on a mixture of public and private data is a reasonable engineering approach, and the paper documents the public datasets and the training split clearly enough. The latency number on an L4 GPU (~0.02s) is plausible and useful for practitioners.\n\nBut the evaluation has more problems. Only one external baseline is used, with no confidence intervals or multiple runs. The internal test set is a random 10% split from the same sources as training, so it is in-distribution by construction. The private data generation and split process are not described, so leakage or iterative refinement on the same test set cannot be ruled out. And Table 2 includes qualifire/Qualifire-prompt-injection-benchmark, a dataset created by the same company, in the public average. That is not disqualifying by itself, but combined with the opaque private data it makes the SOTA claim hard to trust.\n\nWho this is for: practitioners who want a fast, ready-made detector might still try the model, but the paper as written does not establish that it is state of the art. The honest fix is to correct the table, release the evaluation code and either the private data or a detailed generation protocol, and compare against several strong baselines (including other fine-tuned detectors and possibly LLM-as-judge).\n\nRecommendation: if this lands on my desk, I would send it back for major revision. A referee should be able to check the numbers after the authors fix them. As it stands, the arithmetic error alone is enough to reject, but the underlying work is not worthless. If the authors provide the missing evidence, a revised version could be a useful applied contribution.","headline":"The paper's central SOTA claim is contradicted by its own Table 1, where the reported F1 scores cannot be derived from the reported precision and recall.","tokens_in":6020,"tokens_out":2687,"would_cite":false,"duration_ms":28928,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Sentinel claims 98.7% accuracy at catching prompt injections","keywords":["prompt injection detection","LLM security","ModernBERT","jailbreak detection","binary classifier","fine-tuning","low-latency detection"],"falsifier":"Collect a fresh corpus of prompt-injection attacks created after Sentinel's training cutoff, none of which appeared in its public benchmarks, and run the released model on it; if its F1 falls toward the DeBERTa-v3 baseline rather than staying near 0.98, the generalization claim is refuted.","tokens_in":5138,"feed_emoji":"🛡️","tokens_out":7168,"duration_ms":70188,"temperature":0.7,"pith_summary":"The paper claims to build a state-of-the-art prompt-injection detector, Sentinel, by fine-tuning ModernBERT-large on a carefully aggregated mix of open-source and private datasets. On a held-out internal test set it reports an average accuracy of 0.987 and an F1 score of 0.980, and on four public benchmarks it reports an average binary F1 of 0.938, beating the DeBERTa-v3-based baseline by roughly 23 points. The practical payoff is that LLM applications could gate user input with a lightweight classifier that adds about 20 milliseconds of latency per prompt. The authors attribute the improvement to a modern base model combined with diverse, carefully curated training data.","feed_headline":"Classifier catches prompt injections with 98.7% accuracy","feed_subtitle":"Fine-tuned ModernBERT beats a DeBERTa-v3 baseline by about 23 F1 points on public benchmarks at ~20 ms per prompt.","key_machinery":"The load-bearing mechanism is the pairing of a modern encoder architecture with a diverse training corpus. Sentinel is a 395M-parameter binary classifier obtained by fine-tuning ModernBERT-large, a bidirectional encoder-only Transformer with 28 layers, a native 8192-token context, rotary position embeddings, local-global alternating attention, unpadding, and Flash Attention. The training set is consolidated to roughly 70% benign and 30% jailbreak prompts, split 90/10 into training and held-out test, with the private synthetic portion aimed at nuanced error correction and real-world misclassifications. The same architecture-plus-data recipe is what the paper credits for the transfer to public benchmarks.","core_discovery":"The central claim is that fine-tuning ModernBERT-large as a binary benign-versus-injection classifier on a 70/30 mix of benign and jailbreak prompts, drawn from several open-source collections plus a small private synthetic set, yields a detector that sets a new state of the art for prompt-injection detection. The evidence is a 10% held-out internal test set where Sentinel scores 0.987 average accuracy, 0.991 recall, 0.986 precision, and 0.980 F1, versus 0.848, 0.905, 0.820, and 0.728 for the DeBERTa-v3 baseline, plus four public benchmarks where Sentinel averages 0.938 F1 against the baseline's 0.709. The authors argue that ModernBERT's architectural features and the diversity of the curated data are what produce the gain.","pith_inferences":["The paper leaves implicit that its internal test set is a random split of the same source collections used for training, so samples share formatting and topic distributions; genuinely novel attack families could reduce the reported margin over the baseline.","The error analysis found no recurring categories in misclassifications; a useful next experiment would be to stress Sentinel with character-level obfuscation, role-play reframing, and encoding tricks to map where its decision boundary actually gives way.","Including the authors' own benchmark among the four public sets may inflate the averaged comparison; the strongest test would come from fully independent third-party benchmarks collected after the model's training cutoff.","Sentinel's design as a binary classifier on raw prompt text could be extended to indirect prompt injections hiding in retrieved documents or tool outputs, a setting the paper does not evaluate."],"forward_implications":["At roughly 0.02 seconds per inference on an L4 GPU, Sentinel can serve as a low-latency pre-filter in front of LLM calls, making prompt-injection detection a real-time gate.","The reported F1 gain over the DeBERTa-v3 baseline (0.938 versus 0.709 averaged across four benchmarks) implies that older detector architectures are comparatively brittle on scenario-based and in-the-wild attack data.","Because the model is released publicly, application developers can reproduce the core result and integrate the detector without retraining.","The training mix suggests that a small private synthetic set targeting specific error patterns can improve a detector without requiring a massive new corpus."],"supporting_citations":[{"why":"Supplies the ModernBERT-large architecture that Sentinel fine-tunes.","marker":"[23]"},{"why":"The DeBERTa-v3-based baseline that Sentinel must beat on internal and public tests.","marker":"[16]"},{"why":"Provides jailbreak examples from the O5 Malicious Use category used for training.","marker":"[13]"},{"why":"Supplies jailbreak prompts from the toxic-chat collection where the jailbreaking flag is set.","marker":"[11]"},{"why":"Contributes in-the-wild jailbreak and benign prompts.","marker":"[20]"},{"why":"Adds 16,000 scenario-based attack samples to the training mix.","marker":"[19]"},{"why":"One of the public benchmarks used to measure Sentinel's generalization.","marker":"[10]"},{"why":"One of the public benchmark sets on which Sentinel is compared with the baseline.","marker":"[6]"},{"why":"The authors' own prompt-injection benchmark included in the averaged F1 comparison.","marker":"[17]"}],"fun_headline_variants":["Sentinel model hits 98.7% accuracy on prompt injection detection","SOTA prompt-injection defense: Sentinel, 98.7% accurate","Sentinel: ModernBERT-based detector, 98.7% accuracy","New model Sentinel detects prompt injections at 98.7% accuracy","98.7% accuracy: Sentinel sets new prompt-injection detection bar"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The internal held-out test set is representative of real-world prompts and does not share distributional artifacts with the training data, since the random split preserves the same sources and the private-data generation process is not described.","fun_headline_variants_meta":{"raw":{"variants":["Sentinel model hits 98.7% accuracy on prompt injection detection","SOTA prompt-injection defense: Sentinel, 98.7% accurate","Sentinel: ModernBERT-based detector, 98.7% accuracy","New model Sentinel detects prompt injections at 98.7% accuracy","98.7% accuracy: Sentinel sets new prompt-injection detection bar"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000872,"raw_usage":{"total_tokens":3767,"prompt_tokens":926,"completion_tokens":2841,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":2745}},"tokens_in":542,"tokens_out":2841,"duration_ms":24576,"temperature":1.0,"reasoning_tokens":2745,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T10:24:57.773828+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect a fresh corpus of prompt-injection attacks created after Sentinel's training cutoff, none of which appeared in its public benchmarks, and run the released model on it; if its F1 falls toward the DeBERTa-v3 baseline rather than staying near 0.98, the generalization claim is refuted.","supporting_citations":[{"cited_title":"qualifire/Qualifire-prompt-injection-benchmark Dataset","cited_arxiv_id":null,"evidence_quote":"Supplies the ModernBERT-large architecture that Sentinel fine-tunes."},{"cited_title":"microsoft/orca-agentinstruct-1M-v1 dataset","cited_arxiv_id":null,"evidence_quote":"The DeBERTa-v3-based baseline that Sentinel must beat on internal and public tests."},{"cited_title":"lmsys/toxic-chat dataset","cited_arxiv_id":null,"evidence_quote":"Supplies jailbreak prompts from the toxic-chat collection where the jailbreaking flag is set."},{"cited_title":"Do Anything Now","cited_arxiv_id":null,"evidence_quote":"Contributes in-the-wild jailbreak and benign prompts."},{"cited_title":"deepset/prompt-injections dataset","cited_arxiv_id":null,"evidence_quote":"One of the public benchmark sets on which Sentinel is compared with the baseline."}],"review_version":1}