> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Has prompt injection

> Detect prompt injection attempts, with optional LLM-as-a-judge explanations

## Definition

The prompt injection test uses your selected detector — built with Llama or a multilingual detector — to check for prompt injection, malicious strings, and jailbreak attempts in your system's input data.

## Taxonomy

* **Task types**: LLM.
* **Availability**: development (Continuously evaluate your models and datasets as you iterate on their versions.)
  and monitoring (Monitor a model in production, measure its health, check for drifts and set up alerts.).

## Why it matters

* Prompt injection is a type of attack that exploits an AI system and deviates it from its intended behavior.
* It is important to detect and prevent prompt injection attacks to ensure the reliability and security of your system.

## Detector and sensitivity

Choose a detector based on the languages, message roles, speed, and false alarms you can accept:

| Detector | When to use |
| - | - |
| Llama Prompt Guard 2 | You want very few false alarms and need to scan every message, but can accept more missed injections. This option has no sensitivity setting. |
| Horizon Guard (base) | You want the recommended multilingual option with few false alarms. |
| Horizon Guard (small) | You want the fastest multilingual option and can accept slightly more false alarms than with the base option. |
| mDeBERTa (multilingual) | You want to catch more translated jailbreak prompts and English attacks and can review more false alarms on text that mentions trigger words. |

The multilingual detectors scan user and tool messages, including tool results. They skip messages written by your application, such as system, developer, and assistant messages. Llama Prompt Guard 2 scans every message.

For detectors that support sensitivity, choose **High precision** to flag only the cases the detector is most sure of, **Balanced** for the recommended trade-off, or **High recall** to miss fewer injections at the cost of more false alarms. Treat flags as a review queue rather than a block list, especially with more sensitive settings.

Tests created in the UI default to **Horizon Guard (base)** with **Balanced** sensitivity. Existing tests do not change: a test without a `detector` parameter continues to use Llama Prompt Guard 2. Set `detector` explicitly in `tests.json` or the API to use a multilingual detector. If you omit `sensitivity` for a detector that supports it, the test uses `balanced`.

If several prompt injection tests use different detectors or sensitivities on the same project, Openlayer keeps their verdicts separate and labels each verdict with the test that produced it.

## Judge explanations

In the test **Parameters**, turn on **LLM-as-a-judge explanations**. While it is on, the shared LLM judge settings appear beneath the switch: model, sampling, batch, and custom instructions. Other LLM-as-a-judge tests, such as [LLM-as-a-judge](https://docs.openlayer.com/tests/catalog/l-l-m-rubric-threshold.md) and [Bias](https://docs.openlayer.com/tests/catalog/bias.md), use the same block.

When the judge runs, results include **Judge explanation** and **Judge confidence** columns. The explanation covers why the row was flagged, where the detection appears, and the relevant excerpt. **Judge confidence** is the LLM judge's confidence that this is a real injection.

With explanations off, results show a **Detection details** column with the detector's own evidence. Hover the prompt-injection verdict to see the same summary.

The judge can call out a likely false positive. Explanations are advisory and do not change the test count or verdict.

Prompt-injection results support the **Summarize** drill-down when the run has per-row explanations.

Without an explicit question column, the detector scans every text-bearing input variable. On a traced pipeline with several inputs, a row is flagged if any scanned input fires, and the results name the input column that fired.

The judge reviews a sample of flagged rows, bounded by the evaluator's `sample` settings, merged with the project's default LLM evaluator. The project default commonly uses a random sample with a row limit. Custom prompt instructions on the evaluator apply to the explanation pass.

## Test configuration examples

If you are writing a `tests.json`, here are valid configurations for the prompt injection test.
Set `detector` and `sensitivity` in `insightParameters`. Omitting `detector` runs Llama Prompt Guard 2. Set `explain_with_llm` to `true` to request explanations. You can also set `llm_evaluator` to override the model, sampling, and custom instructions for this explanation pass.

```json Development theme={null}
[
  {
    "name": "No prompt injection",
    "description": "Asserts that the input data has no prompt injection attempts",
    "type": "integrity",
    "subtype": "hasPromptInjectionCount",
    "thresholds": [
      {
        "insightName": "hasPromptInjectionCount",
        "insightParameters": [
          {
            "name": "detector",
            "value": "horizon_base"
          },
          {
            "name": "sensitivity",
            "value": "balanced"
          },
          {
            "name": "explain_with_llm",
            "value": true
          }
        ],
        "measurement": "hasPromptInjectionPercentage",
        "operator": "<=",
        "value": 0.0
      }
    ],
    "subpopulationFilters": null,
    "mode": "development",
    "usesValidationDataset": true,
    "usesTrainingDataset": false,
    "usesMlModel": false,
    "syncId": "b4dee7dc-4f15-48ca-a282-63e2c04e0689"
  }
]
```

```json Monitoring theme={null}
[
  {
    "name": "No prompt injection",
    "description": "Asserts that the input data has no prompt injection attempts",
    "type": "integrity",
    "subtype": "hasPromptInjectionCount",
    "thresholds": [
      {
        "insightName": "hasPromptInjectionCount",
        "insightParameters": [
          {
            "name": "detector",
            "value": "horizon_base"
          },
          {
            "name": "sensitivity",
            "value": "balanced"
          },
          {
            "name": "explain_with_llm",
            "value": true
          }
        ],
        "measurement": "hasPromptInjectionPercentage",
        "operator": "<=",
        "value": 0.0
      }
    ],
    "subpopulationFilters": null,
    "mode": "monitoring",
    "usesProductionData": true,
    "evaluationWindow": 3600,
    "delayWindow": 0,
    "syncId": "b4dee7dc-4f15-48ca-a282-63e2c04e0689"
  }
]
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.