The rapid adoption of large language models (LLMs) in corporate and governmental systems has raised critical security concerns, particularly prompt injection attacks exploiting LLMs’ inability to differentiate control instructions from untrusted user inputs. This study systematically benchmarks neural network architectures for malicious prompt detection, emphasizing robustness against character-level adversarial perturbations—an aspect that remains comparatively underemphasized in the specific context of prompt-injection detection despite its established significance in general adversarial NLP. Using the Malicious Prompt Detection Dataset (MPDD) containing 39, 234 labeled instances, eight architectures—Dense DNN, CNN, BiLSTM, BiGRU, Transformer, ResNet, and character-level variants of CNN and BiLSTM—were evaluated based on standard performance metrics (accuracy, F1-score, and AUC-ROC), adversarial robustness coefficients against spacing and homoglyph perturbations, and inference latency. Results indicate that the word-level 3WordBiLSTM achieved the highest performance on clean samples (accuracy = 0. 9681, F1 = 0. 9681), whereas the Transformer exhibited lower accuracy (0. 9190) and significant vulnerability to spacing attacks (adversarial robustness ρspacing=0. 61). Conversely, the Character-level BiLSTM demonstrated superior resilience (ρspacing=1. 0, ρhomoglyph=0. 98), maintaining high accuracy (0. 9599) and generalization on external datasets with only 2–4% performance decay. These findings highlight that character-level representations provide intrinsic robustness against obfuscation attacks, suggesting CharBiLSTM as a reliable component in defense-in-depth strategies for LLM-integrated systems.
Kushnerov et al. (Wed,) studied this question.