PromptArmor: turn an off-the-shelf LLM into a sub-1% prompt-injection guardrail

PromptArmor: Simple yet Effective Prompt Injection Defenses (arXiv 2507.15219)·medium signal

PromptArmor interposes a lightweight guardrail LLM (GPT-4o/4.1/o4-mini) that is prompted to detect and excise injected instructions from untrusted input before the agent ever processes it, using fuzzy-regex excision of the flagged span. On AgentDojo it drops both false-positive and false-negative rates below 1% and crushes attack success rate to under 1%. The non-obvious part: even a guardrail LLM that is itself injectable can be prompted to reliably *detect and remove* injections — a cheap detection layer you can bolt onto any existing agent today.