Evaluating Hybrid Guardrail Architectures for Prompt Injection Defense in Large Language Models

Prompt injection attacks exploit the instruction-following behavior of large language models (LLMs) by embedding adversarial directives within user-provided text. Production systems frequently deploy layered guardrail mechanisms, combining heuristic filters and model-based classifiers, to mitigate such attacks. However, rigorous empirical evaluations of these architectures under structured adversarial variation remain limited, and most deployed systems lack publicly reported performance metrics.

We present a systematic evaluation of three guardrail configurations: (1) a baseline with no guardrails, (2) regex-based heuristic filtering, and (3) a hybrid architecture combining regex filtering with an LLM-based safety classifier. We construct a two-tier benchmark of 625 prompts: 400 standard-difficulty prompts (200 attacks across 8 categories, 200 benign across 11 categories) and 225 hard-difficulty prompts (175 adversarially crafted attacks across 10 categories, 50 benign across 10 categories). We measure attack block rate, miss rate, benign false-positive rate, precision, recall, and F 1-score under a single-turn threat model.

On standard attacks, the hybrid configuration achieves perfect recall (100.0% block rate, 0.0% miss rate) with 5.0% benign FPR and F 1 = 0.976, while regex-only filtering blocks 75.0% of attacks with 2.5% FPR. On adversarially crafted hard attacks, the hybrid maintains near-perfect performance: 98.9% block rate with 0.0% benign FPR and F 1 = 0.994, while regex-only filtering degrades to 24.6% block rate (F 1 = 0.408). The hybrid's only failures on the hard tier occur in the benign-wrapper injection category (2 misses of 35 attempts).

We identify two principal findings: (1) the hybrid classifier generalizes robustly to adversarial attack variations, losing only 1.1 percentage points in recall from standard to hard; and (2) false positives concentrate exclusively in security-adjacent benign categories on the standard tier (security research: 87.5% FPR; critique: 37.5%), while the hard tier's generalpurpose benign prompts produce zero false positives. Our results demonstrate that hybrid architectures can achieve robust adversarial performance, though the semantic overlap between legitimate security discourse and attack signatures remains a persistent challenge for input-level classification.