PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift

Abstract

Prompt-injection detectors are typically evaluated using aggregate <inline-formula> <tex-math notation="LaTeX">$F_{1}$ </tex-math></inline-formula> on in-distribution test data, which offers limited insight into behavior under distribution shift, particularly on the benign side of the decision boundary, where false positives impose direct operational cost yet are seldom measured. We present PIDS-Bench, a frozen multi-axis benchmark that jointly evaluates attack detection and benign false-positive behavior at fixed thresholds, spanning in-distribution inputs, hard-benign prompts that mimic injection structure without malicious intent, obfuscated attacks, and domain and structural distribution shifts. We evaluate seven detectors (learned baselines, external prompt-injection classifiers, and broad-safety comparators) alongside a rule-based lower-bound reference. Multi-axis evaluation exposes a failure mode that aggregate <inline-formula> <tex-math notation="LaTeX">$F_{1}$ </tex-math></inline-formula> conceals. A detector exceeding <inline-formula> <tex-math notation="LaTeX">$F_{1} = 0.98$ </tex-math></inline-formula> on the held-out split still misclassifies roughly one-third of an externally-sourced benign subset drawn from public corpora and restricted to security-adjacent content. Across a full threshold sweep and five training seeds, no internal detector reaches an operating point satisfying <inline-formula> <tex-math notation="LaTeX">$F_{1} \geq 0.95$ </tex-math></inline-formula> and hard-benign <inline-formula> <tex-math notation="LaTeX">$\mathrm {FPR} \leq 0.10$ </tex-math></inline-formula> together on this stress distribution. Decomposing by provenance, we find that hard-negative augmentation nearly eliminates over-defense on curated stress inputs but leaves it substantially intact on externally-sourced prompts, a pattern we term provenance-sensitive over-defense. The asymmetry holds across both fine-tuned architectures and does not diminish as the augmentation pool grows, with the externally-sourced FPR remaining far above the 0.10 target. Whether augmentation matched to the externally-sourced distribution would close this gap is untested; threshold calibration and curated-style augmentation alone do not.