Research
Prompt injection classifiers are terrible security boundaries | Tom Ganz
First reported · Discovered thecout.com
Page published
Earliest dated coverage: 4 Oct 2026 · First observed: 12 Oct 2026 · Latest dated coverage: 4 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Prompt-injection classifiers are the most commonly recommended defense for LLM apps, and this work shows they can be systematically bypassed with GCG-optimized suffixes, undermining a control many defenders rely on as a security boundary.
Tom Ganz demonstrates that prompt-injection detection classifiers make poor security boundaries by training a strong 323M classifier ('Smolaya-guard', 0.9998 AUC, 99.7% catch rate) and then using Greedy Coordinate Gradient (GCG) adversarial-suffix optimization to reliably push flagged injections below the detection threshold so they are waved through as benign. The method, building on the universal/transferable adversarial-attack work of Zou et al., shows any such detector can be evaded with a handful of gradient-descent steps while the underlying injection still functions.