{"id":"https://openalex.org/W7222525668","doi":"https://doi.org/10.48550/arxiv.2610.20907","title":"From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection","display_name":"From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection","publication_year":2026,"publication_date":"2026-10-14","ids":{"openalex":"https://openalex.org/W7222525668","doi":"https://doi.org/10.48550/arxiv.2610.20907"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2610.20907","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.20907","pdf_url":"https://arxiv.org/pdf/2610.20907","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2610.20907","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125400130","display_name":"Qianlong Lan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lan, Qianlong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106015158","display_name":"Anuj Kaul","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kaul, Anuj","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106015160","display_name":"Vinothini Pandurangan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pandurangan, Vinothini","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5148515464","display_name":"Indranil Sanyal","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sanyal, Indranil","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/prompt-injection-detection","display_name":"prompt injection detection","score":0.8640000224113464},{"id":"https://openalex.org/keywords/llm-security","display_name":"LLM security","score":0.6949999928474426},{"id":"https://openalex.org/keywords/probabilistic-decision-model","display_name":"probabilistic decision model","score":0.6800000071525574},{"id":"https://openalex.org/keywords/probability-calibration","display_name":"probability calibration","score":0.8019999861717224},{"id":"https://openalex.org/keywords/distribution-shift","display_name":"distribution shift","score":0.7390000224113464},{"id":"https://openalex.org/keywords/deferral","display_name":"deferral","score":0.44999998807907104},{"id":"https://openalex.org/keywords/temperature-scaling","display_name":"temperature scaling","score":0.753000020980835},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"false positive rate","score":0.39399999380111694},{"id":"https://openalex.org/keywords/jev","display_name":"Jev","score":0.35499998927116394}],"concepts":[{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.7232000231742859},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5914000272750854},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.5835000276565552},{"id":"https://openalex.org/C165838908","wikidata":"https://www.wikidata.org/wiki/Q736777","display_name":"Calibration","level":2,"score":0.5439000129699707},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.4433000087738037},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.37959998846054077},{"id":"https://openalex.org/C84839998","wikidata":"https://www.wikidata.org/wiki/Q5249245","display_name":"Decision rule","level":2,"score":0.37439998984336853},{"id":"https://openalex.org/C3309909","wikidata":"https://www.wikidata.org/wiki/Q864155","display_name":"Binary decision diagram","level":2,"score":0.34790000319480896},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31459999084472656},{"id":"https://openalex.org/C149441793","wikidata":"https://www.wikidata.org/wiki/Q200726","display_name":"Probability distribution","level":2,"score":0.3138999938964844},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3066999912261963},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2957000136375427},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2935999929904938},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C28901747","wikidata":"https://www.wikidata.org/wiki/Q177571","display_name":"Decision theory","level":2,"score":0.28380000591278076},{"id":"https://openalex.org/C107327155","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision support system","level":2,"score":0.28040000796318054},{"id":"https://openalex.org/C96608239","wikidata":"https://www.wikidata.org/wiki/Q1199823","display_name":"Statistical power","level":2,"score":0.27730000019073486},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27160000801086426},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.2694999873638153},{"id":"https://openalex.org/C59594135","wikidata":"https://www.wikidata.org/wiki/Q5249242","display_name":"Decision model","level":2,"score":0.2646999955177307},{"id":"https://openalex.org/C2992838255","wikidata":"https://www.wikidata.org/wiki/Q856887","display_name":"Security guard","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C2777317252","wikidata":"https://www.wikidata.org/wiki/Q18393516","display_name":"Rare events","level":2,"score":0.2547999918460846},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.2524999976158142},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.25189998745918274}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2610.20907","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.20907","pdf_url":"https://arxiv.org/pdf/2610.20907","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2610.20907","doi":"https://doi.org/10.48550/arxiv.2610.20907","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2610.20907","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2610.20907","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.20907","pdf_url":"https://arxiv.org/pdf/2610.20907","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"score":0.46149998903274536,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7222525668.pdf","grobid_xml":"https://content.openalex.org/works/W7222525668.grobid-xml"},"referenced_works_count":2,"referenced_works":["https://openalex.org/W4404342689","https://openalex.org/W7165620026"],"related_works":["https://openalex.org/W7165620026","https://openalex.org/W7160821884","https://openalex.org/W7163343622","https://openalex.org/W7163057773","https://openalex.org/W4416615478","https://openalex.org/W7161540053","https://openalex.org/W7223416926","https://openalex.org/W7202211995","https://openalex.org/W7219302268","https://openalex.org/W7164820531"],"abstract_inverted_index":{"Prompt-injection":[0],"defenses":[1],"are":[2],"commonly":[3],"evaluated":[4,157],"as":[5],"binary":[6],"detectors,":[7],"although":[8],"deployed":[9],"LLM":[10,105,187],"applications":[11],"must":[12,190],"make":[13],"operational":[14,198],"decisions":[15,34,182],"about":[16],"whether":[17],"to":[18,31],"allow,":[19],"block,":[20],"or":[21],"escalate":[22],"potentially":[23],"malicious":[24],"inputs.":[25],"Recent":[26],"probabilistic":[27,51,174],"decision":[28,52,199],"models":[29],"aim":[30],"support":[32],"such":[33],"through":[35],"calibrated":[36,138],"confidence":[37],"estimates,":[38],"but":[39],"their":[40],"reliability":[41],"under":[42,99,183],"distribution":[43,82,184],"shift":[44],"remains":[45],"uncertain.":[46],"We":[47],"evaluate":[48,192],"a":[49,100],"native":[50,131],"model":[53],"(Jev),":[54],"two":[55],"Llama":[56],"Prompt":[57,118,124],"Guard":[58,119,125],"2":[59,120,126],"classifiers":[60],"(22M":[61],"and":[62,64,74,81,87,96,123,141,165,197],"86M),":[63],"an":[65,150],"LLM-based":[66],"judge":[67,106],"on":[68],"47,611":[69],"held-out":[70],"examples":[71],"spanning":[72],"direct":[73],"indirect":[75],"prompt":[76],"injections,":[77],"hard-benign":[78],"inputs,":[79],"obfuscation,":[80],"shift.":[83,185],"Using":[84],"separate":[85],"development":[86],"calibration":[88,145],"splits,":[89],"we":[90],"assess":[91],"detection":[92],"performance,":[93],"probability":[94],"calibration,":[95,194],"allow-block-defer":[97],"policies":[98],"frozen":[101],"evaluation":[102],"protocol.":[103],"The":[104],"achieves":[107],"the":[108],"highest":[109],"overall":[110],"discrimination":[111],"(AUROC":[112],"0.897),":[113],"followed":[114],"by":[115],"Jev":[116],"(0.871),":[117],"86M":[121],"(0.757),":[122],"22M":[127],"(0.714).":[128],"However,":[129],"Jev's":[130],"probabilities":[132],"do":[133,177],"not":[134,178],"consistently":[135],"outperform":[136],"post-hoc":[137],"classifier":[139],"scores,":[140],"temperature":[142],"scaling":[143],"improves":[144],"without":[146],"improving":[147],"discrimination.":[148],"At":[149],"empirical":[151],"false-negative-rate":[152],"target":[153],"of":[154],"1%,":[155],"all":[156],"gate-reviewer":[158],"systems":[159,189],"require":[160],"more":[161],"than":[162],"91.8%":[163],"escalation":[164],"incur":[166],"substantial":[167],"false-positive":[168],"rates.":[169],"These":[170],"findings":[171],"demonstrate":[172],"that":[173],"outputs":[175],"alone":[176],"establish":[179],"reliable":[180],"security":[181,188],"Effective":[186],"jointly":[191],"detection,":[193],"reviewer":[195],"behavior,":[196],"policies.":[200]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-10-17T00:00:00"}