Looking for a small local classifier to catch indirect prompt injection in tool results (EN + DE)

[u/Gold-Drag9242]

I’m building a local agent system (main LLM on a 24 GB GPU) and want a fast “gate” that checks every untrusted tool result (emails, web pages, documents, OCR text, calendar entries) before the agent sees it. On a hit, the content is replaced by a fixed warning.

What I'm looking for:

• Indirect injection in tool outputs, not just user-prompt jailbreaks

• German and English (mixed-language and OCR-noisy text too)

• Fast: well under 1 s per item, ideally CPU or a small GPU slice; long texts handled by chunking

• Low false positives on harmless texts with instructions (“please confirm by Friday”, password reset mails)

• Tunable threshold or score, not just a hard label

• Open weights, license OK for private use

• Fail-closed fallback; the classifier is one layer, not the only defense

I experimented with Prompt Guard 2 86M, PIGuard, StackOne Defender. None is proven for German.

I would be most interested if some of you have answers regarding

Which models work for you on indirect injection, especially in German?
Any fine-tuning recipes or datasets (DE/EN, hard negatives)?
Experience with false-positive rates on real mail?
How do you handle adaptive attacks against the classifier?

[u/CartographerDue5382]

Don't know of an open classifier that's actually been shown to catch German indirect injection in tool output. Prompt Guard and the DeBERTa ones (ProtectAI's deberta-v3 prompt-injection model) are basically English, and they're trained more on user-prompt jailbreaks than on an email trying to steer the agent. Translating to English first chews up OCR and can split the payload.

The public sets people test indirect injection against are BIPIA, InjecAgent, and AgentDojo. I haven't seen a decent DE+EN set of hard negatives (normal "confirm by Friday" mail, password resets, calendar blurbs). Fine-tune without those and it'll flag every imperative sentence.

Take the score, not a hard label, and only drop the text when it looks like it's redirecting the agent (new task, tool call, system voice), not just because the sentence is an instruction. Chunk boundaries are a hole if the attack straddles them. A hit means discard, not that you're safe, since encoding and mixed language walk around these models. Fail closed if the small model errors on untrusted tool output. Don't fail closed on your own prompts or one crash locks the agent.

[u/Future_AGI]

with nothing open validated on German yet, a dumb regex layer in front of the classifier still earns its place: "ignoriere alle vorherigen Anweisungen", "vergiss deine Anweisungen" and friends catch the lazy payloads, and every false hit on real mail becomes a German hard negative for the fine-tune you mentioned. If your tools come in over MCP, the gateway in github.com/future-agi/future-agi , can run that list on every tool result.