Do Injection Guardrails Read Attack Intent? An XAI Study of Prompt Guard 2

In September 2026, researchers including a team at Universidad de la República published an XAI study of Meta's Prompt Guard 2 prompt-injection classifier. They found the 86-million-parameter DeBERTa-v2 model is not a simple keyword filter, yet its decisions still rest largely on familiar attack phrasing rather than on attack intent.

In September 2026, researchers including a team at Universidad de la República published "Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection" (arXiv 2609.24801). The paper studies Meta's Prompt Guard 2, an 86-million-parameter DeBERTa-v2 classifier that labels an input as Benign or Injection.

https://arxiv.org/pdf/2609.24801

In many LLM applications a small security classifier scores the user prompt first. Text labeled benign is passed to the main model. Text labeled as prompt injection or jailbreak is blocked. These classifiers are smaller, faster, and cheaper than using another large model as a judge, so they are often placed in front of every call. The paper asks whether an injection label reflects attack intent or a match on words that often appear in attacks.

Attribution shows a distributed pattern

The authors used Vanilla Gradient and SHAP to turn a single label into a token-importance map. Vanilla Gradient estimates which tokens the model is most sensitive to. SHAP estimates how much each token contributed to that decision.

Feature importance was dispersed, 0.118 under Vanilla Gradient and 0.169 under SHAP, and the two methods disagreed on lower-ranked tokens. The authors conclude Prompt Guard 2 is not a simple keyword filter. They also conclude that its judgments still rest to a large degree on how attacks are usually phrased, rather than on a full reading of what the attack is trying to do.

The authors report that the guardrail's decision boundary and the protected model's behavior boundary are not the same line. The security-relevant region is a prompt the classifier marks benign while the backend model still follows the underlying request. The heaviest rewrite analysis used one representative jailbreak prompt, with a limited extra check in Spanish.

Familiar phrasing versus intent

The authors then scored Vanilla Gradient salience on a random draw from a 10,000-prompt set (7,000 benign, 3,000 malicious): 200 benign prompts and 200 injection prompts. On correctly detected injections, high-attribution tokens clustered on language associated with overriding prior instructions, changing roles, and requesting restricted data.

Of the 200 malicious samples inspected, 105 were not flagged. The authors stress that figure is not an overall miss rate for Prompt Guard 2. Missed samples used more ordinary wording and leaned toward information-seeking rather than classic instruction-override templates.

The paper calls this lexical dependency: a flexible match on attack-like language, distinct from a hard denylist and from intent recognition. The analogy in the paper is a student who solves chicken-and-rabbit word problems by spotting those animals, then fails the same math when the story is about robots and wheels.

Production stacks often pair a tens-of-millions-parameter injection classifier with a much larger backend LLM. The two models differ in size, training objective, and data. Evaluation that only reports accuracy, recall, or F1 on a frozen attack set can miss whether labels stay aligned with backend behavior when the same intent is written in different words, syntax, or languages.

XAI as an internal diagnostic

Explanation methods can show which tokens and structures a classifier depends on. In a safety setting that cut runs both ways. Defenders can use it to find blind spots. The authors warn that transparency in a security classifier can be dual-use, and they recommend keeping XAI inside internal red-team and diagnostic workflows, then feeding weak spots back into training, evaluation, and monitoring.

They outline three engineering directions. Train on semantic equivalence classes: many surface forms of one attack intent, not only original attack strings. Treat label consistency under meaning-preserving rewrites as a product metric. Use token attribution in the test pipeline for targeted data expansion, threshold calibration, and distribution-drift checks.

The paper does not offer a replacement guardrail architecture and does not claim that Prompt Guard 2 lacks all semantic signal. It tests this one Meta detector, with the main rewrite work on a single prompt family. The authors list larger automated evaluation as future work. The narrower claim is that this filter is stronger at recognizing attacks it has seen how to phrase than at recognizing attack intent as such.