Wolf Defender on the Buried Injections benchmark
Buried Injections examines a specific weakness in prompt injection detection: AgentDojo attacks are embedded in longer, realistic tool outputs. This tests whether a detector can still find an injection when it occupies only a small part of mostly ordinary content.
The benchmark measures context dilution, not multi-turn attacks. That distinction matters when interpreting the Wolf results.
That context dilution is a problem for many open-weight detectors: some recognize attack text in isolation but detect it far less often inside the full tool output. The benchmark's payload and full-context results show the difference.
Wolf Defender on Buried Injections
The Patronus runtime processes large content in small chunks instead of treating it as one huge input. The current Wolf Defender Small v2 was trained exclusively for single-turn prompt injection, without explicit multi-turn memory. On the 629 embedded attack cases, it detects 524 attacks, with one false positive across 97 benign cases.
| Model | Attacks detected | Recall | False positives |
|---|---|---|---|
| Wolf Defender Small v2 | 524 / 629 | 83.31% | 1 / 97 |
| Wolf Candidate C1 (multi-turn training, internal) | 628 / 629 | 99.84% | 3 / 97 |
| Wolf Candidate C2 (multi-turn training, internal) | 629 / 629 | 100% | 5 / 97 |
| Jailbreak-Detector-Large | 319 / 629 | 50.72% | 2 / 97 |
| ProtectAI DeBERTa v2 | 145 / 629 | 23.05% | 4 / 97 |
At the default settings in the public benchmark, Jailbreak-Detector-Large has the best published trade-off: 319 of 629 attacks detected with two false positives. Wolf Defender Small v2 is well above that result at the fixed 0.5 threshold. The public baselines come from the benchmark repository; the Wolf figures come from our own evaluation on the same case material. The repository author also shows that tuning thresholds can change the ranking. This table compares the settings shown here, not every possible configuration.
What the internal candidates show
The two internal candidates for the next Wolf generation are also trained on longer agent histories, tool context, and attacks that develop over several steps. On Buried Injections, C1 and C2 detect 628 and 629 of the 629 cases, respectively. Those numbers describe detection of embedded attacks; on their own, they do not establish a detection rate for multi-turn attacks.
The dataset has important limits: its 629 cases reuse 27 distinct attack payloads across different AgentDojo contexts. Our internal candidates have seen AgentDojo-inspired training data. The 97 benign cases are also a small sample for estimating false-positive rates in production. C2's perfect score on this dataset, like the other figures, does not mean prompt injection is solved.
The results show why detection needs to be evaluated in full context: the dangerous signal may occupy only a small part of a much larger AI context. Several public detectors lose substantial recall in precisely that setting.
Wolf Defender Small v2 is publicly available. The two candidates will remain internal until the next evaluation round is complete. The benchmark methodology and data are public; for more about the model, read our Wolf Defender v2 article.