Lakera Guard: Prompt Injection Detection in Practice

Lakera Guard is one of the few AI security products designed specifically for prompt injection detection rather than general content moderation ↗. The positioning matters: prompt injection is a distinct threat class from toxicity or harmful content generation, and it requires different detection approaches.

We deployed Lakera Guard as part of a layered security stack for a customer-facing LLM application and ran it in production for four months alongside comparative tools. This is the honest assessment, structured around our AI security tool evaluation framework.

What Lakera Guard does

Lakera Guard provides an API that classifies LLM inputs for:

• Direct prompt injection (user inputs attempting to override system instructions)
• Indirect prompt injection (injected content in retrieved documents, tool outputs, or other external content)
• Jailbreak attempts
• PII detection (a secondary capability)

The classification is real-time (API call, ~30-50ms typical), returns a binary flag plus category details, and integrates into the pre-processing pipeline before your LLM call.

Detection performance

Direct prompt injection: On our production traffic, Lakera Guard caught approximately 85-90% of clear injection attempts — the “ignore previous instructions,” “you are now a different AI,” and explicit role-override patterns. False positive rate on legitimate user inputs was 1-2%, acceptable for our use case.

On adversarial tests (optimized bypass attempts, indirect framing, encoding-based obfuscation), effectiveness dropped to 60-70%. This is not a Lakera-specific failure — all current detection tools have this gap.

Indirect prompt injection: This is where Lakera Guard’s differentiation is most visible. Most competitors either don’t have indirect injection detection or it’s clearly undertrained. Lakera’s indirect injection coverage — classifying retrieved documents and tool outputs for embedded instructions — is meaningfully better than alternatives at similar price points.

On synthetic indirect injection test cases (documents with embedded instruction text), detection rate was ~75%. On real production traffic, the indirect injection attempt rate is low enough that we haven’t seen enough genuine cases to measure reliably.

Jailbreak detection: Comparable to other dedicated AI security products. Persona-based jailbreaks (DAN variants) caught reliably. Encoding-based and adversarially optimized jailbreaks caught less reliably.

Latency profile

At 30-50ms typical latency, Lakera Guard adds measurable overhead. In our deployment (total budget ~200ms for the user-facing interaction), this was acceptable. For sub-100ms applications, this is a constraint.

Their enterprise tier includes a self-hosted deployment option with on-premises hardware, which reduces latency to ~10-15ms in the same cloud region as the application.

Cost model

Lakera Guard uses a request-based pricing model. At typical production volumes (1-5M requests/month), costs run in the range of a few thousand dollars per month. The API pricing is tiered; high-volume deployments get better per-request rates.

The self-hosted option is priced separately and substantially higher. It’s appropriate for compliance environments where API calls to external services are restricted.

Comparison to alternatives

Rebuff (open source): Lower cost (self-hosted), weaker indirect injection coverage, reasonable direct injection detection. Good starting point if cost is a constraint.

LangKit/Whylabs: More oriented toward general LLM monitoring than injection detection specifically. Better for the observability use case than the security use case.

OpenAI Moderation API: Fast and free, but not designed for injection detection. Catches some obvious jailbreaks incidentally; misses most injection-specific patterns.

NeMo Guardrails: More capability but more complexity. If you need conversation flow control in addition to injection detection, NeMo is worth the overhead. If you just need injection detection, Lakera is more targeted.

Verdict

Lakera Guard is the best purpose-built prompt injection detection tool we’ve evaluated. For teams whose primary threat model is injection-based attacks (reasonable for consumer-facing applications), it’s the right dedicated tool.

It’s a layer in a stack, not a complete security solution. It doesn’t replace content classification (use Llama Guard or OpenAI Moderation API for that), output monitoring, or behavioral anomaly detection.

For broader AI security product comparisons across the stack, bestaisecuritytools.com ↗ maintains updated benchmark data.