I spent the last while building a prompt-injection detector trained on 78,000+ attack samples. Here's what surprised me, and why I ended up going the unfashionable route.
The trendy approach is to use an LLM. I didn't.
The default move in 2026 is "use an LLM to judge whether input is an attack." It's appealing because models understand nuance. But once you try to run it inline on every request, the problems pile up fast:
Latency. You've added a full model round-trip to every single call. Hundreds of milliseconds, minimum.
Cost. Your security bill now scales with your traffic. Every request pays the token tax.
