DeBERTa-v3-base fine-tuned for binary prompt injection classification. Trained on the original 8,183-example dataset plus 1,687 synthetic examples targeting 5 documented v1 failure patterns.

The standard test set is saturated (v1 already missed only 7 of 1,754 examples). v2 was not measured to beat v1 on this benchmark by design intent of the synthetic data, which targets categories underrepresented in split_test. On a held-out adversarial slice built from the failure clusters (n=651, injection-heavy), v2 achieves 0.99 injection recall and 1.00 benign recall.

9,870 examples: 8,183 original (5 public datasets, deduplicated) + 1,687 synthetic examples generated via Claude Sonnet, deduplicated against existing training data via sentence embeddings, cross-validated with Claude Haiku (99.2% label agreement).

Synthetic data targets 5 failure clusters identified from v1 error analysis: non-English injections, very short injections, indirect jailbreaks framed as hypotheticals, legitimate role-play requests, and instruction-adjacent coding phrasing.

See the GitHub repository for the complete failure analysis, synthetic data pipeline, and quality filter documentation.