VGE PromptGuard v4: A New Generation of Prompt Injection Defense

On August 4, 2026, OWASP published its new Top 10 for LLM Applications. Prompt injection stays at the top of the list as LLM01, the number one risk for LLM applications. That ranking matches what we see in production, and it is why summer was not downtime at Vigil Guard but a stretch of intensive work. VGE PromptGuard v4 is the result: a clean redesign of our detection models that replaces the v3 detectors with models we own end to end, trained on adversarial data we generate ourselves, and evaluated against v3 before it ships.

The previous generation, like most detectors in this space, adapted a general-purpose DeBERTa classifier to the task. v4 leaves that approach behind. These are Vigil Guard's own detection models, trained on data we engineer through a proprietary adversarial data factory, a pipeline built to manufacture the hardest, most realistic attacks and edge cases at scale. The training data is generated from the attack patterns the model has to catch, not adapted from a dataset built for something else.

Every new model passes a strict paired no-regression evaluation against the current production version, across held-out attack and benign traffic in all five supported languages. A model ships only when it beats the previous one on both.

Against v3, v4 delivers:

Catching more of the subtle indirect injections that slip past pattern-matching filters, while nearly halving false alarms, is what lets a security layer stay switched on in production instead of being tuned down until it stops blocking.

Attacks do not only arrive as short chat prompts. v4 is a family of models. A fast short-context model inspects prompts up to 512 tokens. A long-context tier reads up to 8,000 tokens in a single pass, built for the places injections actually hide: source code, documents, and retrieved RAG content, analyzed whole instead of split into fragments.

These detectors are narrow on purpose. VGE PromptGuard v4 has one job: it catches prompt injection and jailbreak attempts that try to hijack a model's instructions, not general content moderation. That focus is why both numbers move in the right direction at once, more detections and fewer false positives.

Every other job has its own purpose-built detector. Content moderation, sensitive-data detection for PII, and our own semantic drift model each cover one task and are trained and measured for that task alone. Vigil Guard runs them as one multi-layer pipeline: a prompt, a model output, or an agent action passes through the layers that apply to it, and each returns its own decision.

Building a separate model for each job is the harder path, and it is the one that survives production. A single general classifier stretched across injection, moderation, PII, and drift blurs every decision boundary and cannot improve on one axis without regressing another. Specialist models stay independent: we can retrain the injection detector, prove on a paired evaluation that it beats the previous version, and ship it without touching moderation or PII. Each layer improves on its own schedule.