Turkish prompt injection classifier

Examples

The first three rows are benign: a task instruction from cagrigungor/turkish-pii-masking-benchmark (“mask all personal data in the text with suitable tags”), a user changing their own earlier style instruction, and a rule written to protect the assistant. The last two are attacks: an instruction override, and an attempt to plant a rule in memory, which v2 misses. Bold is a score at or above the threshold (0.05 for v2, 0.5 for v1 and proventra).

v1 and v2

v2 is the default on Hugging Face. If few false alarms and speed matter most, pin v1 with revision="v1".

v2 was first published with threshold 0.3, which had been picked on a different training seed than the one released. Re-checked on the released model’s own held-out-source runs, without touching the test splits, the threshold moved to 0.05. The weights are the same; this page and the model card show the numbers at 0.05.

There is a third option, the recall mode of detect.py: it averages v1 and v2 and flags at 0.2, both chosen on the selection protocol. With each source held out its mean F1 is 0.677 (conv 0.690), and it catches 96% of fevzi. It also flags 14 of the 34 benign rows in the 1k test set, against 2 for v2, and needs about 59 ms per text. With v2 at its new threshold, recall mode is only better on conv.

v1 was measured on the test splits, and I also compared a few variants there, which flatters its numbers. For v2 I kept selection apart: every recipe was compared with each training source held out and measured on that source’s train and validation splits, and on benign splits never used in training. The test splits were touched once, for the numbers on this page. Eight recipes went through that protocol, and the chosen one was repeated with a second seed. The chosen one (mmBERT-base, obfuscation augmentation, English agentic data) scored a mean F1 of 0.717 and 0.661 with two training seeds, against 0.612 for the v1 recipe. I fixed in advance that the release would use the second seed, the weaker one. Two more seeds trained later scored 0.638 and 0.529: averaging three seeds scores higher but raises false alarms on hard benign rows and costs three times as much, and averaging their weights is worse than one seed. The release stays one model.

Results

The honest number is source held out: for each test set, a separate model is trained without any row from that source and tested on that source’s test split. I ran every model with the same script. These are my measurements, not the authors’ published numbers.

In short: v2 catches 96.3% of 107 obfuscated attacks and 97.6% of 42 attacks hidden in invisible Unicode, none of which it saw in training or selection, and flags 2.1% of 750 ordinary Turkish banking texts.

conv: 3nesdeniz/turkish-conversation-prompt-injection. 1k: 3nesdeniz/turkish-prompt-injection-1k. berat: beratcmn/turkish-prompt-injections, a translation of deepset/prompt-injections (* a model trained on the English deepset set has, in effect, seen these items). The English agentic sets added in v2 come from the same curator as conv and 1k, so those two columns are less unseen for v2 than for v1.

fevzi: fevziegeyurtsevenler/turkish-prompt-injection. invisible: fevziegeyurtsevenler/invisible-unicode-injection, instructions hidden in Unicode tag characters or split by zero-width characters inside innocent text. The decoder tries base64, hex, Caesar shifts, reversed text, letter spacing, leetspeak, Cyrillic look-alikes and invisible Unicode, and keeps the highest score. It was written from general techniques, not tuned on these rows, and changed no model’s false-positive rate on the benign sets below.

The three sets are published together as halilneed/turkish-prompt-injection-false-alarm-benchmark, 2,875 benign Turkish texts with a script that reproduces this table for any model. They come from my KVKK benchmark, my BSEBY benchmark and the instructions of cagrigungor’s PII benchmark, all CC0. They are in-domain for this model and not for the others: its training data has other texts from the same domains. Trained without them, the v1 recipe flagged 65% of banking texts and 98.5% of task instructions. If your traffic is from another domain, measure the false-positive rate on your own benign text first.

Where it fails

• Agentic attacks from an unseen source (conv, source held out): memory poisoning, data exfiltration and tool abuse are each caught in 0 of 3 rows; system prompt extraction and RAG poisoning in 1 of 3. Three rows each, so read them as a direction.
• Turkish morphological rewording (fevzi): 13 of 15, up from 9 in v1.
• The deepset translation style (berat, source held out): recall 0.339, up from 0.170.

Where it holds up: encoded attacks, 13 of 13 in fevzi (v1 5, proventra 10, wolf-defender 12); users changing their own earlier instruction, 5 of 7 in the 1k test set with that source held out (proventra 0 of 7, wolf-defender 1 of 7).

Python quick start

from transformers import pipeline

clf = pipeline("text-classification", model="halilneed/turkish-prompt-injection-classifier")
scores = {d["label"]: d["score"] for d in clf("Önceki mesajımdaki formatı unut, bu sefer tablo olarak yaz.", top_k=None)}
is_injection = scores["INJECTION"] >= 0.05
# v1 instead: pipeline(..., revision="v1")

The repository also ships detect.py and guard.py: a Detector that classifies the text and its decoded forms and returns the highest score, which forms were decoded, and which one set the score. The decoder adds under 1 ms per text.

Measured speed for v2: 35.0 ms per text on average, 55.7 ms at the 95th percentile, at batch size one on an Intel i5-12400F with eight threads, for texts of 119 characters on average. Text beyond 512 tokens is cut off, so classify long documents in chunks and flag the document if any chunk is INJECTION.

This is one layer. Keep an agent’s tools on least privilege, ask for confirmation before irreversible actions, and treat retrieved content as data whatever the model says.

Training data

No new attack text was written for this model. Attacks come only from public datasets.

• Turkish: 3nesdeniz/turkish-conversation-prompt-injection (CC-BY-4.0; 120 attacks, 510 benign), 3nesdeniz/turkish-prompt-injection-1k (CC-BY-4.0; 471 attacks, 416 benign), beratcmn/turkish-prompt-injections (Apache-2.0; 199 attacks, 300 benign). Train and validation splits only.
• English (v2): 3nesdeniz/agentic-prompt-injection-5k and agentic-prompt-injection-boundary-pairs (CC-BY-4.0; 5,350 rows, 2,950 attacks).
• My own benign text: about 3,000 synthetic Turkish business texts from the training splits of my KVKK and BSEBY classifiers, and about 1,500 masking instructions from the training split of my PII model.
• Obfuscation augmentation (v2). Letter spacing, separators, leetspeak, Cyrillic look-alikes, reversal and case changes, applied to existing rows of both classes with the same probability, so that odd spelling alone does not mean “attack”.
• Not used, on purpose: a multilingual set whose Turkish rows are the fevzi test set, a multilingual translation of deepset that would leak the berat test, a CC-BY-NC-SA set, and sets without a licence.
• Method (v2). Full fine-tune of mmBERT-base, 3 epochs, learning rate 3e-5, bfloat16, up to 384 tokens, one RTX 5060 Ti. Checkpoint chosen on a Turkish development split (dev F1 0.955).

Limitations

• The test sets are small: 30, 79 and 59 attacks. One or two rows move F1 by several points, and two training seeds of the same recipe differed by 0.056 mean F1.
• All Turkish sources are synthetic or translated. None is a sample of real production traffic.
• The model reads one piece of text at a time. It does not see the conversation, the system prompt or which tool the text came from.
• It is not a content moderation model. A harmful request without any manipulation is BENIGN by design.
• Not compared: Llama Prompt Guard 2 (gated, no access) and a scikit-learn Turkish detector that does not load in transformers.

Türkçe prompt injection sınıflandırıcısı

turkish-prompt-injection-classifier, bir LLM’e giren Türkçe metni BENIGN (zararsız) ya da INJECTION olarak işaretleyen küçük bir sınıflandırıcıdır. v2, açık bir test setindeki 13 kodlanmış saldırının 13’ünü (v1: 5) ve görünmez Unicode ile gizlenmiş talimatların %95’ini (v1: %40) yakalar. Zararsız Türkçe metinde yanlış alarm oranı en fazla %1,7’dir.

Görmediği bir kaynaktan gelen konuşma ve ajan saldırılarında v1’den zayıftır. Bu sizin için önemliyse revision="v1" ile v1’i kullanın. Tek başına bir savunma değildir.

Links

• Model card and weights
• Turkish prompt injection benchmark and its false-alarm set
• Turkish PII detection and masking
• Turkish KVKK classifier
• Turkish BSEBY classifier
• All models