SusFactor: Detecting Jailbreak and Prompt Injection Attacks Using Real-World Threat Intelligence

We have released the paper describing SusFactor, a 560M-parameter binary classifier for jailbreak and prompt-injection detection, trained on a mixture of public datasets and proprietary real-world attack data from the 0DIN Threat Feed 0DIN THREAT FEED Real-time intelligence and alerts on emerging GenAI vulnerabilities and security threats. Explore Threat Feed . It takes a user prompt as input and outputs a suspiciousness score between 0 and 1, where a higher score indicates that the model is more confident that the prompt has malicious intent. It achieves the highest pooled AUROC on JailbreakBench (0.954) among classifiers we evaluated and ranks competitively on WildGuardTest (0.878) against generative guards 10 to 15 times its size. This post summarizes the paper's methodology, results, and findings.

The detector landscape

The guardrail ecosystem offers three families of detectors. Moderation APIs score content against fixed harm taxonomies. Generative guards use instruction-tuned LLMs (7 to 8 billion parameters) to reason about policy violations, but carry higher compute requirements and per-call latency. Lightweight fine-tuned classifiers prioritize low inference cost.

A pattern of specialization emerges. Technique-oriented injection detectors degrade on semantically natural jailbreaks: Prompt Guard 2 scores 0.657 AUROC on WildGuardTest, ProtectAI DeBERTa-PI scores 0.549, near random. Taxonomy-based moderation misses attack-technique jailbreaks (OpenAI Moderation, 32.8% ASR on JailbreakBench). Open-source safety classifiers draw from a small, heavily overlapping pool of public datasets, leaving shared blind spots. SusFactor sits in the lightweight classifier category.

The 0DIN Threat Feed 0DIN THREAT FEED Real-time intelligence and alerts on emerging GenAI vulnerabilities and security threats. Explore Threat Feed

0DIN AI operates a vulnerability management platform where security researchers submit jailbreak attacks against production LLMs through a bug bounty program. These submissions differ from synthetic and academic datasets in four ways:

• Adversary skill level. Submissions come from researchers with expertise in LLM exploitation, not automated tools or crowd workers.
• Production targeting. Attacks target deployed systems with real safety training.
• Technique diversity. GCG-style suffixes, persona hijacks, multi-turn escalation, encoding-based obfuscation, structured payload injection, and novel techniques absent from public datasets.
• Temporal currency. The feed reflects the current attack landscape, including techniques developed against the latest safety improvements.

The training snapshot is 3,426 attacks, quality-filtered (minimum 20 characters, exact-text deduplication), all labeled malicious. Every training text was checked against benchmark data to rule out contamination.

Model and training data

SusFactor uses a 560M-parameter multilingual E5 encoder (XLM-RoBERTa-Large architecture): 24 transformer layers, 1024 hidden dimensions, 512-token context window. The classification head applies mean pooling over all token embeddings, followed by a two-layer MLP (1024 to 256 to 2) with GELU activation, dropout, and softmax. The encoder is initialized from a model we had previously fine-tuned on a jailbreak similarity task for our internal deduplication system. On a consumer Apple M2 Pro CPU (4 threads, fp32), median latency is 63 ms at roughly 32 tokens, 116 ms at roughly 129 tokens, and 328 ms at the full 512-token context window.

The training corpus comprises 68,935 examples:

Source	Count	Label
WildJailbreak	15,000	malicious
0DIN Threat Feed 0DIN THREAT FEED Real-time intelligence and alerts on emerging GenAI vulnerabilities and security threats. Explore Threat Feed	3,426	malicious
jackhhao/jailbreak	513	malicious
WildJailbreak	25,000	non-malicious (hard negatives)
WildChat-1M	24,996	non-malicious (benign)
Total	68,935

The class split is deliberate: 28% malicious, 72% non-malicious, reflecting the importance of hard negatives for false positive reduction. Training uses class-weighted cross-entropy with sqrt-proportional oversampling (threat feed sampled roughly 2x more per epoch). The corpus is PII-scrubbed with Microsoft Presidio.

How we evaluated

We report three metrics. ASR (attack success rate): the fraction of genuine attacks that slip past undetected; lower is better. FPR (false positive rate): the fraction of benign prompts wrongly flagged. AUROC: how well scores separate the two classes across all thresholds; higher is better. All systems were evaluated at a fixed 0.5 threshold with no per-model tuning.

JailbreakBench adaptation. The benchmark was designed to evaluate generative target models, so we repurposed its pre-computed attack artifacts as a labeled prompt-classification set. Labeling failed jailbreak attempts as benign is unsound: a failed jailbreak still contains harmful content a guardrail should flag. We use a matched construction where positives are successful attacks only and negatives are the 100 genuinely benign JBB-Behaviors prompts. Pooled across four attack configurations (GCG, PAIR, DSN-vicuna, DSN-llama), this gives 338 attacks. Confidence intervals from stratified bootstrap, 1,000 iterations.

WildGuardTest adaptation. We retained only the prompt-harmfulness task and dropped items with null labels, yielding 1,699 examples including 455 adversarial-benign hard negatives.

Results

JailbreakBench (pooled, all attack configurations):

Classifier	AUROC	ASR	FPR	Type
WildGuard (7B)	n/a	1.2%	45.0%	gen. guard
Llama Guard 3 (8B)	n/a	7.1%	23.0%	gen. guard
Mistral Mod.	0.887	7.7%	39.0%	mod. API
SusFactor	0.954	12.1%	9.0%	classifier
Prompt Guard 2	0.946	23.7%	4.0%	classifier
OpenAI Mod.	0.834	32.8%	17.5%	mod. API

WildGuardTest:

Provider	AUROC	Recall	FPR	Benign Acc
Mistral Mod.	0.906	0.800	0.133	0.910
WildGuard (7B)	0.898	0.850	0.054	0.976
SusFactor	0.878	0.744	0.122	0.990
Llama Guard 3 (8B)	0.807	0.651	0.038	0.980
OpenAI Mod.	0.771	0.442	0.085	0.959
Prompt Guard 2	0.657	0.276	0.098	0.986
ProtectAI DeBERTa-PI	0.549	0.312	0.245	0.996

SusFactor leads pooled JailbreakBench AUROC at 0.954, though Prompt Guard 2's confidence interval [.922, .965] overlaps ours [.933, .972], so we do not claim a significant win on that metric. On WildGuardTest, SusFactor ranks third behind Mistral Moderation and WildGuard, with near-best benign accuracy (0.990).

SusFactor's per-attack ASR is nearly uniform across methods (GCG 0.125, PAIR 0.116, DSN-vicuna 0.126, DSN-llama 0.117), indicating detection of adversarial intent rather than surface technique. By contrast, Prompt Guard 2 misses roughly 80% of PAIR attacks (0.797 ASR) while reaching 0.021 ASR on DSN, which contains detectable surface-level artifacts.

The threat feed ablation

We compared the production model against an otherwise-identical variant trained without the 3,426 threat feed examples:

Model variant	JBB AUROC	JBB ASR	WGT AUROC
Full (3,426 TF)	0.954	12.1%	0.878
No Threat Feed	0.733	77.5%	0.800

Without the threat feed, 262 of 338 attacks bypass the guardrail, a 6.4x increase. The regression concentrates on suffix-based attacks: 95.8% ASR on DSN-vicuna (AUROC 0.544), 86.3% on GCG, 85.1% on DSN-llama, while PAIR degrades less (11.6% to 31.9%) because it is better represented in public data. WildGuardTest degrades less because it shares a distribution with WildJailbreak training data. The ablated model's 1.0% FPR is degenerate, not an improvement: it reflects a model that has largely stopped flagging.

Deployment and threshold calibration

At the default 0.5 threshold, the production model has roughly 9% FPR on JailbreakBench benign prompts and 12.2% on WildGuardTest. Precision depends heavily on attack prevalence: SusFactor reaches 50% precision at 9.3% attack prevalence, and at 1% prevalence precision is about 9%, meaning roughly nine of ten alerts are false. This base-rate effect hits every classifier, and the only remedy is raising the threshold.

On WildGuardTest, SusFactor's break-even prevalence is 14.1%, competitive with Mistral Moderation at 14.3% but behind Llama Guard 3 at 5.5% and WildGuard at 6.0%. We recommend a per-customer calibration and a two-stage pipeline: auto-block above a strict threshold, and route medium-confidence inputs to human review.

We provide a guide to setting the threshold for your deployment in our docs.

Limitations and future work

• Indirect prompt injection is out of scope and is the top priority, with plans to add document-embedded injection examples in simulated retrieved documents, tool outputs, and structured formats.
• 512-token context window. Injections deeper in longer documents are not detected.
• Training data oriented toward jailbreaks with limited direct prompt-injection coverage.
• English-only. Cross-lingual transfer unvalidated.
• Latency measured on one consumer laptop CPU.
• Per-customer calibration required for production deployments.
• Designed for periodic retraining on a monthly or quarterly cadence.
• Planned exploration of chunking with aggregation and longer-context backbones.
• Evaluation code to be released as open source. The Threat Feed is proprietary, so full pipeline reproduction is not possible, but independent benchmark verification will be.

For the full methodology, per-attack breakdowns, and confidence intervals, see the paper. If you would like to try SusFactor on your own traffic, the early-access beta is available at 0din.ai/susfactor-trial.