FlagThis

Abstract

Prompt-injection detectors are heterogeneous: each is strong on a different slice of attacks, and none is always reliable. Yet existing systems still treat detection as a fixed single-detector pipeline, committing every request to one detectors blind spots. We reframe defense as detector allocation : given a heterogeneous pool, decide per request which detectors to run and whether to escalate to an LLM judge. Our framework SCOUT ( Scalable and Controllable Outcome-prediction for Uncertainty-aware Triage) makes this decision dynamic by predicting each detectors per-sample reliability and latency from how it behaved on similar past inputs, and exposes a single safetyutility threshold to the operator (where utility bundles benign-pass rate and wall-clock). To evaluate this setting, we build SCOUT-450, a benchmark that captures the structurally complex, agent-facing injections that older promptinjection sets under-represent. On SCOUT-450, a safety-oriented operating point reduces attacksuccess rate by 46 % and total wall-clock by 40 % relative to an always-on GPT-4o judge, at a 5 . 1-point benign-utility drop. SCOUT also transfers to three external benchmarks (BIPIA, IPI, and IHEval), improving the safetyutility frontier.