inference4j adds a local prompt-injection detector for Java apps
New source code wraps Protect AI's DeBERTa classifier with overlapping document windows; the detector is not yet in the latest packaged release.
A guard before the language-model call
Java developers have a new local option for checking user input and retrieved documents before passing them to a language model. An October 14 inference4j commit adds DebertaPromptInjectionDetector, backed by an ONNX export of Protect AI’s existing DeBERTa-v3 prompt-injection classifier. This is a library integration and model-format mirror, rather than a new model training announcement.
The API returns an InjectionCheck with a probability, threshold and injection flag. Longer documents are split into overlapping windows instead of being cut off at the first 512 tokens. By default, the highest-scoring window determines the document’s score; the overlap and decision threshold are configurable. That lets an application examine passages beyond the beginning of a retrieved document without asking a hosted model to classify them.
Available in source, with clear limits
The latest packaged release at review is still v0.13.1, published October 12. The detector arrived afterward, so installing that release does not provide this feature. Early adopters need the newer repository source; its README documents Java 17+ and ./gradlew build. The library and mirrored model declare Apache 2.0 licenses.
Inference runs locally through ONNX Runtime without a model-service API key, although the default model source downloads files on first use and caches them locally. The JVM needs the documented native-access permission. This is an application library, not an agent-harness plugin or a tool that automatically blocks agent actions.
The guardrail documentation narrows the default model’s role to English instruction overrides and system-instruction leakage. It explicitly excludes general jailbreak and harmful-content classification, warns about repeated-text false positives and says no classifier catches every attack. Its accuracy and latency figures are developer measurements. The supported news is a concrete Java integration to try, with least-privilege tools and output checks still needed around it.