SecGuard reports 94.5% injection recall, with a 23.4% false-alarm rate

SecGuard’s new security decision engine comes with an unusually useful tension in its own results: the author reports 94.5% recall for prompt injection, alongside a 23.4% false-positive rate. High detection in that held-out category therefore comes with many benign examples being flagged. These are author-run results, not an independent AITrending evaluation or a production accuracy guarantee.

The October 28 Hugging Face upload calls itself Security Decision Model v1.0.0, but explicitly says it is not a single neural network. It is a Python engine that combines normalization and de-obfuscation, source-aware rules, syntax-tree checks on generated SQL, checksum-based PII detection and optional transformer classifiers. Applications submit tagged segments, such as user input and retrieved documents, and receive an allow, sanitize, review or block decision with risk and reasons.

The published example downloads the repository with huggingface_hub, imports its Python package and loads config.json. This is an application integration, not a ready-made chat service or a new general-purpose model. The default configuration enables third-party classifiers, including Protect AI’s prompt-injection detector and SQLPromptShield. The card declares MIT licensing for the project while warning that the classifiers have separate licenses and limits; it also recommends pinning their revisions.

The tradeoffs vary sharply across tasks. The author’s held-out table reports 95.0% recall with a 0.6% false-positive rate for SQL injection, but only 21.6% recall for jailbreak safety. Its 2% false-positive tuning target should not be mistaken for a bound on the held-out results. The card describes English-centered rules and synthetic proxy tests, and recommends testing on an application’s own traffic before enforcing blocking decisions.

Configuration also matters when a model fails. The published default uses an ML failure mode of degrade, allowing other checks to continue when a classifier fails; a separate fail-closed setting does not mean every classifier failure blocks a request. SecGuard is worth examining as a composable decision layer with visible evaluation limits. Its own documentation says it does not replace least-privilege database roles, parameterized queries, egress controls or output encoding.