Sentry is testing a small classifier to screen for prompt injection more cheaply

A speaker from Sentry told Cloudflare Connect 2026 that the company is moving toward small classifiers for one narrow judgment: spotting prompt injection. The talk is on the Cloudflare Developers show. The speaker also said a classifier alone is not enough. Prompt injection means hiding instructions in text so an AI follows them.

What was said

Sentry takes in untrusted error data from customers. Agents that read it can be fooled by planted instructions. In early tests, the speaker said, "frontier models, no matter how smart, were very, very capable of running these instructions unchecked and very happy about it." Real attacks are rare. The speaker put them at about 100 malicious events a day, among hundreds of millions processed.

The design is a cheap screen that feeds a strict reviewer, a Sonnet pass. The screen takes text and outputs a number from zero to one for how malicious it looks. Small general models, which the speaker called decision models, cost about three times less than the cheapest large model Sentry had used. The speaker said, "It beats all the LLMs." Even so, the cost would still be too high at 100 times the volume.

Some cheaper models caught every attack but also flagged many harmless issues. That would send far more items to the strict reviewer. The speaker gave half a million as the figure for a comparable load, but the transcript does not say what unit that is.

Sentry then tried text encoders of about 150 million parameters. Smaller decision models run to a couple of billion. An encoder splits text into tokens, runs attention layers and outputs a number. After fine-tuning, one scored above 90% accuracy. That was short of the goal, because the data gathering and labeling loop was not built. It is being shadow tested.

The speaker gave 12K as a cost for a similar load, with no period stated. The speaker hoped that at 100 times the load they could escape a million-dollar bill. The speaker expected these models to be much cheaper and faster, if accuracy matches.

Why it matters

Our reading: the scarce skill here is judging, not building. A model can score text, but people must decide what counts as malicious and label examples. The speaker said the labeling loop was not built. The speaker also said, "The problem is cases we don't know." Staff for that work, not only for model tuning. When buying a screening tool, ask what it costs at 100 times the volume. Ask how many harmless items it flags. Ask who keeps its labels current.

The other side

The speaker was direct that this is not a full answer. Asked whether one classifier on all untrusted input is a good approach, the speaker said it is not enough. It should be combined with other signals, such as checking a package that an input asks to install.

The evidence is also incomplete. Accuracy is below target, and the encoder's cost is a projection with no stated period. Self-hosting on rented GPUs adds work. The claim of beating all large models was made for decision models, not the encoder.