Semalith v1.4: Llama-Guard-3-8Bの44分の1のパラメータ数で最先端のプロンプトインジェクション検出を実現した184Mキャリブレーション済み安全分類器Semalith v1.4: A Calibrated 184M Safety Classifier Achieving State-of-the-Art Prompt-Injection Detection at 44x Fewer Parameters than Llama-Guard-3-8B

Prompt injection has emerged as one of the most persistent security concerns for applications built on large language models, and a newly published paper introduces Semalith v1.4, a compact classifier designed to detect such attacks at a fraction of the usual computational cost. The work matters because safety filtering is increasingly deployed on every request flowing through an LLM system, meaning the size and efficiency of the guardrail model directly affect latency, infrastructure spending, and how broadly protection can be applied.

According to the paper, Semalith v1.4 is a 184-million-parameter safety classifier that matches or surpasses Meta's Llama-Guard-3-8B on prompt-injection detection while using roughly 44 times fewer parameters. The central claim is not that a small model can approach a large one within some acceptable margin, but that on this specific task it reaches state-of-the-art detection quality outright. If the reported results hold up under independent evaluation, they would support a broader thesis that narrowly scoped safety tasks do not necessarily require the full capacity of a general-purpose guard model.

Prompt injection refers to a class of attacks in which adversarial instructions are embedded in user input, retrieved documents, or tool outputs in an attempt to override a model's intended behavior. Because these attacks exploit the way LLMs blend instructions and data, they are difficult to eliminate at the model level alone, and many production systems rely on a separate classifier to screen incoming and outgoing text. A dedicated detector that is small enough to run cheaply is therefore attractive, since it can be placed inline without adding significant overhead to each interaction.

A notable emphasis in the paper is the word "calibrated" in the model's description. Calibration measures how closely a classifier's predicted probabilities align with real-world outcomes, so that a score of, for example, 0.9 corresponds to a genuine 90 percent likelihood of an injection attempt. Well-calibrated confidence scores are valuable in safety pipelines because operators frequently set thresholds to balance false positives against missed attacks, and they may route borderline cases to stricter review or human oversight. A model that is both accurate and calibrated gives engineers finer control over that trade-off than accuracy figures alone would suggest.

The comparison point, Llama-Guard-3-8B, is part of Meta's Llama Guard family, a widely referenced open series of moderation and safety models built on the Llama architecture. These models are designed to classify prompts and responses across multiple hazard categories, making them general-purpose tools rather than specialists. Semalith appears to take the opposite approach, trading breadth for a focused, efficient design targeting prompt injection specifically. That distinction is important context: a like-for-like parameter comparison can favor the smaller model when the task is narrower, and readers should be cautious about extrapolating the efficiency gains to every safety category a larger guard model covers.

The broader industry trend the paper fits into is the push toward smaller, task-specialized models for classification and moderation work. Organizations running LLM services at scale face meaningful costs when a multibillion-parameter guard model must evaluate every message, and alternatives such as distillation, fine-tuned encoder models, and compact classifiers have all been explored to reduce that burden. Related efforts across the field include guardrail frameworks, open moderation datasets, and adversarial benchmarks intended to stress-test detectors against evolving injection techniques. Semalith v1.4 is positioned within this ecosystem as evidence that lightweight models can carry more of the load than previously assumed.

Several caveats are worth keeping in mind. Prompt-injection detection is an adversarial problem, and benchmark performance does not guarantee robustness against novel or deliberately crafted attacks that fall outside the training distribution. The strength of any such claim also depends heavily on the evaluation data, the diversity of attack types represented, and whether the comparison was conducted under matched conditions. As with many arxiv preprints, the results have not necessarily undergone peer review at the time of publication, so independent replication will be important before the efficiency claims are treated as settled.

Even with those qualifications, the reported result is a useful data point for teams weighing the cost of safety infrastructure. If a 184M-parameter model can reliably flag prompt-injection attempts, it lowers the barrier to placing protective filtering closer to users and across more of a system's surface area, which is likely to appeal to developers operating under tight latency and budget constraints.