What is Llama Prompt Guard 2?
Llama Prompt Guard 2 is a pair of small text classifiers from Meta that flag prompt injection and jailbreak attempts. The 86M model is built on Microsoft's multilingual mDeBERTa base; the 22M model, on DeBERTa-xsmall, is the fast option, with Meta saying it cuts latency and compute costs by 75% for a small loss in accuracy. Both return one of two labels, benign or malicious, with a score.
They read 512 tokens at a time, so longer documents need splitting into chunks that are scanned in parallel. Meta evaluated them in English, French, German, Hindi, Italian, Portuguese, Spanish and Thai, though only the 86M has a multilingual base. A prompt is flagged when it explicitly tries to override earlier instructions, whether or not it would cause harm, which makes it a check for untrusted text such as web pages and tool output as well as user messages.
The weights are under the Llama 4 Community License and gated on Hugging Face. The models were published with the Llama 4 collection in April 2025 and are part of Meta's LlamaFirewall framework. The 86M model was downloaded 101,122 times in the last month.
How much does Llama Prompt Guard 2 cost?
| Plan | Price | What you get |
|---|---|---|
| 86M | Free | Multilingual base, higher accuracy |
| 22M | Free | Faster: 19.3 ms per 512 tokens on an A100 |
Free open weights under the Llama 4 Community License, gated on Hugging Face; self-hosted only, in 86M and 22M sizes.
Is Llama Prompt Guard 2 worth it?
Prompt Guard 2 does one thing and costs almost nothing to run. On Meta's private, out-of-distribution jailbreak set the 86M model catches 97.5% of attacks at a 1% false-positive rate, against 21.2% for the first Prompt Guard; the 22M model catches 88.7%. Latency on an A100 at 512 tokens is 92.4 ms for the 86M and 19.3 ms for the 22M.
The agent results are the more useful number. On AgentDojo, at a 3% cost in task completion, the 86M stops 81.2% of attacks and the 22M 78.4%, while older open detectors from ProtectAI and Deepset stop 22.2% and 13.5%. In Meta's LlamaFirewall paper, putting the 86M in front of tool output cut attack success from 17.6% to 7.5%.
The limits are stated in the card. It sees 512 tokens, so a long retrieved page has to be chunked and an attack split across chunks can slip through. It flags instruction-like text, not harm, so documentation that quotes "ignore previous instructions" will trip it. Meta warns that attackers adapt to classifiers and that accuracy depends on what normal traffic looks like in your application, and recommends fine-tuning on your own data. The 22M model is noticeably weaker outside English.
It is also not open source in the strict sense: the Llama 4 Community License adds terms and the download is gated. For a team that needs Apache or MIT weights, that matters more than the benchmark.
Where it earns its place
A backend engineer adding web search to a customer support bot
Screen every fetched page for planted instructions before it reaches the model
Split each page into 512-token chunks, score them in parallel with the 22M model and drop or quarantine chunks labelled malicious. At about 19 ms per chunk on a GPU it adds little to a search call.
A platform team at a European insurer serving users in several languages
Block jailbreak attempts in French, German, Italian and Spanish chats
Run the 86M model, which has the multilingual base, on each user turn; set the threshold from a few hundred real benign messages per language, since Meta warns accuracy depends on your traffic.
An ML engineer with a labelled set of past attacks on their product
Cut false positives on technical content that quotes prompts
Fine-tune the 86M model on your own benign and malicious examples, as the card recommends, and compare recall at 1% false positives before and after.
Before you commit
- Setup
- Accept the Llama 4 licence on Hugging Face, then load meta-llama/Llama-Prompt-Guard-2-86M or -22M with the Transformers text-classification pipeline; first result in minutes.
- Integrations
- Transformers; used as the PromptGuard scanner inside LlamaFirewall, which has OpenAI Agents SDK and LangChain examples.
- Data and privacy
- Self-hosted, so text never leaves your machines. Weights under the Llama 4 Community License, gated behind Meta's terms.
- Cost at scale
- No API fee. Both models are small next to any LLM they protect; a long document costs one pass per 512-token chunk.
- Limits
- Binary benign or malicious label only; 512-token context; vulnerable to adaptive attacks; the 22M model is weaker outside English.
What’s good
- 97.5% recall at 1% false positives on Meta's jailbreak set (86M)
- 19.3 ms per 512 tokens on an A100 for the 22M model
- 81.2% of AgentDojo attacks stopped at a 3% utility cost (86M)
- Small enough to run beside every tool call
What’s not
- 512-token window; long inputs must be chunked
- Flags instruction-like text, not harmful content
- Benchmarks are Meta's own, partly on a private set
- Llama 4 Community License and gated download
Best for
Teams that want a fast, self-hosted check for injected instructions on user input, retrieved documents and tool results.
Llama Prompt Guard 2 alternatives
Llama Prompt Guard 2: common questions
- Is Llama Prompt Guard 2 worth it?
- A cheap first filter for injected instructions that every agent pipeline can afford, as long as nobody mistakes it for the whole defence. We rate it 4.2 out of 5.
- How much does Llama Prompt Guard 2 cost?
- Free open weights under the Llama 4 Community License, gated on Hugging Face; self-hosted only, in 86M and 22M sizes.
- What are the downsides of Llama Prompt Guard 2?
- 512-token window; long inputs must be chunked; flags instruction-like text, not harmful content; benchmarks are Meta's own, partly on a private set; llama 4 Community License and gated download.
- Who is Llama Prompt Guard 2 best for?
- Teams that want a fast, self-hosted check for injected instructions on user input, retrieved documents and tool results.
- How much does Llama Prompt Guard 2 cost for a team or in production?
- No API fee. Both models are small next to any LLM they protect; a long document costs one pass per 512-token chunk.
- Is Llama Prompt Guard 2 safe for company data?
- Self-hosted, so text never leaves your machines. Weights under the Llama 4 Community License, gated behind Meta's terms.
- What are the best Llama Prompt Guard 2 alternatives?
- The closest alternatives we have reviewed are GLiNER2.5-Decide, Shieldstral 1.0 3B and Laya.
Answers checked Nov 6, 2026.
Make Llama Prompt Guard 2? Show this rating on your site
