Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection

Current open-source prompt-injection detectors converge on two architectural choices: regular-expression pattern matching and fine-tuned transformer classifiers. Both share failure modes that recent work has made concrete. Regular expressions miss paraphrased attacks. Fine-tuned classifiers are vulnerable to adaptive adversaries: a 2025 NAACL Findings study reported that eight published indirect-injection defenses were bypassed with greater than fifty percent attack success rates. This work proposes seven detection techniques that each port a mechanism from a discipline outside LLM security: forensic linguistics, materials-science fatigue analysis, deception technology, local-sequence alignment from bioinformatics, mechanism design, spectral signal analysis, and taint tracking. Three are implemented in the prompt-shield v0.4.1 release (Apache 2.0) and evaluated across six datasets (deepset/prompt-injections, NotInject, LLMail-Inject, AgentHarm, AgentDojo). The local-alignment detector lifts F1 on deepset from 0.033 to 0.378 with zero additional false positives on deepset's fifty-six benign samples; the same detector adds ten false positives on the 339-sample NotInject benign set (FPR 0.9%->3.8%), a specificity regression discussed in Section 5.4. The stylometric detector adds 11.1 percentage points of F1 on an indirect-injection benchmark. The fatigue tracker is validated via a probing-campaign integration test. Section 5.6 reports independent evaluation on three peer-reviewed benchmarks (Liu, USENIX Sec 2024; Garak, 2024; InjecAgent, ACL Findings 2024) totalling 8,276 attacks, using the regex-only baseline (d022, d027, d028 disabled). All code, data, and reproduction scripts are released under Apache 2.0.