Llama Prompt Guard 2

weights

open(Llama-Prompt-Guard-2-86M/22M on HF)

data

not-released

license

Llama-4-Community(NOT OSI)

Weights for both sizes download after an access request under Meta's Llama 4 Community License, which restricts use and is not OSI-approved. The card describes the training mix of public and synthetic data but does not release it.

• https://huggingface.co/api/models/meta-llama/Llama-Prompt-Guard-2-22M recorded 2026-09-29

  The Hugging Face API record for meta-llama/Llama-Prompt-Guard-2-22M tags it "license:other" under the "LLAMA 4 COMMUNITY LICENSE AGREEMENT" gated prompt, sets gated to manual, and lists "model.safetensors" among its files, so the smaller checkpoint ships downloadable weights on the same terms as the 86M model.

• https://huggingface.co/api/models/meta-llama/Llama-Prompt-Guard-2-86M recorded 2026-09-29

  The Hugging Face API record for meta-llama/Llama-Prompt-Guard-2-86M tags the repo "license:other" with license_name llama4, embeds the "LLAMA 4 COMMUNITY LICENSE AGREEMENT" as its gated prompt, sets gated to manual behind a form ending "By clicking Submit below I accept the terms of the license", and lists "model.safetensors" among its files. Searched the body for datasets and dataset: tags: none, so no training set is declared.

• https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M recorded 2026-09-29

  The model card carries the Llama 4 license text, which requires a separate Meta license where users exceed "greater than 700 million monthly active users in the preceding calendar month". It describes the training data only in prose, "The training dataset is a mix of open-source datasets reflecting benign data from the web" plus "our own synthetic injections and data from red-teaming earlier versions of Prompt Guard", and links no dataset release; the only training-related link is a cookbook notebook, "Access our tutorial for fine-tuning Prompt Guard on custom datasets", not the data Meta trained on.

Adoption is read from Hugging Face downloads for the one published checkpoint, meta-llama/Llama-Prompt-Guard-2-86M. The smaller 22M variant is not separately counted, so the reading reflects only the larger model's downloads.

• https://huggingface.co/api/models/meta-llama/Llama-Prompt-Guard-2-86M recorded 2026-08-13

  111,334 downloads in the trailing 30 days for meta-llama/Llama-Prompt-Guard-2-86M

Llama Prompt Guard 2 detects prompt injection and jailbreaks with high recall at a low false-positive rate and classifies a prompt in under 100 ms on an A100. It flags only known attack patterns, so it complements a full-taxonomy content guard rather than replacing it.

• https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M recorded 2026-09-29

  The card frames the models as detecting "explicit, known attack patterns, labeling prompts as" benign or malicious, with a table of "AUC (English)", "Recall @ 1% FPR (English)" and "Latency per classification (A100 GPU, 512 tokens)" where the 86M model reads ".998", "97.5%" and "92.4 ms" and the 22M model "88.7%" and "19.3 ms". It states "Both Llama Prompt Guard 2 models support a 512-token context window" and were evaluated in "English, French, German, Hindi, Italian, Portuguese, Spanish, and Thai".

• https://pypi.org/pypi/llamafirewall/json recorded 2026-09-29

  The PyPI record for llamafirewall lists PromptGuard 2 among its core components as "A fast, lightweight BERT-style classifier that detects direct prompt injection attempts" and wires it in through "Initialize LlamaFirewall with Prompt Guard scanner".