A detector at F1 0.98 misclassifies a third of security-adjacent benign prompts.

PIDS-Bench evaluates seven prompt-injection detectors at fixed thresholds across in-distribution inputs, hard-benign prompts that mimic injection structure, obfuscated attacks and domain shifts, scoring false positives as a first-class axis (arXiv 2609.15017). A detector exceeding 0.98 F1 on its held-out split still misclassifies about a third of an externally-sourced benign subset restricted to security content. Across a full threshold sweep and five seeds, no internal detector hit F1 ≥ 0.95 and hard-benign FPR ≤ 0.10 simultaneously. If your product's users talk about security, this detector class will fight them.