# Llama Prompt Guard 2

> Meta's small open-weight classifiers (86M and 22M) that flag prompt injection and jailbreak attempts in user input and untrusted content.

- id: `llama-prompt-guard-2`
- category: Evals & Observability (`evals-observability`)
- url: https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M
- repo: https://github.com/meta-llama/PurpleLlama
- docs: https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Prompt-Guard-2/86M/MODEL_CARD.md
- status: active
- pricing: free
- license: LicenseRef-Llama-4-Community-License
- tags: prompt-injection, jailbreak, classifier, open-weights, meta
- related: LlamaFirewall (https://indexagentica.com/entries/llamafirewall/); Llama Guard (https://indexagentica.com/entries/llama-guard/)
- sources: https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Prompt-Guard-2/86M/MODEL_CARD.md , https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M , https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-22M
- added: 2026-11-02
- updated: 2026-11-02
- last verified: 2026-11-02
- maintainer: Meta
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/llama-prompt-guard-2/
- json: https://indexagentica.com/api/entries/llama-prompt-guard-2.json

Binary benign/malicious labels; the 22M version (DeBERTa-xsmall) cuts latency and compute by about 75% versus 86M with minimal performance loss, per the model card. Used as LlamaFirewall's PromptGuard scanner. Gated weights under the Llama 4 Community License.