Evaluating Prompt Injection Defenses for Educational LLM Tutors: Security-Usability-Latency Trade-offs

Synthesis: This paper addresses a fundamental tension in educational LLM deployment: tutors must be both secure (resist prompt injection attacks) and usable (not block legitimate educational interactions). The author presents a systematic evaluation methodology using a 480-query benchmark (369 injection, 111 benign) with statistically rigorous comparison.

Defense methods compared:

The proposed pipeline combines deterministic pattern filters, structural validation, contextual sandboxing, and session-level behavioral checks. Its design prioritizes pedagogical usability — zero false positives means no legitimate student queries get blocked, an essential requirement for Intelligent Tutoring systems where interruptions harm learning.

NeMo Guardrails blocks all attacks but incorrectly flags ~16% of benign requests — a rate that would seriously degrade the Student Experience in real tutoring sessions. Prompt Guard provides middle-ground performance.

The framework enables evidence-based guardrail selection under institutional risk and usability requirements. This directly connects to SafeTutors: Benchmarking Pedagogical Safety in AI Tutoring Systems concerns and the emerging field of Pedagogical Safety in Educational Reinforcement Learning. The latency dimension is particularly important for real-time The Path to Conversational AI Tutors: Integrating Tutoring Best Practices and Targeted Technologies to Produce Scalable AI Agents where response delays degrade engagement.

The paper highlights that educational settings have unique requirements: false positives are more costly than in general-purpose chatbots, because blocking a student's learning interaction carries pedagogical harm. This aligns with findings in Sycophancy is an Educational Safety Risk: Why LLM Tutors Need Sycophancy Benchmarks that educational safety requires domain-specific benchmarks.

What this means for practice

• Instructors. Do not let a guardrail's presence stand in for safe task design: even the multi-layer pipeline left 46.34% of injections successful (198 of 369 blocked), so pair deployment with assessment that cannot be satisfied by pasted model output.
• Designers. Choose guardrails on measured false-positive cost rather than attack blocking alone — NeMo Guardrails stopped every attack but flagged 16.22% of benign student queries, and in a tutor those blocks are pedagogical harm.
• Designers. Use low-latency in-line filtering for interactive sessions: the pipeline averaged 2.50 ms against more than 1.4 s for NeMo Guardrails, a delay that would break conversational flow in a tutoring dialogue.
• Administrators. Make procurement decisions on the full security-usability-latency trade-off, since the pipeline's 0.00% false positive rate (111 of 111 benign queries passed) is what preserves the Trust students place in the tool.

Limitations

• The benchmark is 480 synthetic queries (369 injection, 111 benign) produced by an LLM-assisted pipeline, so real student interactions may show different textual distributions and obfuscation strategies.
• Evaluation used an offline single-turn protocol, so the Layer 4 session-level behavioral heuristics register zero blocks by design and could not be measured directly.
• It targets one deployment context, a programming tutor in English and Portuguese, leaving transfer to subjects such as math and science unverified.
• No user-centric outcomes were measured (perceived helpfulness, trust, or learning gains) because no live student or educator study was run, and the robustness sweep covered only 10 seeds.

Citation

Maiorano, A. C. (2026). Evaluating prompt injection defenses for educational LLM tutors: Security-usability-latency trade-offs.