Interactive tool
Scanner Tradeoff Explorer
Set a false-positive, latency, cost and detection budget and see how AI-security scanner tradeoffs move against it. Illustrative curves, not measurements.
Reviewed October 2026. Each curve is a generic detector archetype, not a named product, and no figure on this page was measured. Move the sliders to set your operating budget; only archetypes with at least one threshold meeting every constraint survive. The scatter plots each surviving operating point on detection vs. false-positive axes and rings the Pareto-optimal set — the points no other point beats on both axes.
Operating points meeting your constraints
| Archetype | Deploy | Thresh | Detect % | FPR % | p95 ms | $/1k | Pareto |
|---|
Tools modelled (illustrative curves)
Small encoder classifier
Injection / jailbreak classifier · self-host · Open weights
A compact encoder of tens of millions of parameters running beside the app. Modelled with the lowest added latency of the model-based shapes and recall that plateaus on obfuscated or novel phrasing.
Mid-size encoder classifier
Injection classifier · self-host · Open weights
A fine-tuned encoder one size class up from the small one. Modelled as the middle ground on recall and latency, with false positives climbing on long benign instructions at low thresholds.
Generative safety classifier (8B class)
Safety classifier (LLM-based) · self-host · Open weights
An 8B-class language model that labels prompts and responses against a hazard taxonomy. Modelled with the highest recall of the self-hosted shapes and GPU-bound latency in the hundreds of milliseconds.
Hosted injection-detection API
Injection / jailbreak API · hosted-api · Commercial
A vendor-run injection and jailbreak detector called over the network. Modelled with the round-trip inside p95 and a flat per-call price.
Hosted content-moderation API
Output / content filter · hosted-api · Commercial (free tier)
A harm-category moderation endpoint pointed at injection traffic it was not built for. Modelled as free to call, with the weakest injection recall of the hosted shapes.
Multi-layer detection pipeline
Layered injection detector · self-host · Open source
Heuristics, a small model and an LLM check chained together. Modelled with latency and cost that step up once the threshold is low enough for the LLM layer to fire.
Rule-based filter
Heuristic / rule-based · self-host · Open source
Regex and keyword rules with no model behind them. Modelled with near-zero latency and cost, and the lowest recall against paraphrased attacks.
Methodology & caveats
Each card below is a detector archetype, a class of design rather than a named product, represented by an operating curve: a set of (threshold, detection, fpr, p95ms, costPer1k) points describing how a detector of that shape behaves as its decision threshold is swept. Detection = true-positive rate on an in-scope attack corpus; fpr = false-positive rate on a benign-traffic corpus; p95ms = 95th-percentile added latency per check; costPer1k = USD to screen 1,000 requests.
Illustrative figures. Nothing on this page was measured. This site runs no test lab, and these points are not a benchmark result from anyone: they are editorially constructed curve shapes for generic detector archetypes, sketched from typical design, model size, deployment mode and pricing model so the shape of the tradeoff can be reasoned about. No curve stands for a named product. Do not cite any figure here as a published, vendor or product result. Use it to decide what to measure, then measure the shortlist on your own corpus.
There is no corpus behind these curves, which is exactly why they cannot be compared with a real evaluation. A comparable result has to name its attack set, its benign set, the hardware or API path the latency was taken on, and the pricing basis behind the cost. Record those four things when you re-run this on your own traffic, or the numbers will not travel.
- Modelling assumption: hosted-API curves put the network round-trip inside p95; self-hosted curves assume no warm-batch advantage.
- Modelling assumption: cost for self-hosted open models is amortized GPU compute, not $0, because running a classifier still costs money.
- A point is Pareto-optimal when no other point (across all archetypes) has both higher detection and lower false-positive rate. That definition holds whatever the underlying numbers are.
- For real figures on a specific product, read the evaluation its maintainers or vendor published, check the corpus and conditions behind it, then re-run your shortlist on your own traffic.