Detection is not defense: we measured our own injection classifier on novel attacks

Everyone quotes a prompt-injection benchmark number. We ran ours against attacks it had never seen (40% recall on the held-out set) and we're publishing it, because the authorization layer is what actually stops the attack.