SIGNAL
The safety stack for agentic AI is splitting along an axis nobody in procurement talks about. The assumption that a bigger general model makes a safer filter is breaking on the attack class that now costs the most: prompt injection. Signature detection is not generation; the right tool is a calibrated narrow classifier, not an 8-billion-parameter generalist.
The Semalith v1.4 paper documents the split. Against Meta's Llama-Guard-3-8B, the 184M-parameter DeBERTa-v3-base wins seven of seven prompt-injection benchmarks at 44x fewer parameters. The deployment-driving number is the false-positive rate: on 208 benign agentic prompts, Semalith v1.4 records 0.000; Llama-Guard-3-8B records 0.063. In an agent loop, that gap is the difference between a guardrail that runs inline and one that blocks real work.
The boundary is built in. Llama-Guard-3 still leads on general-harm benchmarks (WildGuardMix, HEx-PHI, HarmBench), and the paper discloses six weak spots and recommends Semalith v1.3 for conversational moderation. The honest deployment is both: a specialized small classifier for prompt injection, a general large model for general harm, unified in a single forward pass.
The mechanism is repeatable. Any narrow attack class that resolves to a fixed taxonomy is now a candidate for the specialized-and-calibrated pattern. The wire will say "small model beat big model." The real story is that scale was never the lever; calibration on a narrow axis was. The causal relationship between calibration methodology and prompt-injection performance is inferred from the benchmark results; no independent ablation of the calibration variable was cited.