Rebuff vs Lakera vs InjectShield — open-source vs SaaS prompt injection defense

Rebuff (open-source, Protect AI): heuristics + vector-DB lookup of known injection strings + optional LLM-based check + canary tokens to detect exfiltration. Self-hosted; no per-request fee; maintenance has slowed; coverage strongest on direct injection, weaker on novel indirect/multi-turn.

Lakera Guard (SaaS): proprietary classifier models, frequently updated, low-latency, strong coverage across direct/indirect/jailbreak. Closed-source — you trust the vendor's benchmarks. Enterprise pricing; minimum contract typical; on-prem available on request.

InjectShield (hybrid OSS + paid semantic): heuristic ruleset open-source on GitHub (auditable, PR-able) covering direct/indirect/stored/jailbreak/role-confusion/tool-misuse; optional Anthropic Haiku semantic layer for nuanced cases (~$0.0002/req). MCP-native (@injectshield/mcp) plus REST API. Self-serve pricing, no minimum, dashboard at injectshield.dev/dashboard.

Choose Rebuff if you need free, self-hosted, and your traffic is low-novelty. Choose Lakera if you need a fully-managed enterprise contract with SLAs and your security team prefers a vendor relationship. Choose InjectShield if you want auditable heuristics, a cheap semantic upgrade path, MCP-first deployment, and pay-as-you-go economics.