Abstract
Detectors for prompt injection attacks emit scores, but source-selected thresholds can become permissive or unusable under distribution shift. We introduce regime-adaptive drift-triggered conformal recalibration (RA-DTCR), a stateful controller for frozen guardrails. Label-hidden monitors compare against the deployed regime under horizon-wide error spending. Triggers refresh that reference from monitors, purchase disjoint labeled calibration windows for benign-score references, and convert scores to one-sided conformal p-values. Benign-score exchangeability gives marginal false-positive control at α; conditionally valid monitor p-values bound the probability of any unnecessary label acquisition over T windows by δ, without test independence. Similarity shield, ProtectAI-v2, and PIGuard evaluations cover four non-overlapping public targets (5,629 examples; 100 overlapping split-sensitivity runs per pair). Frozen thresholds fail both ways; one-shot recalibration yields mean false-positive rates 0.045–0.052 but triggers in every evaluated transfer. Constructed twelve-window prequential streams include stable periods, five transitions, and recurrence. Against periodic target conformalization, RA-DTCR saves 63.9–69.0% labels, with pooled mean false-positive rates 0.045–0.059 (periodic: 0.046–0.049) and recall changes −0.011 to +0.036. It detects 74.4–86.6% of transitions within two windows, with no unnecessary acquisitions in evaluated stable windows. These are ordered public regimes, not timestamped production logs. A three-stage enterprise guardrail motivates the study; scores, splits, tests, and code are released.