Not All Models Are Equal: Model Selection and Rotation as Moving Target Defense Against Prompt Injection

Prompt injection remains a fundamental vulnerability in Large Language Model (LLM) deployments, with recent work demonstrating that existing defenses can be bypassed with over 90 filtering, output validation, and architectural separation, no prior work has systematically examined how the choice of defender model itself affects defense outcomes. We present an empirical study of model-level Moving Target Defense (MTD) against prompt injection, testing five local LLMs (1B–9B parameters) as defenders against both static and adaptive attacks from Gemini 2.5 Flash. Our experiments reveal three key findings: (1) defense rates vary dramatically across models (0 selection may be a more impactful defense lever than commonly studied techniques; (2) rotation among heterogeneous models provides no benefit against static (non-adaptive) attacks, where defense rate is determined entirely by pool composition; and (3) including weak models in a defense pool actively degrades overall defense, contradicting the conventional MTD assumption that diversity is inherently beneficial. We discuss the limitations of our experimental setup, including the constrained attack strength relative to state-of-the-art optimization-based methods, and position our findings as an initial empirical contribution to an underexplored dimension of LLM security