List your company
ResearchFormerly WizWand

Adversarial Attack Success Rate Assessment on AgentDojo

0ASRChatInject
-3.2218.51540.2561.985Sep 26, 2025Oct 20, 2025Nov 13, 2025Dec 7, 2025Dec 31, 2025Jan 24, 2026Feb 18, 2026
Updated 6mo ago

Evaluation results

MethodLinks
ChatInjectTarget Model=Qwen2-Max, Defense=Injection Detector2026.020
ChatInjectTarget Model=DeepSeek-V3, Defense=w/o Defense2026.020
ChatInjectTarget Model=DeepSeek-V3, Defense=Injection Detector2026.020
GPT-ossPrompt=InjecPrompt, Technique=default2025.090.3
GLM-4.5Prompt=InjecPrompt, Technique=default2025.090.3
Llama-4Prompt=InjecPrompt, Technique=default2025.091
ChatInjectTarget Model=DeepSeek-V3, Defense=Delimiter Spotlighting2026.021.3
Llama-4Prompt=Multi-turn, Technique=default2025.091.8
PhantomTarget Model=Gemini-1.5-Flash, Defense=Injection Detector2026.022.6
PhantomTarget Model=Gemini-1.5-Flash, Defense=Tag Filter2026.023.25
Single-TemplateTarget Model=DeepSeek-V3, Defense=Tag Filter2026.023.25
ChatInjectTarget Model=DeepSeek-V3, Defense=Tag Filter2026.023.25
GPT-ossPrompt=Multi-turn, Technique=default2025.093.6
Single-TemplateTarget Model=Qwen2-Max, Defense=Injection Detector2026.024.55
Semantic-InjectionTarget Model=Qwen2-Max, Defense=Injection Detector2026.025.84
Kimi-K2Prompt=InjecPrompt, Technique=default2025.095.9
Grok-2Prompt=InjecPrompt, Technique=default2025.096.1
Single-TemplateTarget Model=DeepSeek-V3, Defense=Injection Detector2026.027.14
Semantic-InjectionTarget Model=DeepSeek-V3, Defense=Injection Detector2026.028.44
PhantomTarget Model=Gemini-1.5-Flash, Defense=w/o Defense2026.029.74
PhantomTarget Model=Gemini-1.5-Flash, Defense=Delimiter Spotlighting2026.0210.39
PhantomTarget Model=Qwen2-Max, Defense=Injection Detector2026.0211.04
Llama-4Prompt=Multi-turn, Technique=ChatInject2025.0911.1
Kimi-K2Prompt=Multi-turn, Technique=default2025.0912.3
PhantomTarget Model=Qwen2-Flash, Defense=Injection Detector2026.0212.34
PhantomTarget Model=GPT-4o, Defense=Injection Detector2026.0212.34
PhantomTarget Model=Gemini-1.0-Flash, Defense=Injection Detector2026.0213.64
ChatInjectTarget Model=Qwen2-Max, Defense=Tag Filter2026.0213.64
Kimi-K2Prompt=Multi-turn, Technique=ChatInject2025.0913.9
Single-TemplateTarget Model=Qwen2-Max, Defense=Tag Filter2026.0214.29
PhantomTarget Model=DeepSeek-V3, Defense=Injection Detector2026.0214.94
PhantomTarget Model=GPT-4o-Mini, Defense=Injection Detector2026.0215.58
Llama-4Prompt=InjecPrompt, Technique=ChatInject2025.0917.2
Qwen-3Prompt=InjecPrompt, Technique=default2025.0917.5
GLM-4.5Prompt=Multi-turn, Technique=default2025.0917.5
PhantomTarget Model=GPT-4, Defense=Injection Detector2026.0218.18
Semantic-InjectionTarget Model=Qwen2-Max, Defense=Delimiter Spotlighting2026.0218.18
Grok-2Prompt=InjecPrompt, Technique=ChatInject2025.0919.3
Llama-4Prompt=InjecPrompt, Technique=ChatInject + tool2025.0919.8
GLM-4.5Prompt=InjecPrompt, Technique=ChatInject2025.0920.3
Semantic-InjectionTarget Model=Qwen2-Max, Defense=Tag Filter2026.0220.78
PhantomTarget Model=Gemini-1.0-Flash, Defense=Tag Filter2026.0222.08
Grok-2Prompt=Multi-turn, Technique=default2025.0923.7
Semantic-InjectionTarget Model=Qwen2-Max, Defense=w/o Defense2026.0224.68
Grok-2Prompt=Multi-turn, Technique=ChatInject2025.0924.7
GLM-4.5Prompt=InjecPrompt, Technique=ChatInject + think2025.0924.8
ChatInjectTarget Model=Qwen2-Max, Defense=Delimiter Spotlighting2026.0225.32
Kimi-K2Prompt=InjecPrompt, Technique=ChatInject2025.0929.3
PhantomTarget Model=GPT-4o, Defense=Tag Filter2026.0231.17
ChatInjectTarget Model=Qwen2-Max, Defense=w/o Defense2026.0235.71
GLM-4.5Prompt=InjecPrompt, Technique=ChatInject + tool2025.0936
PhantomTarget Model=DeepSeek-V3, Defense=Tag Filter2026.0240.26
PhantomTarget Model=Gemini-1.0-Flash, Defense=Delimiter Spotlighting2026.0240.91
PhantomTarget Model=Qwen2-Max, Defense=Tag Filter2026.0241.56
Kimi-K2Prompt=InjecPrompt, Technique=ChatInject + tool2025.0944.2
Semantic-InjectionTarget Model=DeepSeek-V3, Defense=Tag Filter2026.0247.4
GPT-ossPrompt=InjecPrompt, Technique=ChatInject + tool2025.0947.4
GLM-4.5Prompt=Multi-turn, Technique=ChatInject2025.0948.1
GPT-ossPrompt=InjecPrompt, Technique=ChatInject + think2025.0948.6
PhantomTarget Model=Qwen2-Flash, Defense=Tag Filter2026.0250
GPT-ossPrompt=InjecPrompt, Technique=ChatInject2025.0951.4
Single-TemplateTarget Model=Qwen2-Max, Defense=Delimiter Spotlighting2026.0251.95
Semantic-InjectionTarget Model=DeepSeek-V3, Defense=w/o Defense2026.0252.6
PhantomTarget Model=GPT-4o, Defense=w/o Defense2026.0253.25
PhantomTarget Model=GPT-4o, Defense=Delimiter Spotlighting2026.0253.25
Single-TemplateTarget Model=Qwen2-Max, Defense=w/o Defense2026.0253.25
Semantic-InjectionTarget Model=DeepSeek-V3, Defense=Delimiter Spotlighting2026.0253.25
PhantomTarget Model=Qwen2-Flash, Defense=Delimiter Spotlighting2026.0254.55
Qwen-3Prompt=InjecPrompt, Technique=ChatInject2025.0954.8
GPT-ossPrompt=Multi-turn, Technique=ChatInject2025.0955.5
PhantomTarget Model=Qwen2-Flash, Defense=w/o Defense2026.0255.84
Qwen-3Prompt=Multi-turn, Technique=default2025.0960.9
PhantomTarget Model=Qwen2-Max, Defense=Delimiter Spotlighting2026.0263.64
Qwen-3Prompt=InjecPrompt, Technique=ChatInject + think2025.0966.1
Single-TemplateTarget Model=DeepSeek-V3, Defense=w/o Defense2026.0266.23
PhantomTarget Model=Qwen2-Max, Defense=w/o Defense2026.0267.53
PhantomTarget Model=GPT-4o-Mini, Defense=w/o Defense2026.0267.53
Single-TemplateTarget Model=DeepSeek-V3, Defense=Delimiter Spotlighting2026.0268.67
Qwen-3Prompt=InjecPrompt, Technique=ChatInject + tool2025.0969.4
PhantomTarget Model=GPT-4o-Mini, Defense=Delimiter Spotlighting2026.0269.48
PhantomTarget Model=GPT-4o-Mini, Defense=Tag Filter2026.0269.48
PhantomTarget Model=Gemini-1.0-Flash, Defense=w/o Defense2026.0272.73
PhantomTarget Model=GPT-4, Defense=Tag Filter2026.0274.03
PhantomTarget Model=GPT-4, Defense=w/o Defense2026.0275.97
PhantomTarget Model=GPT-4, Defense=Delimiter Spotlighting2026.0276.62
PhantomTarget Model=DeepSeek-V3, Defense=w/o Defense2026.0278.57
PhantomTarget Model=DeepSeek-V3, Defense=Delimiter Spotlighting2026.0279.87
Qwen-3Prompt=Multi-turn, Technique=ChatInject2025.0980.5