# Agentic Prompt Injection Defense on AgentDojo (test) Source: [Agentic Prompt Injection Defense on AgentDojo (test)]() Collection index: [llms.txt]() Data updated: 2026-02-26T05:24:01.534Z Evaluation of model defense mechanisms against agentic prompt injection attacks using the test set of the AgentDojo dataset. Metrics focus on detailed Attack Success Rate (ASR) and Unauthorized Access (UA) across specific attack vectors, alongside Baseline Utility (BU). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Agentic Prompt Injection Defense | | Dataset (including any stated split) | AgentDojo (test) | | Metric | ASR (Direct) | | Unit | PERCENT | | Direction | Lower is better | | Results loaded | 6 of 6 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [ASR (Direct)](): Lower is better; unit: PERCENT. - [ASR (Ign. Prev.)](): Lower is better; unit: PERCENT. - [ASR (Sys. Msg.)](): Lower is better; unit: PERCENT. - [ASR (Imp. Msgs.)](): Lower is better; unit: PERCENT. - [ASR (Avg Under Attack)](): Lower is better; unit: PERCENT. - [UA (Direct)](): Lower is better; unit: PERCENT. - [UA (Ign. Prev.)](): Lower is better; unit: PERCENT. - [UA (Sys. Msg.)](): Lower is better; unit: PERCENT. - [UA (Imp. Msgs.)](): Lower is better; unit: PERCENT. - [UA (Avg Under Attack)](): Lower is better; unit: PERCENT. - [BU (No Attack)](): Higher is better; unit: PERCENT. ## Recorded results | Method | ASR (Direct) | Result date | Report paper | | --- | --- | --- | --- | | MELON | 0 | Not recorded | 6937acf86cfd488761a4e6a2 | | CCA | 0.42 | Not recorded | 6937acf86cfd488761a4e6a2 | | DeBERTa | 0.74 | Not recorded | 6937acf86cfd488761a4e6a2 | | Repeat Prompt | 0.95 | Not recorded | 6937acf86cfd488761a4e6a2 | | No Defense | 2.32 | Not recorded | 6937acf86cfd488761a4e6a2 | | Spotlight | 3.16 | Not recorded | 6937acf86cfd488761a4e6a2 | ### MELON ASR (Direct): 0. Result ID: 69962d5d5698665ec46edf64. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defensive Paradigm":"SOTA runtime verification"}. This record does not assert independent reproduction. ### CCA ASR (Direct): 0.42. Result ID: 69962d5d5698665ec46edf65. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Full Name":"Cognitive Control Architecture"}. This record does not assert independent reproduction. ### DeBERTa ASR (Direct): 0.74. Result ID: 69962d5d5698665ec46edf61. [Reporting paper]() Recorded evaluation configuration: {"Defensive Paradigm":"External model-based classifier"}. This record does not assert independent reproduction. ### Repeat Prompt ASR (Direct): 0.95. Result ID: 69962d5d5698665ec46edf63. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defensive Paradigm":"Prompt engineering-based"}. This record does not assert independent reproduction. ### No Defense ASR (Direct): 2.32. Result ID: 69962d5d5698665ec46edf60. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### Spotlight ASR (Direct): 3.16. Result ID: 69962d5d5698665ec46edf62. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defensive Paradigm":"Prompt engineering-based"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.